Cybersecurity, cryptography, zero-trust architecture, and the battles securing our digital lives.
103 articles
An outside attacker bypassed a VPN in Japan's shared government network, and the Digital Agency now says roughly 246,000 records of officials and contractors may have leaked.
Proofpoint and Volexity reported that four China aligned espionage groups used a shared BlueMoon exploit kit to chain three zero days in Chrome and Windows, exploiting a nearly four week patch gap.
The disclosure shows how AI-assisted tools let a small research team weaponize a voice-chat bug in days, a pace that defenders across the messaging industry now have to assume.
A suspected inflation bug in the sidechain's software let an attacker mint unbacked tokens and redeem them for real bitcoin, and the promise to return the funds has not yet been honored.
The exploit works on fully updated Windows 11 and Server 2025 machines, has no CVE yet, and arrives alongside three other vendor bypasses released by the same researcher in one week.
Enterprises now treat urgent browser patches as a recurring operational event, a rhythm that mirrors how often attackers turn engine flaws into working exploits.
The additions cover vulnerabilities in LiteLLM, Starlette, Kestra and JFrog Artifactory, and federal agencies face remediation deadlines in mid-September.
Attribution of the outage to Tehran, reported days after similar warnings about US water utilities, has turned a small facility's downtime into the clearest evidence yet that state actors can manipulate the industrial software running critical infrastructure.
The write-up catalogs more than 50 MITRE ATT&CK techniques chained across the operation, found no zero-day exploit, and says the intruder capped the intrusion by leaving an 80-page security audit on the victim's systems, evidence of how fast agentic tools are lowering the skill bar.
An espionage campaign has moved its attack surface from endpoints to the authentication layer of enterprise networks, loading malicious code into a process that security tools already trust. Because the payload erases itself from disk after execution, the standard detection playbook, scan for files and signatures, has nothing to find.
Hackers are breaking into exposed PaperCut print servers by chaining two unpatched flaws, then quietly installing SimpleHelp and AnyDesk for lasting access. CISA has added both vulnerabilities to its catalog of actively exploited bugs as emergency fixes roll out.
Reuters reported August 27 that the Aur0ra ransomware group tricked the Cursor AI coding agent into credential theft and account takeovers at seven companies, with cybersecurity firm Gambit Security recovering 28 chat sessions showing the agent was powered by Anthropic's Claude Sonnet 4.5.
The Bureau of Alcohol, Tobacco, Firearms and Explosives notified Congress of a 'major incident' on August 27 after a Russian-linked ransomware group claimed responsibility for stealing internal ATF data, the latest federal agency breach disclosed in 2026.
Pharmaceutical distributor McKesson disclosed a cybersecurity incident on August 28 after the ShinyHunters extortion group claimed it stole roughly 284 million patient-related records via vishing attacks on employees.
Dream Research Labs disclosed on August 12 a four-day operation in early July where up to eight parallel AI sub-agents compromised government systems in Asia, exfiltrating records and credentials and reaching nuclear safety systems.
A suspected Iranian cyberattack took a small UK power station offline for four days in July, the first such incident in Britain, while the FBI warned that attackers are now using AI-generated exploit scripts against Siemens S7 PLCs.
Apollo Global Management confirmed a data breach on August 24 after a voice-phishing attack on an employee in its New York office. The disclosure follows two other major Wall Street incidents this month — a Westlane Capital vendor breach on August 14 and a Cowen prime-brokerage compromise on August 19 — and signals an escalation in financial-sector social-engineering campaigns.
Dark-web monitoring by ThreatMon on August 23 confirmed LockBit 5's posting of ADT, Qilin's addition of two Italian firms, and ShinyHunters' claim of a CyrusOne breach. The same day brought a WordPress ClickFix campaign exposed by Check Point and continued activity from a Lazarus-linked zero-day exploit chain.
CISA, the FBI and HHS said on August 18 that the Medusa ransomware-as-a-service operation has breached more than 500 critical-infrastructure organizations since June 2021. A day later, the agency ordered federal agencies to patch two actively exploited flaws in TrueConf Server within two weeks.
A China-nexus APT compromised 361 organizations across 47 countries within five days of a VMware vCenter patch release, while CISA added four critical vulnerabilities to its KEV catalog on August 18 and set an August 21 patch deadline for Federal Civilian Executive Branch agencies. The combined campaigns collapse the historical patch grace period to days rather than weeks.
CVE-2026-69836, an unauthenticated deserialization flaw in Microsoft's cloud identity service, carries a CVSS 10.0 score. Microsoft says the bug is already mitigated and no customer action is required, but is not disclosing who exploited it or how widely.