News Archive
2287 stories · page 56 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Walmart's "Trusted Agent" Approach to Purple Teaming
Walmart has reportedly implemented a "Trusted Agent" approach to its purple teaming exercises, a strategy designed to integrate its red and blue security teams through co-location. This method seeks to cultivate trust and improve collaboration between the offensive and defensive security functions, with the ultimate goal of strengthening the company's overall security posture.
Plug and Pwn attack uses fake USB devices for Windows SYSTEM access
Security researchers Alejandro Hernando and Borja Martínez have unveiled a new class of "Plug and Pwn" attacks that leverage the Windows Plug and Play feature to achieve SYSTEM-level privileges. Presented at DEF CON 34, their research demonstrates how Windows' automatic hardware identification and driver installation process can be exploited to install vulnerable or insecure vendor software.
Lazarus hackers exploited Windows zero-day to target defense firms
North Korean state-sponsored hackers, identified as the Lazarus Group, have been exploiting a Windows zero-day vulnerability, designated CVE-2026-68820, as part of their ongoing Operation Dream Job campaign. The vulnerability, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys), allows for local privilege escalation. Microsoft confirmed the active exploitation…
SharePoint Vulnerability Exploited Shortly After PoC Release
A vulnerability affecting Microsoft SharePoint has reportedly been exploited in the wild shortly after the release of a proof-of-concept (PoC) exploit. The flaw was previously patched by Microsoft in July, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had issued a warning regarding its potential for active exploitation.
“Zoomsday” flaws could let one Zoom participant attack another
Three vulnerabilities, collectively dubbed "Zoomsday" by researchers, have been identified in the Zoom meeting platform. These flaws, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, could enable one participant in a Zoom meeting to compromise another through specially crafted collaboration data.
Uber Freight Investigates Data Breach After Extortion Group Claims Attack
Uber Freight is investigating a data security incident after the Helix extortion group claimed to have stolen nearly 1 million files from the logistics company. Helix listed Uber Freight on its data leak site on August 6, alleging compromise of mailboxes, OneDrive accounts, and accounts receivable data, among other repositories.
WindRelay Malware Pairs With SpyNote RAT in Live-Call Scam
A new NFC relay malware, dubbed WindRelay, has been observed in the wild, operating in conjunction with a variant of the SpyNote remote access trojan (RAT) to facilitate real-time financial fraud. Cybersecurity researchers at Group-IB documented a specific incident where a fraudster used this combination during a 13-minute phone call to steal a victim's card data and secure a loan in their name.
Linux Kernel Process Accounting, (Wed, Aug 12th)
A recent report highlighted the utility of Linux kernel process accounting as an alternative or supplementary method for gaining insight into command history and system activity. This discussion emerged in response to an earlier mention of the Atuin tool, which aims to enhance the organization and data collection capabilities beyond the standard bash history. The reader's comment suggested…
FBI: Hackers target online accounts to steal nude photos
The Federal Bureau of Investigation (FBI) has issued a public service announcement warning that cybercriminals are actively targeting online accounts belonging to both adults and children to steal sexually explicit images and videos. This stolen content is then used for blackmail, sold on illicit marketplaces, or shared with other criminals who may further pressure victims into providing…
737 Chrome Extensions Caught Routing User Traffic Through Proxies
A recent report indicates that 737 Google Chrome extensions have been identified as surreptitiously routing user browser traffic through proxy servers. These extensions, which collectively amassed over 75,000 installations, were primarily observed targeting Russian-speaking users. The core functionality of these extensions appears to be the circumvention of geo-restrictions or service blocks,…
The Threat Hiding in Your Hiring Process: How Fake Remote Workers Get In
North Korean IT workers are reportedly exploiting vulnerabilities in remote hiring processes to gain employment with foreign companies, exfiltrate sensitive data, and funnel salaries back to North Korea. These operations leverage sophisticated tactics to bypass standard identity verification and onboarding controls, according to a July alert from the US Department of State and warnings from…
Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition
The Colombian Ministry of Justice has reportedly been impacted by a ransomware attack, an incident that occurred just days prior to a scheduled presidential transition. This event highlights a continuing trend of cyberattacks targeting critical infrastructure and government-affiliated entities within Colombia, aligning with a broader increase in malicious cyber activity observed across Latin…
A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
A campaign dubbed "City-Forum" has been observed exfiltrating data from public-facing Salesforce and ServiceNow portals globally for at least 17 months, according to researchers at Reco. The activity, which began no later than March 2025, involves an attacker operating from a single, consistent IP address associated with a German hosting provider.
