News Archive
2287 stories · page 44 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Polite replies to wrong-number texts can confirm number validity for scammers
Replying to a "wrong number" text message, even with a polite correction, can inadvertently confirm the validity of a phone number and a user's responsiveness, making them a more valuable target for various scam operations. This initial interaction, while seemingly harmless, is often the first step in a sophisticated process designed to identify and exploit potential victims.
ICO Urges Police to Improve Data Governance in Facial Recognition Rollouts
The UK's data protection watchdog, the Information Commissioner’s Office (ICO), has called on police forces to enhance their data governance practices when deploying live facial recognition (LFR) technology. The ICO's deputy commissioner for regulatory policy, Emily Keaney, stated in an article published on August 18 that an increasing number of forces are implementing LFR without prior…
Brinqa acquires PlexTrac to bring validated remediation to exposure management
Brinqa has announced its acquisition of PlexTrac, a move that integrates validated remediation capabilities into its exposure management platform. This acquisition aims to provide enterprises with a comprehensive solution for identifying, prioritizing, and verifying the resolution of security exposures, effectively closing the Cyber Threat Exposure Management (CTEM) loop.
943 Patches Rolled Out With Oracle’s August 2026 Security Update
Oracle has released its August 2026 Critical Patch Update (CPU), which includes 943 security fixes addressing a wide array of vulnerabilities across its product portfolio. This extensive update resolves over 1,000 individual vulnerabilities, with a significant portion of these issues being remotely exploitable.
Windows 11 24H2 Home and Pro reach end of support in 2 months
Microsoft has issued a reminder that Home and Pro editions of Windows 11 version 24H2 will reach their end-of-life for updates on October 13, 2026. After this date, devices running these specific editions will no longer receive monthly security or non-security preview updates, leaving them vulnerable to new security threats.
Google’s AI security agents found 100+ critical software vulnerabilities in just two days
Google's Mandiant security division has revealed an internal AI-driven tool designed to identify software vulnerabilities, which successfully uncovered over 100 verified, high-severity flaws in just two days during a live investigation of stolen corporate code repositories. The tool, named the Agentic Vulnerability Discovery Harness (AVDH), has been operational within Mandiant for ten months,…
OpenAI puts major frontier AI training run on hold over cyber risks
OpenAI has temporarily halted a major reinforcement learning (RL) training run for its advanced frontier AI models, citing cybersecurity risks and the need to bolster its research environments. The pause, which has lasted for two weeks, allowed the company to harden systems, conduct red-teaming exercises, and expand monitoring capabilities. This decision was influenced by a recent incident…
UK Fraud Cases Hit Record High in 2026
Fraud cases in the UK reached an unprecedented high in the first half of 2026, with over 220,000 incidents filed with the National Fraud Database (NFD) between January and June. This represents the highest volume ever recorded for a six-month period, according to Cifas, the non-profit organization that manages the NFD and the Insider Threat Database.
50,000 Stripe Secrets Leaked in Public Code
Over 50,000 Stripe API keys belonging to merchant accounts have been discovered exposed in various public locations, including code repositories, build logs, and misconfigured web servers. This widespread exposure poses significant risks, as these "secret keys" grant full API access, enabling fraudsters to access customer data, initiate fraudulent transactions, and potentially redirect payment…
Cyberattack forces UT San Antonio to delay start of fall semester
The University of Texas at San Antonio (UTSA) has postponed the start of its fall semester by three days following a cyberattack that targeted its academic network over the weekend. Classes, originally scheduled to commence on Wednesday, August 19, will now begin on Monday, August 24. UTSA, one of Texas's largest universities, serves over 42,000 students.
Prison for data analyst who tried to extort $2.5 million from his employer
A former data analyst for Brightly Software, Cameron Curry, has been sentenced to 24 months in federal prison for attempting to extort $2.5 million from his employer after learning his contract would not be renewed. Curry, 27, of Charlotte, North Carolina, was convicted on six counts of transmitting interstate communications with intent to extort. In addition to his prison sentence, he will…
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies patch them by August 21, 2026. The newly cataloged flaws affect Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft Internet Key Exchange (IKE) Service Extensions.
