The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Twenty-four npm packages used as free hosting for ClickFix fake CAPTCHA pages
Researchers found a cluster of 24 npm packages being used not to infect developers but as free, reputable, CDN-backed storage for phishing content. Each package contains a single HTML page that renders a fake Cloudflare CAPTCHA and redirects into a ClickFix flow. Installing the package does…
-
Mirage2FA phishing-as-a-service hit 4,500 US and EU companies by letting victims finish MFA first
Mirage2FA is a commercial adversary-in-the-middle platform that proxies real Microsoft 365 login flows rather than attacking MFA directly. The victim completes the legitimate login, including the second factor, and the toolkit steals the resulting authenticated session cookie. ANY.RUN tracked…
-
CISA adds actively exploited Gitea code injection flaw to KEV, federal deadline August 28
CISA added CVE-2026-60004 to the Known Exploited Vulnerabilities catalog on August 25 citing evidence of exploitation in the wild. The flaw carries a CVSS of 9.8 and lets an attacker with repository write access send a malicious patch to the diffpatch API endpoint, planting an executable Git hook…
-
Operation Jackal IV: 58 arrests across 22 countries targeting West African cybercrime networks
Law enforcement from 22 countries identified 263 suspects and arrested 58 people linked to cybercrime networks coordinated by African organized crime groups. The operation ran from November 2025 through June 2026 and targeted the business email compromise and romance-fraud infrastructure these…
-
Taiwan charges nine over illegal AI server exports to China, including Nvidia and Super Micro staff
Taiwanese prosecutors charged nine people, including an Nvidia manager and two Super Micro employees, over illegal export of high-end AI servers built on export-controlled B300 GPUs. Prosecutors say 74 servers reached mainland China, 50 routed through Indonesia, 16 shipped directly, and 8 sent to…
-
At least 274 Zimbra servers already compromised through CVE-2026-73570
At least 274 internet-facing Zimbra instances have been compromised via CVE-2026-73570, a code injection flaw Synacor patched in ZCS 10.1.20 on July 20. The bug is only exploitable when the optional zimbra-snmp package is installed and SNMP notifications are enabled, which is a non-default…
-
Anthropic expands Claude Security access for defenders and announces 35 million dollar open source fund
SecurityWeek reports Anthropic is widening access to Claude Security, currently in public beta for Claude Enterprise customers, which now runs codebase scans on the Mythos 5 model, alongside a 35 million dollar open source fund.
-
Microsoft Teams adds admin policy to block external bots from meetings
Microsoft is rolling out a Teams meeting protection policy letting administrators automatically block all identified external bots from joining meetings. This addresses the growing problem of uninvited AI notetakers and transcription agents silently joining calls.
-
Venezuelan national gets record eight-year federal sentence for ATM jackpotting
Juan Manuel Gouveia-Aguilera received eight years in federal prison, the longest US sentence to date for ATM jackpotting, for a scheme that caused millions in losses.
-
TikTok reaches 400 million dollar COPPA settlement with DOJ
The Department of Justice announced a 400 million dollar settlement with TikTok, ByteDance, and affiliated companies over allegations they violated the Children's Online Privacy Protection Act. TikTok pays 300 million immediately and 100 million more once an order vacates the prior consent decree…
-
Uber fined 825 million euros by Dutch regulator over automated driver suspensions
The Dutch Data Protection Authority fined Uber 825 million euros, roughly 966 million dollars, for deactivating driver accounts through automated systems without adequate human involvement or notification. It is the second-largest GDPR penalty on record, behind Meta's 1.2 billion euro fine in…
-
WordlistLoader and SynkLoader: ClickFix delivery and a fake Windows lock screen that harvests the real password
Gen Digital detailed two loader families likely used to sell access to ransomware groups. WordlistLoader is delivered through ClearFake campaigns using the ClickFix or FakeCaptcha technique, where a fake "I am not a robot" checkbox copies a malicious command to the clipboard and instructs the…
-
ReliaQuest confirms ShinyHunters social-engineering attack on its own staff
A ReliaQuest employee was targeted by attackers impersonating a member of the company's own security team and fell for the phishing attempt, giving the attackers access to a dashboard. The company says the data-theft attempt failed and impact was limited.
