CISA has added the exploited flaw, CVE-2026-53362, to its KEV catalog, alongside a JFrog vulnerability exploited by OpenAI agents.
The post OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems appeared first on SecurityWeek.
PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. [...]
New research shows that country-of-origin labels can obscure an AI model’s upstream dependencies, inherited behaviors and potential security risks.
The post Think You’ve Eliminated Chinese AI? Check the Model’s Lineage, Cisco Says appeared first on SecurityWeek.
Nearly 130 tech and cybersecurity companies back a collective call to boost cyber defenses as AI-enabled attacks grow more sophisticated.
The post Tech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense Pledge appeared first on SecurityWeek.
Noteworthy stories that might have slipped under the radar: Manchester Airports Group cyberattack, Carhartt breach data was partly fake, U.S. Bank responds to ransomware gang’s claims.
The post In Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker Sanctions appeared first on SecurityWeek.
The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retailer giant Carhartt earlier this month, according to data breach notification service Have I Been Pwned. [...]
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever.
In a statement released today, the Australian Federal Police (AFP) said two unnam…
agrupados por: alleged · teampcp · australia · hackers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. [...]
The West African nation launched financing, procurement, and infrastructure policies to boost its sovereign cloud initiative and increase domestic technical knowledge.
AxiosRELIABLE 7.5geopolítica✓ 20 fuentesWed, 26 Aug 2026 17:51:19
A federal judge removed a nationwide ban on President Trump's sweeping mail-in voting policy Wednesday after the Supreme Court cleared the way earlier this week.The big picture: The decision removes the last major legal obstacle to the administration's plan, though it does not end the court challeng…
Claude Security, currently in public beta for Claude Enterprise customers, now runs codebase scans on Mythos 5.
The post Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund appeared first on SecurityWeek.
CISA is urging government agencies to immediately patch the Citrix NetScaler vulnerability tracked as CVE-2026-8452.
The post Recent Citrix NetScaler Vulnerability Exploited in the Wild appeared first on SecurityWeek.
A large distributed denial-of-service (DDoS) attack has disrupted Norway's shared government digital infrastructure since Monday, affecting services used by the public sector. [...]
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
The post The Future of AI-Driven Security Depends on Complete Data appeared first on SecurityWeek.
Medical technology company Boston Scientific has been targeted in a cyberattack that disrupted some of its IT systems, causing operational disruptions globally. [...]
agrupados por: boston · cyberattack · scientific · disruption
SecurityWeek talks to Chris Wheeler, CISO at Resilience, about his journey from the Navy to becoming a cybersecurity leader.
The post CISO Conversations: Chris Wheeler – Trust Is the Job, From the Navy to the C-Suite appeared first on SecurityWeek.
The identity security company beat quarterly expectations and raised its outlook as enterprises face growing pressure to secure AI agents and other non-human identities.
The post Okta Shares Surge on Strong Earnings, Growing Demand for AI Identity Security appeared first on SecurityWeek.
When Android users get a call from a non-contact, they will see more information about the caller, including their country.
The post WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update appeared first on SecurityWeek.
The U.S. Department of the Treasury has announced fresh sanctions on Iranian cyber actors as part of what it called an "unprecedented, whole-of-government, economic campaign" against the nation and its enablers.
"We are launching an economic onslaught against Iran's financial connections around the…
War on the RocksRELIABLE 8.0defensa✓ 18 fuentes📎 bien sourced📊 datosTue, 18 Aug 2026 07:00:57
On June 26, 2026, the Civil Police of Rio de Janeiro, through its specialized firearms, ammunition, and explosives unit, raided a clandestine workshop in Rio das Pedras, on the city’s west side. Investigators said the group used a 3D printer seized at the scene to produce pistol frames and structura…
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. [...]
agrupados por: head · malware · android · units · botnet
Cybersecurity company ReliaQuest has confirmed that one of its employees was targeted in a social engineering attack after hackers impersonated a member of the security team. [...]
AI infrastructure, including advanced semiconductors mostly made in Taiwan, has become a key point of competition between the U.S. and China.
The post Taiwan Charges 9 Over Illegal AI Server Exports to China, Including Nvidia and Super Micro Staff appeared first on SecurityWeek.
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
The post Silent Patches Don’t Stop Attackers – They Blind Defenders appeared first on SecurityWeek.
Hands-on Cyber Attack Methods course returns to SecurityWeek’s ICS Cybersecurity Conference, October 6–8 at the W Nashville.
The post Hands-On Cyber-Physical Systems Training Returns to ICS Cybersecurity Conference appeared first on SecurityWeek.
CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin.
The post WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities appeared first on SecurityWeek.
The company, previously known as ActiveFence, has raised a total of $280 million from investors.
The post Alice Raises $140M to Expand AI Model Defenses and Enterprise Guardrails appeared first on SecurityWeek.
TRACE was developed by AMD, Intel, Microsoft, OPAQUE, and TII and contributed to the Linux Foundation.
The post Linux Foundation to Govern TRACE, an Open Standard for AI Runtime Attestation appeared first on SecurityWeek.
TikTok will pay $300 million immediately and another $100 million after an order vacates an earlier consent decree against its predecessor company, Musical.ly.
The post TikTok Reaches $400 Million Settlement With US Justice Department Over Children’s Privacy appeared first on SecurityWeek.
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
The post Rethinking Application Security for the AI Era appeared first on SecurityWeek.
The private equity firm said attackers broke into some of its cloud platforms during a five-day period in early July, compromising sensitive personal data.
The post Apollo discloses data breach from ongoing wave of attacks hitting financial sector appeared first on CyberScoop.
Juan Manuel Gouveia-Aguilera has been sentenced to 8 years in prison for his role in an ATM jackpotting scheme that caused millions in losses.
The post Venezuelan Gets Record Federal Prison Term for ATM Jackpotting appeared first on SecurityWeek.
More than 200 vulnerabilities have been patched to date this year, compared to only 16 in 2025 and 22 in 2024.
The post 91 Vulnerabilities Patched in Spring Application Framework appeared first on SecurityWeek.
Dutch Data Protection Authority said it is imposing a fine of 825 million euros because Uber violated the EU’s General Data Protection Regulation.
The post Uber Fined Nearly $1 Billion by Dutch Regulators Over Automated Suspensions of Driver Accounts appeared first on SecurityWeek.
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
The post Hired for One Job, Judged on Another: The CISO’s Real Problem appeared first on SecurityWeek.
Update: The story was updated after publication to note that the vulnerability has not been exploited.
Although the security bulletin originally marked the "Exploited" field under the Exploitability Assessment table as "Yes," on August 21, 2026, Microsoft corrected the "Exploited" status to "No" af…
Two industry surveys released this week by Kiteworks and CyberSheath paint a consistent picture of the defense industrial base.
The post Contractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind appeared first on SecurityWeek.
Cybersecurity researchers have disclosed a critical security flaw in isolated-vm, a popular open-source sandbox with more than 2,900 stars and 190 forks on GitHub, that could allow attackers to escape the confines of the isolated environment.
The vulnerability ("GHSA-864f-rcv7-6rh4"), which has yet…
Researchers say the new ‘Cryptographic Context Injection’ technique conceals malicious instructions until they are decrypted inside a trusted execution environment.
The post Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini appeared first on SecurityWeek.
Other noteworthy stories that might have slipped under the radar: Threema DDoS attack, Evooo1Bot Linux botnet, Crypto4A secures top-tier NIST certification.
The post In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug appeared first on SecurityWeek.
The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware.
The post Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight appeared first on SecurityWeek.
The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches.
The post Adobe Commerce Bug Targeted Immediately After Disclosure appeared first on SecurityWeek.
Significant cybersecurity M&A deals announced by Barracuda, CrowdStrike, Cyera, Okta, Palo Alto Networks, and Qualcomm.
The post Cybersecurity M&A Roundup: 21 Deals Announced in July 2026 appeared first on SecurityWeek.
The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies.
The post AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions appeared first on SecurityWeek.
The security defect is described as an SQL injection that could allow attackers to achieve remote code execution.
The post Hackers Exploiting Unpatched GeoServer Zero-Day appeared first on SecurityWeek.
Hackers stole the customers’ shipping information, including names, addresses, email addresses, and phone numbers.
The post 14,000 Trezor Customers Impacted by Data Breach at ShipMonk appeared first on SecurityWeek.
The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts.
The post Over 1,000 Charities Hit by Beacon CRM Data Breach appeared first on SecurityWeek.
The hackers published the allegedly stolen information, including names, addresses, email addresses, and phone numbers.
The post 1.6 Million Likely Impacted by RingCentral Data Breach appeared first on SecurityWeek.
Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028.
The post Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal appeared first on SecurityWeek.
Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.
The post Trivy, Not LiteLLM Behind the 2,500 Org Compromise appeared first on SecurityWeek.
Noteworthy stories that might have slipped under the radar: government AI platform deal sparks outrage, North Korean IT worker breaches federal agency, DEF CON attendee blamed for Delta flight disruption.
