A decade ago, a computer did something that no human would have done. It was considered a breakthrough for AI. Now the world is full of them.

Read more →

Russell on launching Savant Pathseeker, the first product in its new Agentic Offensive Testing line.

Read more →

Murphy on why data trust is the foundation of the agentic era.

Read more →

AI-battered hedge fund Situational Awareness made a big bet this week in Source Foundry, a private company aiming to reinvent the way chips are manufactured.

Read more →

Davies shares insights from original FIRE research, while also digging into trends.

Read more →

Boehm discusses why organizations need to build a resilient foundation for securing AI across increasingly dynamic environments.

Read more →

Lina K., a co-worker, recently shared a firsthand account of how bots are adding League of Legends players via the Riot client friends list immediately after a match ends, striking up a flirty conversation, and eventually pushing an OnlyFans link. The pattern lines up with a wave of complaints that have piled up on Reddit…

Read more →

The decision reflects internal findings that the upcoming ‘Astra’ model may possess ‘critical cyber capabilities’ and follows a string of AI-testing incidents.

Read more →

A New Mexico court has ordered Meta to pay a total of $942 million after finding that Facebook and Instagram harmed young users and that the company misled consumers about the safety of its platforms. Reportedly, the decision combines a $375 million civil-penalty verdict from March with a newly ordered $567 million abatement fund intended…

Read more →

A Canadian hacker has pleaded guilty to charges tied to the 2024 breaches of more than 165 Snowflake customer environments, a campaign that exposed data belonging to at least 100 million people. Connor Riley Moucka, 26, admitted to computer fraud, wire fraud, aggravated identity theft, and conspiracy in federal court in Seattle. The attacks relied…

Read more →

A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. […]

Read more →

On Aug. 6, DXC announced a strategic partnership with security startup Primary, becoming the exclusive managed services provider for Primary’s AI-native Zero Trust Platform. The joint offering is designed to help enterprises and government agencies govern how AI agents and enterprise AI applications access data, identities, and business systems. The companies are targeting organizations that…

Read more →

A phone-first data-theft extortion campaign has targeted dozens of major US financial firms over the past month. Ransom-seeking hackers have targeted dozens of major US financial institutions and other businesses in a campaign that relies heavily on phone-based social engineering, according to data from Google and internet intelligence platforms reviewed by Reuters. The targets included…

Read more →

Ten years ago, we launched AWS Directory Service for Microsoft Active Directory, a fully managed Microsoft Active Directory in the AWS Cloud. In that original announcement, Jeff Barr described a straightforward promise: “You will spend less time administering and more time working on your applications and your business.” A decade later, AWS Managed Microsoft AD…

Read more →

China has put one of America’s biggest cybersecurity companies under the microscope, adding network security software to the growing list of US technologies caught in the escalating Beijing-Washington standoff. The Cyberspace Administration of China said Thursday that its Cybersecurity Review Office had begun a review of products sold in China by Palo Alto Networks, citing…

Read more →

Cato Networks, a converged network and security cloud, has launched Cato Agentic Threat Prevention, a new capability to deploy autonomous agents to predict likely attack paths. Stopping frontier AI adversaries before they advance Introduced at Black Hat USA 2026, the capability also automatically personalizes protections for each customer environment to prevent breaches before AI-assisted attacks…

Read more →

Healthcare software company Unlimited Technology Systems reported that more than 3.8 million people were impacted by a data breach incident that occurred in October 2025. […]

Read more →

The start of Q3 saw few mergers and acquisitions (M&A) movements across the channel, but these were nonetheless significant. The acquisitions focused on security and expanding reach into various regions to serve more customers. Read more about the M&A moves below, and be sure to catch up on last month’s moves. Barracuda Networks acquires Evo…

Read more →

Etsy is shrinking its workforce even as its business starts gaining momentum again. The online marketplace said Wednesday it will eliminate about 220 jobs, roughly 12% of its workforce, as part of a restructuring aimed at simplifying the organization and speeding up decision-making. Most of the layoffs will affect employees in product and engineering, according…

Read more →

8×8, Inc., a business communication platform provider, is introducing a new partner program for its direct resell channel that rewards customer retention and expansion. Four-tier structure to align partner and company success The 8×8 partner program features a four-tier structure: Authorized, Silver, Gold, and Platinum. With this structure, direct resellers can earn financial rewards according…

Read more →

Experts urge managed-device logins and audit log monitoring to stop phishing-led cloud data theft.