Patch Tuesday: Update now to fix 421 flaws, including three zero-days
Microsoft’s August 2026 Patch Tuesday addresses 421 vulnerabilities across its product line, including 62 rated as critical. The update package, while smaller than July’s record release, remains one of the largest Patch Tuesday batches to date. Among the fixes are three zero-day vulnerabilities, one of which has been actively exploited in the wild by the Lazarus group.
Signal’s new security feature checks if your encrypted chats were tampered with
Signal has introduced a new security feature called automatic key verification, designed to provide users with an additional method to confirm the integrity of their encrypted chats. This feature aims to ensure that no unauthorized third party has secretly interfered with an end-to-end encrypted session.
ScienceLogic delivers secure AI deployment and smarter IT operations with Skylar AI 2.5
ScienceLogic has announced the release of Skylar AI 2.5, an update to its AI platform designed to enhance secure deployment options for organizations with stringent security, sovereignty, and compliance requirements. The new version also introduces improvements to AI performance, operational intelligence, and enterprise integrations.
Exposed: Woeful security at UK criminal records office that led to sensitive data leak
The UK's criminal records office, ACRO, has received a regulatory reprimand from the Information Commissioner's Office (ICO) following security failures that potentially exposed sensitive data belonging to nearly 11,000 individuals. The incident, initially disclosed by ACRO in April 2023, involved persistent attacker access to their website and content management system for over seven months,…
Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day
The North Korean-backed Lazarus Group has been observed deploying a Windows zero-day exploit, CVE-2026-68820, using a command channel secured with a post-quantum key exchange mechanism. This activity is part of the ongoing "Operation Dream Job" campaign, which targets employees at defense and aerospace companies in Europe and India with fraudulent job offers.
Black Hat USA 2026: AI is racing ahead of cybersecurity controls
AI's rapid advancement is outpacing current cybersecurity controls and accountability frameworks, a central theme at Black Hat USA 2026. Discussions highlighted the increasing speed and volume of vulnerability discovery by AI-powered systems, alongside concerns about the lack of clear ownership and governance for AI actions.
Deloitte strengthens AI governance to support trusted enterprise adoption
Deloitte has announced an expansion of its AI Controls and Assurance services and solutions, aiming to assist organizations in the confident adoption, scaling, and governance of artificial intelligence across their operations. These enhanced services are designed to offer comprehensive support throughout the AI lifecycle, from initial exploration to enterprise-wide deployment, by integrating…
Mindgard Raises $30 Million to Protect AI Systems
Mindgard, a cybersecurity startup focused on the protection of artificial intelligence systems, has reportedly secured $30 million in new investment. This funding round is intended to facilitate the expansion of the company's operational capabilities across several key departments.
Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure
A joint advisory from U.S. and Republic of Korea authorities has warned that the Gunra ransomware-as-a-service (RaaS) operation is actively exploiting two Fortinet vulnerabilities to target government and critical national infrastructure organizations. The advisory, issued on August 10, was authored by the FBI, CISA, and other U.S. government agencies, alongside the Republic of Korea’s…
Three intrusions at UK criminal records office went undetected for two years
The UK's ACRO Criminal Records Office, a national policing unit responsible for sensitive data on the Police National Computer, was subjected to three separate security intrusions over a period of nearly two years, exposing the personal data of thousands of individuals. The incidents, which occurred between July 2021 and June 2023, went largely undetected due to a series of fundamental…
AI is Working in the SOC. So Why are Security Executives More Worried Than Ever?
Artificial intelligence has become a foundational element in security operations centers (SOCs) over the past two years, moving beyond pilot programs to become a core strategy. A recent survey of 500 security professionals, conducted by Omdia and commissioned by Rapid7, indicates widespread positive outcomes from this shift.