The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Signal ships Automatic Key Verification, WhatsApp adds scam alerts
Signal introduced Automatic Key Verification, which complements its manual safety-number system and is intended to detect interception without requiring users to compare codes in person. WhatsApp separately announced a scam alert feature that warns users about likely fraudulent contacts.
-
Chipmaker Patch Tuesday: Intel and AMD fix more than 80 vulnerabilities
Intel and AMD published their August advisories, addressing over 80 flaws combined. Intel flagged several high-severity issues that can lead to privilege escalation and code execution. These are firmware and driver-level fixes that depend on OEM delivery, which is why they lag.
-
Picus Blue Report 2026: perimeter defenses improved, interior defenses got worse
Based on more than 338 million attack simulations in real client production environments during the first half of 2026, average prevention effectiveness rose from 62 percent to 69 percent and logging hit a four-year high of 58 percent. The gains are concentrated at the perimeter. Once inside…
-
FBI warns of account takeovers aimed at stealing explicit images from adults and minors
The FBI is warning that criminals are compromising social media and other online accounts specifically to steal sexually explicit images and videos, targeting both adults and children. The stolen material is used for extortion.
-
Android malware pair takes out loans and relays victims' card data in real time
A new NFC relay malware called WindRelay is being deployed alongside the SpyNote remote administration tool. The combination captures live card data at the point of tap and relays it to attackers in real time, and is being used to take out loans in victims' names.
-
Reasoning APIs from OpenAI, Anthropic, and Google leaked hidden model reasoning, including secrets
Encrypted reasoning objects passed between API calls could be replayed into a different session, and in testing handed to a weaker model in the same provider family to reveal the hidden content. Researchers recovered internal reasoning and secrets from session logs, including API keys and…
-
737 fake Chrome VPN extensions route users' entire browser sessions through one provider's proxies
Socket identified 737 free VPN and proxy extensions across at least 40 Chrome Web Store developer accounts, totaling 75,486 installs. Of those, 274 impersonate 66 known brands including Proton VPN, NordVPN, ExpressVPN, and Cloudflare's 1.1.1.1. Nearly all route the full browser session through…
-
ShieldBreak proof of concept claims a Defender patch bypass that yields SYSTEM
A researcher using the handle Chaotic Eclipse released a PoC called ShieldBreak that bypasses Microsoft's fix for CVE-2026-50656, a race condition in the Microsoft Malware Protection Engine known as RoguePlanet. The original issue allowed spawning a SYSTEM-level shell. The release came right after…
-
City-Forum campaign quietly drains Salesforce and ServiceNow portals through guest access
Reco is tracking a campaign it calls City-Forum that uses a single custom Go binary to hit Salesforce Aura and LWR sites and a barely documented ServiceNow Service Portal search endpoint. It abuses the Guest User that exists in every Salesforce Experience Cloud and ServiceNow portal and cannot be…
-
Attackers exploit a maximum-severity Adobe Commerce flaw while ColdFusion gets three CVSS 10.0 fixes
Exploitation attempts have been detected against CVE-2026-71362 in Adobe Commerce and Magento, which allows hijacking of customer accounts. Separately, Adobe shipped fixes for ColdFusion flaws including CVE-2026-48362 (CVSS 10.0 OS command injection) and CVE-2026-71398 (CVSS 10.0), plus an eval…
-
VMware vCenter flaw exploited across 47 countries, with reverse SSH left behind for persistence
CVE-2026-59310, a CVSS 9.8 directory traversal in the vCenter syslog server, is under active exploitation. QUIRSO found the activity during an incident response engagement and counted 361 victim IPs across 47 countries, with first C2 contact on August 3, five days after Broadcom's advisory…
-
Ivanti EPM update fixes remotely exploitable credential-leak and agent-crash flaws
The vulnerabilities can leak credentials for external SQL connections or crash an agent service. Endpoint Manager is a privileged management platform, so credential exposure there is a lateral-movement problem rather than a single-host problem.