Read more →

LightSpy, a China-linked surveillance platform, has grown into an operation using at least 117 servers with verified router infections. At Black Hat USA, Arctic Wolf researchers Dmitry Bestuzhev and Dmitry Melikov said LightSpy has been identified in more than 13 countries, growing well beyond the spyware, active since at least 2018 and publicly documented in…

Read more →

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. “These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer…

Read more →

AMD is moving deeper into AI inference with technology designed around specific models rather than relying only on general-purpose accelerators. The chipmaker has agreed to acquire Toronto-based Taalas, a startup specializing in inference silicon that AMD says can reduce compute and memory bottlenecks. AMD plans to integrate the technology into its accelerator roadmap and develop…

Read more →

ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host and then fetches a macOS malware payload that’s compatible with the computer’s CPU…

Read more →

Proofpoint Inc. debuted a new program at Black Hat USA 2026 that makes a portfolio of OEM-ready threat intelligence and detection capabilities available for technology providers, cybersecurity vendors, managed services providers, and platform companies. Accelerating OEM innovation with trusted threat intelligence The Proofpoint OEM Program formalizes and expands the cybersecurity providers’ OEM business. It provides…

Read more →

A recent wave of cyber attacks targeting financial services, private equity, and professional services is attributed to a data extortion group known as UNC6671. “UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via…

Read more →

ConnectWise and SentinelOne have unveiled a joint managed cybersecurity strategy aimed at helping MSPs scale threat detection and response through deeper integration of Managed EDR, AI-driven security, and automation. ConnectWise and SentinelOne deepen MSP security collaboration Announced at Black Hat USA 2026, the strategy establishes a framework for deeper collaboration that brings together the AI-driven…

Read more →

Researchers have uncovered an extremely effective attack campaign that involved AI agent skills trojanized to deploy a credential stealer. The incident is part of a growing trend in which attackers are targeting the AI software supply chain by poisoning sharable instruction and configuration files for agentic tools. Discovered by researchers from security firm Zenity, the…

Read more →

Zero Networks, a Zero Trust security solutions provider, announced a new capability at Black Hat USA 2026. This new capability applies the Open Worldwide Application Security Project’s (OWASP) principle of Least Agency to help organizations safely deploy AI agents. Reducing the impact of compromised AI agents The Least Agency Enforcement capability uses identity-based microsegmentation, policy…

Read more →

The attack exploits a time-of-neutralization to time-of-use (TONTOU) window in Spectre v2 defenses, where a gap exists between when the branch predictor is isolated and when it is used.

Read more →

VulnCheck CTO Jacob Baines claims that Zbtlink routers are intentionally designed to communicate with command and control servers, a feature he calls a “phone-home trojan horse.”

Read more →

The lawsuit, filed in the U.S. District Court for the Northern District of Illinois, claims Walmart records calls to its stores, extracts vocal characteristics, and creates mathematical templates to identify callers.

Read more →

Novee Security researchers discovered flaws in Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex.

Read more →

As AI-generated code continues to be injected into all corners of the internet, concerns have risen about an expanding attack surface for malicious hackers to exploit. Some have argued that the enhanced cybersecurity capabilities of large language models could serve as a check, finding and fixing vulnerabilities nearly as fast as they’re created. But new…

Read more →

A Chainalysis report highlights a concerning trend of “wrench attacks” targeting cryptocurrency holders, leading to significant financial losses.

Read more →

The criminals leveraged ChatGPT for various fraudulent activities, including romance scams, fake investment schemes, bogus police impersonations, and potentially operations linked to human trafficking.