-
Apollo Global confirms breach in vishing campaign sweeping private equity and hedge funds
Apollo Global Management confirmed attackers accessed certain cloud platforms between July 6 and July 10 and took names, home addresses, dates of birth, and Social Security numbers. The intrusion is attributed to a social-engineering campaign run by UNC6671 and BlackFile, active since early 2026…
-
Spring Framework patches 91 vulnerabilities, more than 200 so far in 2026
The Spring application framework received fixes for 91 vulnerabilities, bringing the 2026 total to more than 200 compared with 16 in all of 2025 and 22 in 2024. The volume itself is the notable data point, reflecting a broader shift in how quickly flaws are being found and disclosed in widely used…
-
Attackers scanning WordPress at scale for miniOrange SAML SSO authentication bypass
Two critical flaws in the miniOrange SAML 2.0 Single Sign On plugin are under active exploitation. CVE-2026-61979 tricks the plugin into treating a public key as a shared secret, letting an attacker forge a valid signature. CVE-2026-15981 causes the plugin to read an OpenSSL verification error…
-
Unpatched Calix router flaw lets anyone on the internet punch a permanent hole through the firewall
CVE-2026-75501 affects Calix GS7 XGS (GS5239XG) residential gateways running EXOS/6.6.47, sold through US broadband providers including Cox, Brightspeed, ALLO, CityFibre, and Conexon. The device binds its MiniUPnPd WANIPConnection SOAP service to the public WAN interface on TCP 5000 with no access…
-
CISA adds maximum-severity Oracle WebLogic and HTTP Server flaw to KEV, three-day federal deadline
CISA added CVE-2026-21962 (CVSS 10.0) to the Known Exploited Vulnerabilities catalog on August 24 with a remediation date of August 27. The flaw lets an unauthenticated attacker with HTTP network access compromise Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, leading to…
-
Akamai finds the top 5 percent of AI users create most of the shadow AI risk
Akamai telemetry shows the top 5 percent of enterprise AI power users interact with AI models at 12 times the rate of the bottom half of the workforce. The report argues that the real exposure is not casual drafting use but a small group hardcoding unvetted AI tools into business processes and…
-
Operation QUICSILVER targets Myanmar government and IT with QUICAgent Go backdoor
Seqrite Labs flagged an espionage campaign against Myanmar government and IT targets using a Go backdoor called QUICAgent, assessed with moderate confidence as China-nexus. First observed in April 2026 delivering "HolidayNotice.pdf.exe" with a fabricated Belgian-Myanmar holiday calendar lure…
-
Slovakia warns that road speed cameras carry unaccounted remote-access mechanisms
Slovakia's NBÚ issued a formal cyber threat warning covering NERO R-ONE devices sold by Cyprus-based SODASUS, Cordon-series cameras made by Russia's Simicon, and Cordon-series products sold by Croatia's NEROline. Its analysis of a NERO R-ONE sample found mismatches between documented and actual…
-
UAT-10147 uses AI tooling to scale server attacks, drops EDR bypass and Linux rootkit
Cisco Talos detailed a Chinese-speaking cybercrime group tracked as UAT-10147 targeting Windows and Linux web servers across education, media, technology, and gaming, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The group exploits publicly disclosed vulnerabilities at scale…
-
Critical Keycloak password reset flaw lets anyone take over any account
Red Hat and the Keycloak project patched CVE-2026-18963, a 9.1 CVSS flaw in the open-source identity and access management server. An unauthenticated remote attacker can take over any user account by forcing a password reset, with the root cause described as improper state validation in the…
Also covered by ThaiCERT advisory
-
ToxicPanda Android banking trojan abuses VPN permissions to block Google Play
ToxicPanda has expanded to target 349 applications and now supports 167 remote commands. The notable change is its use of Android VPN permissions to cut the device off from Google Play, blocking Play Protect updates and remediation while the malware operates. Related Zimperium research on…
-
Encrypted prompts bypass AI safety guardrails in Grok and Gemini
Adversa AI describes a technique it calls Cryptographic Context Injection, which hides malicious instructions until they are decrypted inside a trusted execution environment, past the point where guardrails inspect input. SecurityWeek's coverage extends the finding to Gemini alongside the Grok…