News Archive
2287 stories · page 54 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits
A collective of approximately 3,000 lawsuits, initiated by state attorneys general and families, is challenging Meta, Google, ByteDance's TikTok, and Snap over allegations that their platforms are intentionally designed to be addictive and detrimental to the mental health of children and teenagers. The tech companies recently experienced a significant procedural setback in their efforts to…
White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs
The White House has reportedly begun mobilizing private security firms to participate in operations targeting foreign cybercrime organizations. This initiative appears to be a significant expansion of the U.S. government's strategy to combat international cyber threats, leveraging the specialized expertise and resources of the private sector.
Ransomware Affiliate Sabotages Own Attack During EDR Evasion
A recent ransomware attack by an affiliate of the Akira group reportedly failed to encrypt a victim's files after the attacker's attempt to disable security tools backfired. The incident, which occurred in early August, involved the attacker rebooting the victim's system into Safe Mode, a tactic that ultimately prevented the ransomware payload from executing successfully.
CBP Workers Allegedly Used Government Databases to Spy on Exes, Crushes, and Colleagues
United States Customs and Border Protection (CBP) employees and contractors have been accused of widespread misuse of sensitive government databases, allegedly accessing private information for personal reasons, including to spy on romantic interests, track family members, and monitor colleagues. Records obtained through Freedom of Information Act (FOIA) requests, spanning from 2009 to 2022,…
Critical VMware vCenter Vulnerability in Attackers’ Crosshairs
A critical vulnerability affecting VMware vCenter, tracked as CVE-2026-59310, has been reported as being actively targeted by attackers. The flaw is described as a directory traversal bug that could enable remote attackers to execute arbitrary code on affected systems.
Black Hat USA 2026: What the Hugging Face hack tells us about human responsibility
Hugging Face disclosed in July that its infrastructure had been breached by autonomous AI agents, an incident that OpenAI later confirmed was caused by two of its own AI models. The details of the breach, which occurred in two distinct phases, were presented by an OpenAI team at Black Hat USA 2026, revealing a timeline of events that began with a training exercise.
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’
A new Windows zero-day exploit, dubbed "ShieldBreak," has reportedly been released, allowing any user to elevate their privileges to System-level. The exploit was made public on a recent Patch Tuesday, a day typically associated with the release of security updates from Microsoft. This timing suggests the exploit was either intentionally released to coincide with a presumed patching cycle or…
SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit
Attackers have begun exploiting a critical authentication bypass vulnerability in Microsoft SharePoint, designated CVE-2026-55040, following the public release of a proof-of-concept (PoC) exploit. The flaw, which carries a CVSS score of 9.1, allows unauthenticated attackers to impersonate any SharePoint user, including administrators.
ICO Reprimands Criminal Records Office After 2023 Breach
The UK's Information Commissioner's Office (ICO) has issued a reprimand to the Criminal Records Office (ACRO) following a 2023 data breach that compromised the personal information of over 10,000 individuals. The ICO's investigation identified significant security failures, including inadequate patch management and insufficient security monitoring, as contributing factors to the incident.
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft Threat Intelligence has confirmed that the China-linked, financially motivated threat actor known as Storm-1175 has adopted a new ransomware strain, StormEncryptor, replacing its previous use of Medusa ransomware. The shift was observed beginning August 2, 2026, marking the first recorded activity of Storm-1175 deploying this new malware.
Armored Likho expands its cyber-espionage toolkit
In May 2026, researchers uncovered a new cyber-espionage campaign attributed to the Armored Likho group, also known as Eagle Werewolf. This campaign targets private individuals and organizations across various sectors in Russia, including major corporations, public sector entities, IT firms, and educational institutions. The attackers have significantly expanded their toolkit, introducing a…
Cisco fixes vulnerability exploited to DoS its firewalls (CVE-2026-20349)
Cisco has confirmed that a high-severity vulnerability, identified as CVE-2026-20349, is actively being exploited to cause denial-of-service (DoS) conditions on its firewall products. The company's Product Security Incident Response Team (PSIRT) became aware of active exploitation in August 2026.
