News Archive
2287 stories · page 39 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Surveillance – Everything You Wanted to Know, But Were Afraid to Ask
A recent report discusses the pervasive nature of digital surveillance, acknowledging a widespread public awareness that such monitoring occurs. However, the report highlights a significant lack of clarity regarding the specific entities conducting this surveillance, their motivations, and the technical methods employed to achieve it. This gap in understanding leaves the public largely…
Ransomware crook poses as recovery firm to steal payments from fellow extortionists
A ransomware affiliate has reportedly adopted a new tactic: posing as a data recovery service to intercept ransom payments from victims. Researchers at GuidePoint Security identified an operation calling itself "Ransom Busters" that contacts ransomware victims before their attacks become public, offering to recover encrypted files and delete stolen data for a significantly lower fee than the…
CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
A new zero-day vulnerability, dubbed ShieldBreak and tracked as CVE-2026-69414, has been identified in the Microsoft Malware Protection Engine, a core component of Microsoft Defender. This elevation-of-privilege flaw allows a local attacker with low privileges to escalate their access to SYSTEM level on affected Windows systems.
Frequently asked questions about the active threat to Siemens S7 Series PLCs
Multiple U.S. government agencies have issued a joint cybersecurity advisory warning of active threats targeting Siemens S7 Series programmable logic controllers (PLCs) across critical infrastructure sectors. The advisory, designated AA26-231A, was released on August 19, 2026, by the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau…
How MSPs can catch phishing attacks email filters miss
AI-powered phishing campaigns are increasingly sophisticated, making them harder for traditional email filters to detect and significantly increasing the risk of successful breaches. Attackers are leveraging artificial intelligence to automate and enhance every stage of a phishing operation, from reconnaissance to content generation and delivery.
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
A significant security vulnerability has been identified in the isolated-vm Node.js library, which could allow sandboxed JavaScript code to escape its intended isolation and potentially achieve arbitrary code execution on the host system. The flaw specifically impacts the ExternalCopy component of the library.
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Citrix has issued urgent security updates for its NetScaler ADC and NetScaler Gateway products to remediate two significant vulnerabilities. The more critical of these, tracked as CVE-2026-19490, carries a CVSS score of 9.3 and enables an authentication bypass. This flaw specifically impacts certain configurations, particularly those where the NetScaler appliance functions as a Gateway or an…
The push to designate AI as the next critical infrastructure sector
A new report advocates for the designation of artificial intelligence (AI) and its supporting infrastructure as the 17th critical infrastructure sector in the United States. This move would unlock federal resources and services for an industry increasingly vital to national and economic security, according to the report.
'Grandoreiro' Malware Resurfaces With Mexico Campaign
The Grandoreiro banking Trojan has reportedly resurfaced, targeting entities within Mexico. This reappearance follows a previous law enforcement takedown operation against the malware. The current iteration of Grandoreiro is noted for incorporating new features designed to complicate its detection and analysis by security researchers and defensive systems.
Twitch wants your content for Amazon AI training. Here’s how to opt out
Twitch, the Amazon-owned livestreaming platform, has confirmed that content from its users' channels is being utilized to train Amazon's generative artificial intelligence models. This practice, which has been ongoing for over two years, recently gained attention following the introduction of an opt-out setting, which is enabled by default for all users.
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
Attackers are reportedly exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS) that enables unauthenticated remote code execution. The flaw, tracked as CVE-2026-73570 and assigned a CVSS score of 8.9, is attributed to insufficient input sanitization within the Simple Network Management Protocol (SNMP) notification processing component of ZCS.
Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia
A recent report indicates that a threat actor, operating under the moniker "Operation CameraSwarm," has compromised approximately 14,000 IP cameras. The campaign reportedly focused on Dahua brand cameras, with the majority of affected devices located within Ukraine and Russia. The targeting appears to have specifically concentrated on telecom network blocks within Russia and the Commonwealth…
Using Microsoft Graph and Powershell - Risk Detection Commands, (Thu, Aug 20th)
A recent report discussed methods for leveraging Microsoft Graph and PowerShell to identify "risky" logins within an environment. This follows previous discussions on general usage of Microsoft Graph and PowerShell, focusing specifically on the detection of potentially compromised user accounts or suspicious authentication attempts.