The post In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilit…
A Go module is used to load PowerShell code that fetches a resolver from public dead drops to execute Windows malware.
The post Network of 200 GitHub Repositories Used for Malware Infection appeared first on SecurityWeek.
Researchers demonstrate adversarial hallucination squatting against popular AI assistants to achieve remote code execution.
The post ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism appeared first on SecurityWeek.
The backdoor’s destructive capabilities include a standalone wiper, ransomware encryption, and a multi-pass wiping command.
The post GigaWiper Combines Multiple Malware for System-Level Sabotage appeared first on SecurityWeek.
The attackers call victims to direct them to phishing websites mirroring Microsoft Entra ID login pages.
The post Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers appeared first on SecurityWeek.
Both foes and allies have targeted the Balochistan Police force in Pakistan for at least two years, according to SentinelOne.
The post China, India-Linked Hackers Both Targeted Same Pakistani Police Force appeared first on SecurityWeek.
Angelo Martino, a former ransomware negotiator, was sentenced to 70 months for helping the BlackCat/Alphv group.
The post Third US Security Expert Sentenced to Prison for Helping Ransomware Gang appeared first on SecurityWeek.
Other noteworthy stories that might have slipped under the radar: Abnormal AI sued by Anthropic, AssuranceAmerica data breach affects 7 million people, NSA brings back TAO.
The post In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops appeared first on Secur…
Multiple campaigns are using ghost accounts to map GitHub organizations, including their repositories and members.
The post Ghost Accounts Abuse GitHub API in Mass Recon Campaign appeared first on SecurityWeek.
The Spanish startup has closed an extended pre-seed funding round two months after launching its digital identity protection platform.
The post 8Layers Raises $2.9 Million for Identity Security Platform appeared first on SecurityWeek.
The security refresh resolves 13 use-after-free bugs, including two critical-severity flaws found by Google.
The post Chrome 150 Update Patches 27 Vulnerabilities appeared first on SecurityWeek.
Wiz has disclosed the details of a new AI coding assistant attack method it has dubbed GhostApproval.
The post AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique appeared first on SecurityWeek.
Hackers accessed the institution’s internal network and deleted two drives containing employee, student, and university data.
The post Mount Royal University Confirms Data Stolen in Ransomware Attack appeared first on SecurityWeek.
The privilege escalation vulnerability tracked as CVE-2026-50656 has been patched with a Microsoft Malware Protection Engine update.
The post Microsoft Patches Defender ‘RoguePlanet’ Vulnerability appeared first on SecurityWeek.
Affecting every major distribution since 2011, the Linux kernel vulnerability allows attackers to gain root access.
The post 15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google appeared first on SecurityWeek.
Hackers exploited a zero-day vulnerability in a third-party system to access a KDDI email system for ISPs.
The post 12 Million Impacted by Data Breach at Japanese Telco KDDI appeared first on SecurityWeek.
Buffer overflow, DoS, command injection, SSRF, authentication bypass, and other types of vulnerabilities have been found in PAN-OS software.
The post Palo Alto Networks Patches 13 Vulnerabilities appeared first on SecurityWeek.
Two announcements on July 7, 2026, demonstrate the government’s determination to improve the level of cybersecurity within the UK.
The post UK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge appeared first on SecurityWeek.
The Israeli company has developed a cryptographic posture and post-quantum cryptography management platform.
The post QIZ Security Raises $17 Million for Cryptographic Governance Platform appeared first on SecurityWeek.
Researchers uncovered two campaigns embedding indirect prompt injections in malicious websites to exploit autonomous AI agents browsing the web.
The post Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments appeared first on SecurityWeek.
Organizations are urged to patch after proof-of-concept code makes the Linux root escalation flaw easier to exploit.
The post Proof-of-Concept Exploit Released for Linux ‘Bad Epoll’ Root Access Vulnerability appeared first on SecurityWeek.
The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer to developers.
The post North Korean Hackers Target Open Source Developers in Supply Chain Attacks appeared first on SecurityWeek.
The threat actor uses modular RATs and information stealers in financially motivated and cyber espionage campaigns.
The post Armored Likho APT Targeting Government, Electric Power Entities appeared first on SecurityWeek.
Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences.
The post The Shift Toward Business-Aligned Risk Management appeared first on SecurityWeek.
Securonix says the sophisticated framework abuses compromised websites, Blogspot, PowerShell, and fileless techniques to evade detection and deploy the PureLog information stealer.
The post Blogspot-Hosted Payloads Delivered in ‘Veil#Drop’ Attacks appeared first on SecurityWeek.