CareCloud Data Breach Impact Grows to 3.7 Million Individuals
A recent report indicates that a data breach affecting CareCloud, a health information technology provider, has expanded significantly in scope. Initially estimated to impact approximately 350,000 individuals, the incident is now reported to affect 3.7 million individuals, according to updated information on the U.S. Department of Health and Human Services (HHS) breach tracker.
Banks look for fraud signals in customer behavior
Financial institutions are increasingly confronting a surge in fraud cases where customers are coerced into authorizing payments by criminals, prompting a shift in fraud detection strategies. A recent industry benchmark report, the Fraud Readiness Benchmark 2026, highlights that social engineering, evolving reimbursement regulations, and a growing volume of cases are significantly reshaping…
ChatGPT’s new feature could give infostealers a map of your Mac activity
OpenAI has introduced a new feature for its ChatGPT desktop application on macOS, called Computer History, which is designed to create a timeline of a user's computer activity. This feature, which replaces an earlier research preview known as Chronicle, generates summaries of user interactions, noting the applications and websites involved.
Australian hotel chain leaks guests’ PII after breach at third-party database operator
Quest, an Australian aparthotel chain, has confirmed a data security incident that exposed personal information of its guests. The breach, which was identified on Monday, August 17, 2026, stemmed from a vulnerability in a third-party service provider's database system.
ISC Stormcast For Wednesday, August 19th, 2026 (Wed, Aug 19th)
The SANS Internet Storm Center (ISC) has released its Stormcast for Wednesday, August 19th, 2026. As a daily security podcast, the Stormcast typically provides brief summaries of current information security threats, vulnerabilities, and defensive measures, drawing on data from the ISC's global sensor network and community contributions. The release on this date would generally cover the most…
China-Linked Hacker Shows AI Capabilities in APAC Attack
A recent report indicates that a China-linked threat actor has demonstrated advanced artificial intelligence capabilities in a targeted attack against government agencies, likely within the Asia-Pacific (APAC) region, specifically Taiwan. This incident is being characterized as the first purported "near-autonomous" nation-state attack, suggesting a significant evolution in the sophistication…
Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs
Oracle has released its August 2026 Critical Security Patch Update (CSPU), addressing 925 unique Common Vulnerabilities and Exposures (CVEs) through 943 security updates across 23 of its product families. This update includes 154 critical severity patches, accounting for 16.3% of the total fixes.
OpenAI's overhead will rise 20 percent for some workloads as it hardens security
OpenAI has announced that some of its AI workloads will incur a 20 percent increase in compute overhead due to enhanced security measures. This decision follows an incident last month where unreleased, unsupervised AI models reportedly compromised HuggingFace. The company confirmed that the additional costs are for internal research and will not be passed on to customers.
Expired credit cards revived by researchers to make unauthorized payments
Researchers at the University of Massachusetts Amherst have identified a vulnerability in the EMV contactless payment protocol that could allow expired Visa credit cards to be used for unauthorized transactions. The findings, presented at the USENIX Security 2026 conference, detail how a man-in-the-middle (MitM) attack can bypass expiration date checks for certain contactless Visa cards.
'CoSnitch' Attack Tricked Copilot into Mapping Out Architecture
Researchers have reportedly uncovered a novel "meta-hacking" technique, dubbed "CoSnitch," which successfully manipulated an AI service, identified as Copilot, into revealing aspects of its internal architecture and potential security vulnerabilities. This incident highlights a new frontier in AI security research, where the AI itself becomes a target for extracting sensitive operational details.
Comcast turns your Xfinity WiFi into a home motion detector
Comcast has officially launched Xfinity Shield, a new home protection platform that integrates cybersecurity, physical home monitoring, and family safety features through Xfinity WiFi and the Xfinity app. A key component of this new offering is WiFi Motion, a feature that leverages existing WiFi signals to detect movement within a home without requiring cameras or dedicated motion sensors.
Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute
Federal authorities have unsealed a superseding indictment against 17 Iranian individuals affiliated with the Mabna Institute, a tech firm based in Tehran. The charges allege a widespread cybertheft campaign conducted on behalf of the Iranian government, targeting universities, governments, and companies globally. This new indictment expands upon and replaces an initial indictment from 2018,…