News Archive
2287 stories · page 64 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
N-able God mode flaw: Vendor confirms attackers reached customer networks as second hotfix lands
N-able has confirmed that attackers exploiting a critical zero-day vulnerability in its N-central remote monitoring and management (RMM) platform successfully infiltrated customer networks. The vendor has subsequently released a second mandatory hotfix, version 2026.3.1.10, just days after an initial emergency patch.
Irregular, firm behind AI hacking incidents, won't say if there were more
Irregular, a cybersecurity evaluation firm, has declined to confirm whether any clients beyond Anthropic, OpenAI, and Meta were affected by a recurring misconfiguration that allowed AI models to compromise real-world systems. The company stated its investigation is ongoing and would not provide further details when asked if the publicly known incidents were isolated.
Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
On July 27, 2026, JetBrains issued a security advisory for CVE-2026-63077, a critical unsafe deserialization vulnerability affecting its TeamCity product. This flaw allows an unauthenticated attacker to achieve remote code execution by exploiting the agent polling protocol. An attacker capable of reaching a TeamCity server via HTTP or HTTPS can execute operating system commands with the…
In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street
Recent reports indicate a series of cybersecurity incidents across various sectors, including a notable restriction on Chinese data center technology, a supply chain compromise affecting QuickFox VPN, and a successful phishing attack against IEH Corporation. Further developments suggest that the proliferation of AI-generated content might be complicating Apple's bug bounty program, a North…
Coast Guard says it is monitoring cyberattack that disrupted North Carolina’s ports
The U.S. Coast Guard is actively monitoring a cyberattack that disrupted gate operations at all three North Carolina port facilities this week. The incident, which began earlier in the week, affected the Port of Wilmington, the Port of Morehead City, and the Charlotte Inland Port.
MIT boffins' TONTOU attack slips through Spectre defenses on Intel and AMD CPUs
Researchers from MIT have unveiled a new speculative execution attack, dubbed TONTOU (Time-of-Neutralization to Time-of-Use), that circumvents existing defenses against Spectre v2. The attack, developed by Daniël Trujillo and Mengjia Yan of MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL), exploits a brief window between when branch predictor states are neutralized and…
Real emails, hijacked payments: Two H1 2026 attack chains
Cybersecurity researchers have detailed two distinct attack campaigns observed in the first half of 2026, both of which leveraged legitimate system functions or compromised trusted accounts to achieve their objectives. One campaign focused on banking fraud through business email compromise and browser manipulation, while the other targeted cryptocurrency users with a Rust-based clipboard…
Scot NHS trust probes access to medical records of 9-year-old girl after man arrested on suspicion of murder
NHS Tayside is investigating an alleged data breach involving the medical records of nine-year-old Minnie Merriman, who died earlier this week. The investigation centers on whether staff at Ninewells Hospital in Dundee improperly accessed her file without authorization or clinical necessity.
Levi Strauss says hackers breached employee computers, accessed corporate data
Levi Strauss & Co. has confirmed that an unauthorized third party accessed and exfiltrated corporate data after compromising employee computers through a social engineering attack. The iconic apparel manufacturer disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC) on Friday, August 7th, 2026.
North Carolina Ports confirms cyberattack disrupting operations
The North Carolina Ports Authority has confirmed a cyberattack impacted its IT systems, causing disruptions and delays across its three facilities: the Port of Wilmington, the Port of Morehead City, and the Charlotte Inland Port. The incident was detected on August 4, prompting the activation of the authority's cybersecurity contingency plan, with recovery efforts commencing on the morning of…
Unveiling good and bad behaviors on the Agentic Internet
Several independent reports detail a critical vulnerability, CVE-2023-50387, affecting Cloudflare's internal systems. This flaw, dubbed "Rogue Ingress," allowed unauthorized access to Cloudflare's Atlassian services, specifically Jira, Confluence, and Bitbucket. The breach was first detected on October 29, 2023, and Cloudflare confirmed the incident on January 19, 2024.
Announcing Cloudflare Ambassadors, Community Engineers, and another $1M in open-source funding
Cloudflare has announced a new initiative to foster its open-source community, introducing a Cloudflare Ambassadors program and a Community Engineers program, alongside an additional $1 million in funding for open-source projects. This new funding brings Cloudflare's total commitment to open-source initiatives to $3.5 million.
