Attackers leveraged an authentication bypass vulnerability, identified as CVE-2026-18556 and later expanded by CVE-2026-18577, to achieve remote administrative access to N-central servers.

Read more →

This new protection, currently in development and planned to be enabled by default, aims to combat malware abuse of Chrome’s enterprise policy features on unmanaged consumer devices.

Read more →

Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information. […]

Read more →

The Baochip-1x is a “mostly” open-source microcontroller that allows for verifiable security.

Read more →

The vulnerability specifically affects Active Storage versions prior to 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1, particularly when the libvips image processing library is in use.

Read more →

INC ransomware exploits SonicWall zero-days, prompting compromise fears.

Read more →

The vulnerability, identified by Block and detailed by Galaxy Research, occurred because a deterministic software pseudorandom number generator (PRNG) was used instead of the intended hardware random number generator (RNG) for seed generation.

Read more →

Europe has turned its AI rulebook into a watchdog, and the world’s biggest AI companies are about to find out what that means. Last August 2, the European Union entered the active enforcement stage of its AI Act. This stage grants its AI Office the authority to investigate providers of General Purpose AI models, require…

Read more →

A random number generation flaw in Coldcard firmware may have left thousands of Bitcoin addresses with substantially weakened seeds. Researchers have linked the bug to suspected thefts totaling $88.6 million across 4,585 blockchain addresses, although the connection has not been computationally confirmed for every wallet. The affected firmware generated seeds with reduced entropy, potentially allowing…

Read more →

Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments. One of the packages in question is “lib-mtop,” an unscoped package with the same name as a…

Read more →

Galaxy Research linked a suspected Bitcoin theft of 1,367.05 BTC to weak COLDCARD seeds. Coinkite says updates cannot repair seeds already generated on devices.

Read more →

The same AI tools triggering suspicious alerts are being attacked by cybercriminals in droves.

Read more →

Multiple vulnerabilities have been discovered in SolarWinds Web Help Desk, the most severe of which could allow for authentication bypass. SolarWinds Web Help Desk software grants access to SolarWinds IT support, asset management, and knowledge base operations. A vulnerability in the Web Help Desk could allow an unauthenticated, remote attacker to bypass authentication and gain…

Read more →

A vulnerability in N-able’s N-central remote monitoring and management (RMM) platform is being actively exploited.  The flaw can give attackers unauthenticated administrative access to the N-central console, allowing them to control every endpoint managed through the platform.  “Exploitation is active in the wild; a compromised N-central server can be used to run scripts, push tools,…

Read more →

The critical vulnerability in Adobe Campaign Classic, identified as CVE-2026-48449, stems from incorrect authorization and poses a significant risk for remote code execution.

Read more →

N-able is warning customers that hackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) affecting both hosted and on-premises N-central servers. […]

Read more →

Anthropic has launched an investigation into what went wrong during a recent test of three models that left a trio of companies accidentally hacked. The company was testing how well Claude Opus 4.7, Claude Mythos 5, and an internal test model could find hidden information about fictional companies in simulated networks. But because of a…

Read more →

These seemingly harmless blank pages or “Coming Soon” placeholders can silently collect a visitor’s IP address, approximate location, User-Agent string, and cookie identifiers.

Read more →

Malware running as an ordinary user on a Windows machine can sign into a victim’s passkey-protected accounts without a fingerprint, a PIN, or anything at all appearing on the victim’s screen. Unit 42 detailed three attack paths against Chrome’s Google Password Manager cloud authenticator, which it calls Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key; the strongest…

Read more →

The phishing attacks involve disguised job applicants sending resumes with malicious links or impersonating recruiters with password-protected ZIP files containing malware.

Read more →

The INC Ransomware operation has emerged as the “dominant threat actor” exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. In a report published over the weekend, Resecurity said it observed the INC Ransomware accelerating its activity since the beginning of August 2026, listing multiple victims on its…

Read more →

Taiwanese server manufacturers are helping Mexico become one of the biggest assembly lines behind America’s AI boom. Mexico exported $46.9 billion in enterprise servers to the United States during the first five months of 2026, putting it just behind Taiwan and underscoring how quickly the country has become part of the US AI infrastructure buildout. …

Read more →

The attack exploited Adform’s JavaScript tracking script, “trackpoint-async.js,” which is embedded in numerous websites.

Read more →

Agents need their own identities, scoped to a specific task, and then must be destroyed.

