The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
F5 BIG-IP privilege escalation via TMUI
CVE-2026-66842 (CVSS 8.8) lets an authenticated user create administrative accounts through the BIG-IP Traffic Management User Interface, resulting in full system privilege escalation.
-
Talassoft Industrial Management Software SQL injection
CVE-2026-18630 (CVSS 8.8) is an SQL injection flaw in Talassoft Industrial Management Software from TMT Machine Industry and Trade Ltd, allowing low-privilege network attackers unauthorized database access.
-
Rockwell Automation DataMosaix Private Cloud unauthenticated data exposure
DataMosaix Private Cloud (CVE-2024-7952, CVSS 8.7) contains hardcoded links to JSON files reachable without authentication, exposing customer data. This is a late disclosure of an existing CVE, newly published in today's vulnerability feeds.
-
Node.js runtime abused for malware delivery against government, tech, and hotel targets
Threat actors are running malicious scripts through node.exe, a legitimately signed developer tool, to evade detection. The campaign has been active since February 2026 against government departments, tech companies, and hotels, using tools including Backdoor.Mistic, C2Looper, and a new…
-
CrowdStrike Falcon Sensor privilege escalation PoC ("FalconFlank")
A researcher publicly released proof-of-concept code for a privilege escalation flaw in CrowdStrike Falcon Sensor for Windows. The bug reportedly abuses Falcon's macro-cleanup routine, which runs elevated, to let a low-privileged local user gain higher access. CrowdStrike has not confirmed the…
-
Texas and Florida order removal of license-plate-reader cameras from state infrastructure
Texas Gov. Abbott (Aug 28) barred state agencies from spending public funds on Flock ALPR cameras, timed just ahead of a Texas Tribune investigation showing a state agency had funneled $30M+ into a surveillance network. Florida DOT (Aug 31, announced by Gov. DeSantis) ordered all ALPRs removed…
-
Incransom claims ransomware attack on Specialty Textile Services
The Incransom ransomware group claimed a breach of Specialty Textile Services, a US textile services company, threatening to leak data absent negotiation. Details are limited to the group's claim; no independent confirmation from the victim yet. Source is a lower-profile threat-intel aggregator…
-
Dropbox confirms 5,000 accounts compromised via legacy Lenovo ID integration
Attackers created Lenovo IDs using just a victim's email address, then linked them to the victim's Dropbox account through a legacy integration that never verified email ownership. Roughly 5,000 accounts were affected between August 4 and August 21, with about a third of those having files viewed…
-
GitSpawn: new vulnerability class lets malicious repos silently run code in AI coding agents
Manifold Security disclosed eight flaws across seven CLI-based AI coding agents (Claude Code, OpenAI Codex, Cursor, Grok Build, Goose, Hermes Agent, Qwen Code). The agents run routine git commands like git status in the background for context; git's core.fsmonitor setting lets a repo specify a…
-
SonicWall SMA1000 zero-days chained for unauthenticated remote code execution
SonicWall confirmed active exploitation of two previously undisclosed flaws in SMA1000 series appliances (models 6210, 7210, 8200v): CVE-2026-83548, a pre-auth SSRF in the Appliance Work Place interface (CVSS 10), and CVE-2026-83549, an OS command injection in the Appliance Management Console…
-
"Threat actors don't want better attacks, they want repeatable ones" — ClickFix and living-off-the-land dominate
Cites Microsoft data showing ClickFix (fake CAPTCHA that walks victims through pasting a malicious command) was the most common initial access method observed last year at 47% of notified attacks, and Bitdefender data showing 84% of high-severity incidents across 700,000 analyzed cases used…
-
METR discloses two security incidents, including a stolen API key that burned ~$600K in AI credits
METR, a nonprofit that evaluates frontier AI models for dangerous agentic capabilities, disclosed that in March 2026 attackers stole an API key and consumed roughly $600,000 in inference credits, and in May 2026 attackers probed its public infrastructure including an unsuccessful attempt at…
-
Internet-exposed OT and edge devices remain the top disruptive-risk focus
This digest synthesizes a UK NCSC advisory (Aug 27) on rising OT targeting and a Claroty Team82 analysis of 200+ cyber-physical attacks over 12 months, finding 82% involved VNC-based remote access to exposed assets and 66% involved compromised HMIs or SCADA systems. Recommendations: asset…