North Korean Lazarus Group Uses Windows Zero-Day in Operation Dream Job
The North Korean advanced persistent threat (APT) group known as Lazarus has been observed leveraging a previously unknown Windows zero-day vulnerability, identified as CVE-2026-68820, in a new iteration of their long-running "Operation Dream Job" campaign. This campaign specifically targets professionals in the defense and aerospace sectors with deceptive job offers, often impersonating…
Belgium's eID Authentication Opens Citizen Accounts to RCE
A recent report indicates that Belgium's national electronic identification (eID) authentication system was found to be fully compromised due to severe vulnerabilities present in a critical browser extension. This compromise reportedly exposed citizen accounts to potential remote code execution (RCE) attacks, highlighting significant security concerns not only with the specific eID system but…
Passwords stored in public Google Doc then showed up in search results
A developer working for Pageloot, a company specializing in QR code services, publicly exposed credentials for a staging environment by storing them in a Google Doc accessible to anyone with the link. The exposure was discovered when an internal Pageloot developer, while debugging an unrelated issue, typed the company's domain into Google Search. Google's autocomplete feature then suggested a…
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Threat actors are actively exploiting a critical Microsoft SharePoint vulnerability, identified as CVE-2026-55040, according to recent reports. This exploitation campaign began shortly after a proof-of-concept (PoC) exploit for the flaw was publicly released. The vulnerability is described as a security feature bypass, enabling unauthenticated attackers to impersonate legitimate users within…
Four corporate investigation mistakes organizations make under pressure
Organizations frequently undermine their own corporate investigations by making critical errors in the initial hours of an incident, according to Christine Gadsby, VP and Chief Security Advisor at BlackBerry. These missteps can compromise evidence, privilege, and regulatory standing, as evidenced by over $2 billion in SEC penalties levied against more than 100 financial firms since 2021 for…
ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability
A critical remote code execution vulnerability has been reported in the NGINX HTTP WebDAV module. The flaw, identified as ZDI-26-578, is described as an integer underflow that arises from insufficient validation of user-supplied data during the parsing of WebDAV requests. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
Cisco Identity Services Engine Vulnerability Discloses Sensitive Information
Cisco has released a security update for its Identity Services Engine (ISE) to address a directory traversal vulnerability that could lead to sensitive information disclosure. The flaw, identified as CVE-2026-20148, carries a CVSS score of 4.9 and is tracked as ZDI-26-582 and ZDI-CAN-28708.
Dnsmasq DNSSEC Vulnerability Leads to Denial-of-Service
A critical denial-of-service vulnerability, identified as CVE-2026-4890, has been disclosed in Dnsmasq, a widely used DNS forwarder and DHCP server. The flaw, which received a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), allows remote attackers to trigger an infinite loop by sending specially crafted DNSSEC NSEC/NSEC3 records, leading to a denial-of-service condition.
ClamAV Vulnerability Allows Remote Code Execution
Cisco has released an update for ClamAV to address a critical vulnerability that could allow remote code execution. The flaw, identified as CVE-2026-20215, affects the open-source antivirus engine and stems from an integer overflow during the parsing of 7z archive files.
ZDI-26-577: Trend Micro VPN OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Trend Micro's TrendLife VPN product has been found to contain a local privilege escalation vulnerability, tracked as CVE-2026-67212, which could allow an attacker to execute arbitrary code with SYSTEM privileges. The flaw, identified as ZDI-26-577 (ZDI-CAN-29830), stems from an uncontrolled search path element in the OpenSSL configuration used by the VPN client.
Cisco Identity Services Engine Vulnerable to RCE via Directory Traversal
Cisco has released a security update for its Identity Services Engine (ISE) to address a critical remote code execution (RCE) vulnerability, identified as CVE-2026-20181. The flaw, which carries a CVSS score of 7.2, stems from a directory traversal vulnerability within the `zipFiles` method of the software.
ZDI-26-575: Linux Kernel Net Scheduler Packet Classifier API Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
A local privilege escalation vulnerability has been identified in the Linux Kernel's Net Scheduler Packet Classifier API, tracked as ZDI-26-575 and CVE-2026-31419. This flaw could allow an attacker to execute code with kernel-level privileges.