Read more →

The surge in malicious activity began around July 29, with initial reports identifying the “openconnect-sso” package as compromised.

Read more →

Amgen detected the breach in July 2026 and initiated its cybersecurity response plan, engaging forensic experts to investigate.

Read more →

A trusted software update can become a malware delivery system when attackers gain control of the account publishing it. Amazon Threat Intelligence has linked four npm supply-chain attacks conducted between March 2025 and March 2026 to Sapphire Sleet, a threat actor associated with North Korea. Based on command-and-control indicators and shared tactics, Amazon assessed the…

Read more →

Researchers intercepted and investigated the model, which was attempting to compromise more than 1,200 hosts for proxyjacking to launch further attacks.

Read more →

Organizations need a clear vulnerability disclosure process as AI speeds flaw discovery.

Read more →

Meta says artificial intelligence is beginning to shorten the distance between a product idea and a working application. During the company’s latest earnings call, CEO Mark Zuckerberg said AI is accelerating software development across Meta and could allow its engineers to create and test more consumer apps. He cited several recent launches, although the company…

Read more →

A Bitcoin business rarely runs a simple website. Payment processors, exchanges, wallet services, blockchain analytics products and Lightning…

Read more →

Cyberattack recovery gets a security upgrade as Commvault brings Google Threat Intelligence into the backup process to help companies find safe data faster. Commvault is integrating Google Threat Intelligence into its Threat Scan workflows to help organizations identify clean recovery points more quickly after ransomware and other cyberattacks. Integrating Google Threat Intelligence with backup scanning…

Read more →

A cyberattack on the U.K.’s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals. […]

Read more →

AI is shifting enterprise traffic from human-initiated to machine-generated workflows. Discover why Cisco SD-WAN must evolve to provide the visibility, policy enforcement, and performance assurance needed to support AI operations at scale.

Read more →

Chinese actors exploited the critical React2Shell exploit inside a day, while 88% of exploited vulnerabilities in H1 2026 were compromised within 48 hours of disclosure

Read more →

Flare researchers analyzed thousands of underground posts to examine how the BTMOB Android malware operation evolved into a fragmented ecosystem of resellers, source-code vendors, custom versions, and competing sales channels. […]

Read more →

Worried about your personal AI chats being exposed? Here’s how to tighten your privacy across several major chatbots.

Read more →

Russian actor Storm-2945 hijacked hotel captive portals to push fake updates and steal tokens

Read more →

Bitsight found Fuyao software on H96 Android TV boxes, letting operators fake ad clicks and route proxy traffic through their owners’ home internet connections.

Read more →

Accountability without any real authority is driving CISO burnout, and organizations need to take notice.

Read more →

Mimecast has unveiled Agent Risk Center, a beta capability for discovering, monitoring, and governing AI agents, alongside Managed Threat Response, a redesigned 24/7 service that combines AI-assisted triage with analyst-confirmed remediation. According to Mimecast’s analysis, 98% of organizations already have unsanctioned AI tools in use, and by 2029 more than a billion agents will take…

Read more →

A Chinese threat actor operating under the aliases “knaithe” and “KnYuan” used multiple LLMs to automate cyberattacks against internet-facing systems with limited human intervention. Researchers at Palo Alto Networks’ Unit 42 uncovered the operation after the threat actor’s AI agent misconfigured a file server, inadvertently exposing the entire infrastructure. “This visibility enabled us to understand…

Read more →

SentinelOne has today announced governed, closed-loop response across the Singularity Platform, delivering trustworthy automation for security operations. Purple AI and Singularity Hyperautomation now autonomously investigate alerts, reach verdicts, and execute responses. Security teams set the boundaries first, deciding where AI acts on its own and where it stops for human sign-off. The Autonomous SOC now…

Read more →

Horizon3.ai has announced a $250 million Series E at a valuation of more than $2 billion, tripling its valuation from $650 million at Series D in just over a year. The oversubscribed round was co-led by existing investors NightDragon and NEA, with participation from seven new investors and five returning backers. The capital underscores accelerating…

Read more →

For the latest discoveries in cyber research for the week of 27th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Minnesota IT Services has confirmed coordinated cyberattacks affecting more than 30 community water utilities across the state. The incidents briefly disrupted a treatment plant in Braham and affected industrial control systems. Officials reported…

Read more →

While AI security today is largely focused on restricting what an agent can do, Zero Networks says it has built a failsafe. The company says it can block a compromise midway by adding a network layer protection. On Monday, the company announced the launch of “Least Agency Enforcement,” a new capability designed to implement the…

Read more →

Plus, America’s lettuce crisis has shoppers ditching supermarkets for farmers markets—for now.