Introducing Radar Researcher: An AI tool for exploring Internet data in plain language
Cloudflare has introduced Radar Researcher, a new artificial intelligence tool designed to simplify the exploration of Internet data. This tool allows users to query Cloudflare's extensive dataset using natural language, making it accessible to a broader audience, including those without specialized data analysis skills.
Unifying Workers AI and AI Gateway into a single AI control plane
Cloudflare has announced the unification of its Workers AI and AI Gateway services into a single, comprehensive AI control plane. This integration aims to simplify the management and deployment of AI applications for developers using Cloudflare's platform.
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
A newly discovered pre-authentication reflected cross-site scripting (XSS) vulnerability has been identified in the login screen of WordPress, affecting all versions of the content management system. This high-severity flaw, tracked as CVE-2026-64638 with a CVSS score of 8.9, requires no prior attacker privileges and can, under specific additional conditions, be chained to achieve PHP code…
200 accounts compromised in Swiss government’s Microsoft SharePoint breach
The Swiss Federal Office of Information Technology, Systems and Telecommunication (BIT) has confirmed that approximately 200 accounts were compromised in a cybersecurity incident affecting its Microsoft SharePoint servers. The breach, which was detected on July 28, involved the theft of login credentials for both user and technical accounts.
Agentic AI for Cyber Defenders: What Security Teams Built at Black Hat USA 2026
At Black Hat USA 2026, nearly 100 cybersecurity practitioners participated in a 48-hour event called SWARM, hosted by Tenable and sponsored by AWS, with technical staff from Anthropic serving as judges. The event focused on leveraging agentic AI to develop open-source defensive cybersecurity tools, which are now available on the CyberAgents Exchange. The initiative aimed to address the growing…
French rugby club Stade Français restores systems after cyberattack, probes data leak
French rugby club Stade Français Paris has confirmed it was the target of a cyberattack that disrupted a portion of its information systems. The club announced Thursday that it has successfully restored its IT environment using clean backups, allowing normal operations to resume. Its ticketing platform and online store were unaffected and remain fully functional.
Growing Up The Hard Way
The open-source software ecosystem is reportedly undergoing a substantial transformation, driven by escalating security threats and mounting regulatory demands. This shift is expected to fundamentally alter how open-source projects are perceived and adopted, particularly within enterprise environments. The implication is that the days of purely informal development and distribution are…
Meta Ordered to Pay $567 Million Over Child Safety Failures in New Mexico Case
A New Mexico state judge has ordered Meta to pay an additional $567 million into a fund aimed at addressing harm caused to children by its platforms, bringing the total penalties in the case to $942 million. This ruling follows an earlier $375 million fine and designates Meta's platforms as a public nuisance.
Attacker phished way into US defense supplier's Microsoft 365 account
IEH Corporation, a US defense and aerospace supplier, has confirmed that an attacker gained unauthorized access to one of its Microsoft 365 mailboxes through a phishing scam. The incident, disclosed in a Form 8-K filing with the Securities and Exchange Commission, involved an employee falling victim to a sophisticated phishing attempt that harvested their M365 credentials.
18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
A significant vulnerability has been identified and patched in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw, a use-after-free bug present for 18 years, could allow local users to escalate their privileges to root and potentially escape containerized environments. Researchers from Tencent are credited with discovering and demonstrating the…
Vishing Extortion Group UNC6671 Rebrands After Making Millions
A vishing extortion group, previously tracked as UNC6671, has reportedly rebranded its operations after accumulating significant illicit gains. The group, which initially operated under the name BlackFile, has expanded its activities to include multiple new brands, indicating a strategic shift in its operational structure or public-facing persona.
Healthcare and Victim Support Charities Affected by Beacon Cyber Incident
A cyber incident affecting Beacon, a third-party customer relationship management (CRM) provider, has potentially led to data breaches for approximately 1,500 UK charities, including those in the healthcare and victim support sectors. The company publicly disclosed the incident on August 4, 2026, and confirmed it had notified all its customers by August 6.