-
SonicWall patches unauthenticated remote code execution in a platform it already discontinued
CVE-2026-66147 (command injection) and CVE-2026-66145 (zip slip) allow unauthenticated remote code execution and sensitive data disclosure in Global Management System virtual appliance and Windows versions 9.5.1 and earlier, fixed in 9.5.2. Eight flaws total across GMS and Email Security…
-
Ceva Logistics breach cascades into ING, Ajax, Ace & Tate, and Valve customer data
The intrusion began July 29 and hit eight European contract-logistics warehouses, delaying shipments for retail customers with inventory in those sites. Ceva says no other systems were affected, but downstream companies are now notifying their own customers that names, home addresses, phone…
-
LiteLLM supply chain compromise reaches 2,500 organizations and more than 430,000 CI/CD pipelines
New scope figures from CloudSEK put the blast radius of the TeamPCP campaign at over 2,500 organizations and more than 430,000 CI/CD pipelines. The chain started with the compromise of Aqua Security's Trivy scanner in March 2026; LiteLLM's own CI pipeline then automatically installed the poisoned…
-
ICS Patch Tuesday: Siemens, Schneider Electric, Phoenix Contact, Honeywell
Siemens published 10 advisories, including a maximum-severity missing-authentication flaw in SIMATIC IoT2050 Advanced (remote unauthenticated code execution with elevated privileges) and a critical code execution bug in Siveillance Video Management Servers. High-severity issues hit Solid Edge…
-
Cisco patches an ASA and FTD firewall zero-day already used in denial-of-service attacks
CVE-2026-20349 lets a remote, unauthenticated attacker send a crafted HTTP request to the Remote Access SSL VPN service and force the appliance to reload into a denial-of-service state. Cisco confirmed active exploitation in August but has released no detail on the attacks. CISA added it to the…
-
BdThemes supply chain attack poisons a JSON feed to create rogue WordPress admins
No source files in the official WordPress.org repository were modified. Attackers poisoned a static remote JSON stream fetched by an administrative promotional banner in BdThemes plugins, including Element Pack Addons for Elementor at over 100,000 active installs. WordPress temporarily disabled…
-
Mozilla revokes the Firefox and Thunderbird Linux signing key after it was committed to a private repo
An unencrypted copy of the GPG signing subkey was committed by mistake to one of Mozilla's own private repositories. Everyone with visibility already had legitimate access, an audit review found no unauthorized access, and nothing suggests external exposure. Mozilla revoked it anyway. The cost…
-
Adobe urges immediate patching of critical ColdFusion and Campaign Classic flaws
Critical defects allowing arbitrary code execution and denial of service, with Adobe pushing customers to patch without waiting for a normal cycle. ColdFusion remains a recurring target because deployments are old, internet-facing, and often owned by whoever built the site rather than by IT.
-
Researchers build a fake crypto startup and hire three suspected North Korean IT workers
Researchers advertised developer roles at an invented company and recorded every virtual machine they issued. The first hire claimed Pasadena, Texas, then sent a California driver's license and a New York bank account, with image metadata showing Google Gemini processing and a SynthID watermark…
-
Sandworm subgroup runs fake job interviews at Ukrainian IT staff to install a VPN client that executes commands
CERT-UA attributes an ongoing campaign since May 2026 to UAC-0145, a subgroup of Sandworm (APT44, Seashell Blizzard), tied to the GRU. Attackers review resumes on job boards, contact system administrators and IT specialists posing as recruiters from firms such as ATLAS Business Group, move the…
-
Malicious MCP servers split instructions across channels to make AI coding agents exfiltrate secrets
A hostile Model Context Protocol server can steal SSH keys, environment secrets, source code, and customer data without ever issuing an obviously harmful instruction. The technique fragments the request, placing one piece in a tool description and another in a tool result, so each fragment looks…
-
Attackers pivot through a utility's private cellular network to shut down a turbine at a second Polish power plant
Attackers stopped a steam turbine and the process-water treatment system at a Polish combined heat and power plant serving roughly 50,000 residents. The route ran through a private APN, the dedicated cellular data network the local distribution operator uses to reach remote equipment. A…
-
Researchers chain an unauthenticated identity-assumption flaw in SharePoint Server into remote code execution, with AI doing much of the work
CVE-2026-55040 (CVSS 9.1) lets a remote attacker with no valid account assume any chosen user's identity on SharePoint Server Subscription Edition, 2019, and 2016, provided they know the target's Active Directory SID or user principal name. SharePoint Online is not affected. Rapid7 chained that to…
Also covered by SecurityWeek