Read more →

A spokesperson for Palo Alto Networks affirmed the company’s commitment to high standards of business conduct and security, stating that the review has no impact on their ability to support customers or deliver services in the region.

Read more →

Security researchers at Arctic Wolf have found that LightSpy, initially discovered in 2018 and linked to Chinese state-backed hackers, has evolved into a commercial spyware platform.

Read more →

WordPress XSS2Shell flaw enables admin takeover and remote code execution. Users should update to patched versions. Researchers at Pwn just published a report on a vulnerability chain they’re calling XSS2Shell, and the entry point is quite simple: type a username that doesn’t exist, and WordPress echoes it back with a tiny formatting flaw baked into…

Read more →

A study of more than 6,000 patches found that even working patches can introduce new bugs, break something else, or are open to bypass.

Read more →

Whatnot, a fast-growing live-shopping platform, has nearly doubled its valuation in 10 months.

Read more →

The Marshall Stanmore IV is a more expensive home speaker, but there’s so much to like that $430 sounds like a good value.

Read more →

The Trump administration tapped a surveillance giant with a record of attacking the press to advise the State Department on free speech. Among the partners for the State Department’s new “Freedom Tech Excellence Program” is Palantir, the AI and data integration firm started by right-wing powerbroker Peter Thiel. Under the program, company employees will go…

Read more →

Hackers used fake IT help desks to steal MFA credentials, targeting over 200 firms, including major financial companies. A hacking campaign operating under names including Redact, Pink, Falcon, and Helix has built credential-stealing websites targeting employees at Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital, and Moody’s, among dozens…

Read more →

Levi Strauss & Co. (Levi’s) says that hackers used social engineering on three of its employees to gain access to and steal corporate data stored on their machines. […]

Read more →

f someone offered you 90% off the official price to access Claude, the powerful AI model from Anthropic, would you be tempted? It turns out that around 900 people were, and they may be regretting their decision. Read more in my article on the Fortra blog.

Read more →

The movie teaches us an unexpected lesson in adapting to an AI world where every challenge demands a different response.

Read more →

As Europe swelters in a heatwave, residents probably don’t want to hear about ways to make their homes even hotter, but that’s what Polish property developer Citylink is talking about, with plans to dump waste heat from a new data center in Wrocław into the municipal district heating network. Citylink is designing the data center…

Read more →

Yet another AI model has escaped from a cybersecurity test lab: This time, it’s the Chinese company Moonshot’s Kimi K3 model on the run. Frontier Security spotted that Kimi K3 had found a loophole in the UK AI Safety Institute’s test environment for AI models performing cybersecurity tasks. The news follows similar exploits by models…

Read more →

Bending Spoons has snapped up Airtable to add to its portfolio of software companies, alongside AOL, Evernote, WeTransfer, Brightcove and Vimeo Airtable made its name as a builder of low/no code database services, aimed particularly at non-technical staff, but is now one of many vendors facing financial difficulties in the face of the SaaS/AIpocalypse. The…

Read more →

The U.S. Coast Guard said it is monitoring the aftermath of a cyberattack that disrupted gate operations at all three of North Carolina’s port facilities this week, though it offered few details as the investigation into the breach continues. A Coast Guard spokesperson told CyberScoop that the branch’s IT unit was coordinating with partner agencies…

Read more →

This week’s cybersecurity landscape was shaped by rapidly expanding AI risks, attacks on trusted developer workflows, actively exploited enterprise software, and costly data breaches. Research into rogue agents, prompt injection, passkeys, and offensive AI showed why governance must keep pace with deployment, while incidents involving npm, hotel networks, remote monitoring tools, and sensitive public-sector data…

Read more →

Wispr, the startup behind dictation tool Wispr Flow, has created an AI note-taking assistant that records meetings and generates conversation summaries for users. The Wispr Flow Notetaker tool “captures your meetings so you can stop splitting your attention between listening and writing things down,” said Sahaj Garja, Wispr CTO and co-founder. Notetaker starts recording with…

Read more →

The North Carolina Ports Authority has confirmed that a cyberattack disrupted IT systems and slowed operations at Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. […]