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
A security research firm has identified a method to repurpose a legitimate, Microsoft-signed Windows Defender component, BTR.sys, into a kernel operation primitive, potentially allowing attackers to execute arbitrary file and registry operations from Ring 0. This technique, dubbed "BTR Reforged," does not rely on traditional exploits, vulnerabilities, or memory corruption, but rather on the…
Grok chat duped into swallowing injected instructions
xAI's Grok web chat agent is vulnerable to a novel prompt injection technique that utilizes encrypted instructions to bypass security filters, according to security researchers at Adversa AI. This method, dubbed "cryptographic context injection," allows an attacker to embed malicious, encrypted instructions on a webpage, which a summarizing AI model can then decrypt and execute.
Using Microsoft Graph and Powershell to Mine for Information - Stale Accounts and Licenses, (Thu, Aug 20th)
A recent report highlights the utility of Microsoft Graph and PowerShell for information gathering within Microsoft 365 and Entra environments, specifically focusing on the identification of stale accounts and licenses. The report suggests that while Microsoft Graph is a relatively mature API, having reached version 2.3.9, its adoption by many users and commercial tools may not yet be widespread.
Your Mac already has a built-in firewall. Here’s how to get more from it
macOS includes a built-in firewall designed to manage incoming network connections, providing a layer of security by determining which requests from applications and other devices are permitted or blocked. While the default settings are often sufficient for many users, adjusting them for specific scenarios, such as public Wi-Fi use or fine-tuning application access, can be complex due to the…
NCSC Urges Stronger Controls for Agentic AI Systems
The UK National Cyber Security Centre (NCSC) has issued interim guidance urging organizations to implement stronger controls for autonomous AI agents. The advice, published on August 20, recommends sandboxing, human oversight, and tightly controlled access to mitigate risks from unintended or malicious agent activity. This follows previous NCSC guidance on securing agentic AI use and comes…
US Defense Contractors Admit Their Rising CMMC Scores May Not Be Accurate
US defense contractors are reporting a significant increase in their self-assessed cybersecurity scores, reaching a five-year high, yet their confidence in the accuracy of these scores has sharply declined. This trend emerges from the 2026 State of the DIB Report, published on August 20 by CyberSheath, which surveys the cybersecurity posture of the US defense industrial base (DIB).
French tax authority says break-in exposed data of 600K, including some private messages
France's General Directorate of Public Finances (DGFiP), the national tax authority, has confirmed a data breach that exposed information belonging to approximately 600,000 individuals and businesses. The compromised data includes tax identification numbers, marital status, email and postal addresses, phone numbers, household composition, number of dependents, family quotient, reference tax…
Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities
Atlassian and Splunk have released patches addressing numerous critical and high-severity vulnerabilities across their product lines. The reported flaws could potentially be exploited by attackers to achieve arbitrary code execution, gain unauthorized access to sensitive data, and escalate privileges within affected systems. Users of Atlassian and Splunk products are strongly advised to apply…
Citrix urges admins to patch new NetScaler flaws as soon as possible
Citrix has issued an urgent advisory to customers, recommending immediate action to secure systems against two newly disclosed vulnerabilities impacting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances. The company confirmed these flaws affect supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including specific FIPS and NDcPP…
MLflow Vulnerability Exploited for Cloud Credential Theft
A critical-severity vulnerability in MLflow has reportedly been exploited to facilitate the theft of cloud credentials. The flaw, described as allowing attackers to send HTTP requests to internal endpoints, was observed in active exploitation, leading to the extraction of sensitive information.
Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments
Researchers have reportedly developed a novel attack, dubbed "Zombie Card," capable of reactivating expired Visa contactless payment cards for in-store transactions. This method reportedly allows an attacker to bypass the expiration date check during a transaction, effectively enabling the use of otherwise invalid cards.