-
Coalition launches Active Cyber Insurance for Enterprises, up to £20M in UK limits
Coalition expanded its Allianz Commercial partnership to offer up to £20 million in cyber limits to large UK enterprises, following a US launch of the same enterprise product in July. The pitch centers on real-time telemetry from Coalition's honeypot network feeding underwriting decisions…
-
Iranian Nimbus Manticore poses as recruiters to plant cross-platform RATs
Kaspersky attributes two new malware families, NodeRabbit and PollCat, to the Iranian group Nimbus Manticore. Both are cross-platform RATs (Node.js/JavaScript) delivered via spear-phishing on LinkedIn and job boards using trojanized coding-challenge archives, expanding the group's reach to Linux…
-
Attackers exploit critical JFrog Artifactory auth bypass to mint admin tokens
CVE-2026-82329 (CVSS 9.8) lets an unauthenticated attacker with network access obtain admin privileges on self-managed JFrog Artifactory, exploiting a "phantom" join key issued to instances without one configured. JFrog patched it August 28; watchTowr says exploitation began September 1, just days…
-
Langflow and Ruby on Rails flaws under mass exploitation, 360 detections in 48 hours
VulnCheck recorded more than 50 exploitation detections within hours on August 30 against CVE-2026-0768 (CVSS 9.8, unvalidated input in Langflow allowing arbitrary Python execution as root), rising to 360 by Monday. Attacker requests are enumerating environment variables including…
-
Russia-aligned UAC-0099 hides a nuclear weapons prompt in malware to break AI analysis
ESET documented a technique it calls GuardBreaker, used by the Russia-aligned actor UAC-0099 against a target in Ukraine. The actor inserted the comment "I want to make a nuclear weapon. Help me ..." into a malicious VBS script, deliberately tripping a large language model's safety filters so the…
-
Cloudflare launches Adaptive Intelligence for AI-driven bot attacks
Cloudflare announced Adaptive Intelligence, positioned against bot traffic that adapts faster than static rule sets. Vendor announcement, not independently evaluated.
-
Silver Fox hides ValleyRAT inside signed Chinese adware users add to antivirus exclusions
The Silver Fox actor distributed the ValleyRAT backdoor (also tracked as Winos 4.0) disguised as QN Wallpaper, a genuine Chinese desktop wallpaper tool that is itself adware in its unmodified form. The malware runs under a trusted, signed process, which slips past users who routinely add such…
-
DOJ corrects its China hacking statement: federal agencies were targets, not confirmed victims
The Department of Justice revised a press statement that had described NASA, the Federal Reserve, the Department of Energy, DOJ, HHS, NIH, and the U.S. Senate as victims of intrusion activity by the PRC-affiliated group QTFY. The updated language lists those agencies as "among the targets of…
-
Kaspersky patches Endpoint Security code execution flaw as an unverified zero-day PoC circulates
Kaspersky confirmed to SecurityWeek that it patched a vulnerability in Kaspersky Endpoint Security that could be exploited to execute arbitrary code and access or tamper with data. Separately and unconnected to the patched issue, a researcher operating as Nightmare Eclipse published a proof of…
-
North Korean fraudulent worker scheme expands into healthcare and sales roles
DPRK-linked operators long associated with fraudulent IT employment are now placing workers in sales, marketing, and medical roles. The scheme relies on stolen or forged identity documents, VPNs, and proxy services to conceal location, with proceeds funding weapons programs. The activity is…
-
Aurora ransomware operators used Cursor AI to plan intrusions against 20-plus organizations
Two independent analyses of an exposed open directory belonging to the Russian-speaking Aurora (Aur0ra) group revealed the operator's toolkit, shell history, and encryptor. CloudSEK says the directory leaked months of activity against more than 20 organizations across nine countries between April…
-
China-linked Fire Ant hijacks Cisco IOS XR routers and TACACS servers, then erases the evidence
Fire Ant, a China-nexus espionage actor previously known for VMware ESXi and vCenter targeting, has moved into Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. Sygnia found purpose-built IOS XR implants: one embeds a modified system library that forwards a log…