Read more →

A Canadian hacker has admitted being part of a group responsible for several major cyberattacks. Connor Riley Moucka pleaded guilty to being part of a coterie of hackers that hit 165 organizations, resulting in the theft of customer records and the extortion of millions of dollars. Industry sources have identified Moucka as one of the…

Read more →

Demis Hassabis, the driving force behind Google DeepMind, is ascending to the role of chief scientist at Alphabet, Google’s parent company, replacing Jeff Dean who is leaving to work at a start-up. The role will enable Hassabis to “put his full attention on actively shaping the future of AGI,” or artificial general intelligence, Alphabet CEO…

Read more →

Hackers exploited vulnerabilities in Microsoft SharePoint servers belonging to Switzerland’s Federal Office of Information Technology, Systems and Telecommunication (BIT), compromising the login credentials of around 200 accounts. On July 28, BIT’s security specialists noticed unusual activity on the SharePoint servers. Once the intrusion was confirmed, BIT blocked internet access to the platform and closed the…

Read more →

Certifications and years of experience can only take you so far in cyber now. Automation means new skills are coming to the fore.

Read more →

Open Source had a great childhood. For two decades it got to be a kid. It ran around barefoot, gave everything away, trusted strangers, and never once thought about who was watching. It ran the kind of lemonade stand that took IOUs from anyone who wandered up — take what you need, pay me back…

Read more →

Meta was ordered to pay $567M after a judge ruled its platforms harmed children, bringing New Mexico penalties to $942M. Meta ‘s child-safety legal bill just got another half-billion dollars heavier. A New Mexico state judge ruled that company’s platforms constitute a “public nuisance,” the BBC reports, ordering $567 million into a fund meant to…

Read more →

A use-after-free bug in Linux’s SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The flaw has existed since 2008. The fix already shipped: stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148, released August 3, close it.…

Read more →

Beacon has informed around 1500 customer charities that its CRM databases were accessed and likely exfiltrated by an unauthorized actor

Read more →

Cybersecurity researchers have called attention to an active “widespread email-driven phishing campaign” that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email. “The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic,

Read more →

A hidden backdoor in 20 router models lets remote servers execute commands as root, putting affected devices at risk of takeover. Jacob Baines had a router on his desk that kept trying to call home, and it wasn’t supposed to. VulnCheck researchers found a backdoor baked into Zbtlink routers, and it’s not the kind of…

Read more →

PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors. PortSwigger said a separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server. Kettle said HTTP Terminator tested 30,000 websites where scanning

Read more →

BlackFile has rebranded as Redact after an alleged affiliate hijack, with Google linking the group to ongoing vishing and extortion campaigns

Read more →

The company and Gilroy, Calif., officials spent years quietly negotiating a $2 billion project that few residents knew about until construction began; now locals are upset.

Read more →

From portable monitors to wireless mice and earbuds, these accessories can help you be more productive this year.

Read more →

OpenAI has updated GPT-5.6 Sol, the model behind ChatGPT for Plus and Pro subscribers, and pushed a new model, GPT-5.6 Luna, out to everyone using the free tier. The company is also removing the rate limit on text conversations for free users, allowing them to keep chats going without waiting for the limit to reset.…

Read more →

AI-generated vulnerability patches still heavily depend on human review, particularly the ones involving security-sensitive code, according to a research. Researchers from 1Password have disclosed an internal evaluation that found AI-generated fixes frequently overlook broader concerns such as architectural intent, business requirements, security implications, and long-term maintainability, despite being syntactically correct. “We studied what happens when…

Read more →

The financial impact of a data breach is substantial for any modern business, regardless of industry or size. IBM’s latest Cost of a Data Breach report discovered that, from March 2025 to February 2026, the average cost of a data breach rose to $6 million, up 35% from $4.44 million a year earlier. The 2026…

Read more →

Finance, technology and healthcare sectors were particularly heavily targeted in July, according to Comparitech

Read more →

A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic’s and Google’s own coding-agent repositories. On OpenAI’s, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor’s agent in the configuration that the vendor ships by…

Read more →