Read more →

Alibaba on Monday introduced Qwen3.8-Max, its largest artificial intelligence model to date, expanding its enterprise AI portfolio with an open-weight model designed for software engineering, multimodal reasoning, and other knowledge-intensive business workloads. In a blog post announcing the launch, Alibaba described Qwen3.8-Max as a 2.4-trillion-parameter mixture-of-experts (MoE) model that activates only about 95 billion parameters during inference.…

Read more →

N-able says attackers bypassed N-central authentication, reached managed client devices and installed Cloudflare tunnels that survived server access revocation.

Read more →

UK police legal database breach exposed officers’ names and work emails, increasing phishing risks. NCA is investigating. The Police National Legal Database (PNLD), the legal reference system used by all 43 Home Office police forces in England and Wales, confirmed that a data breach exposed the contact details of police officers, staff, and criminal justice…

Read more →

The US Cybersecurity and Infrastructure Security Agency (CISA) has published the Open Source Software: Security Principles and Practices guide, which provides federal agencies with recommendations for managing the security of open source software, contributing to OSS projects, and evaluating open source AI systems. Using open source software Federal agencies can benefit from open source software…

Read more →

New HollowFrame loader hid Go code in a fake Python DLL after pre-staging Defender exclusions

Read more →

Qodana 2026.2 shipped with new security inspections, published benchmark results, post-quantum cryptography checks, and coverage reporting that no longer has to be pointed at the reports. The security work sits in the .NET linter and runs by default. Qodana tracks untrusted data across files in C#, JavaScript, and TypeScript, which turns up SQL injection, command…

Read more →

Simbian has released its autonomous AI Threat Hunt Agent, that investigates potential threats and identifies malicious activity across enterprise environments. The Threat Hunt Agent represents the third pillar of Simbian’s AI-driven security suite. These three Agents eliminate blind spots across the entire threat timeline: The Present: The AI SOC Agent analyzes real-time alerts and neutralizes…

Read more →

Chinese smartphone makers have been followers in the global market, embracing the concepts and paradigms set in the past 20 years by Apple and Google. But AI may be giving the Chinese an opportunity to break away and set their own path forward.  Specifically, Chinese companies are integrating AI more fully into smartphones, and also…

Read more →

Companies are deploying AI agents into everyday work at a pace no security program was built for. Related: AI layoffs pays for AI infrastructure The rush is competitive. Nobody wants to be the last one still doing this by hand. What’s getting skipped is the harder question: once an agent is acting on a company’s…

Read more →

An unknown Chinese-threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a…

Read more →

The corporate world has taken more than just algorithms and platforms from the tech world. It has absorbed some of the tech mindset, too.

Read more →

Korean telco KT has been fined $39m for a year-long breach linked to femtocell compromise

Read more →

The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web. The data included names, organisations and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and customers. The incident, identified on July 26, also exposed some names

Read more →

Alleged Żabka data leak offered for €5,000 includes Jira data, GitLab repos, and secrets; researchers verified much of the sample. A brand-new forum account showed up on August 2, posted once, and asked five grand for what it claims is a full data dump from Żabka Polska. Żabka Polska is Poland’s largest convenience store operator…

Read more →

In cybersecurity, third-party risk management normally looks simple on paper: evaluate your vendor, learn the risk, report out on the gaps and weaknesses, transfer to the contract, and continue. Unfortunately, it seldom works that way in practice. In my roles as a CISO, I find my teams in an intermediary position as the compliance and…

Read more →

OpenAI banned a coordinated network of ChatGPT accounts that likely originated in Cambodia’s Preah Sihanouk province, a region reports have linked to online scam compounds and human trafficking operations. The network used the company’s models to create and manage fake online personas, generate and translate messages sent to scam targets, produce promotional content for fraudulent…

Read more →

A hacker has drained nearly $89m from Coldcard Bitcoin wallets after exploiting a legacy bug

Read more →

When OpenAI disclosed that one of its models escaped a test environment and broke into Hugging Face’s systems on its own, headlines cast the incident as the start of a new era of AI-driven attacks. But the underlying cause of the incident was a familiar one: a misconfigured sandbox — the same kind of fundamental…

Read more →

Thermo Fisher Scientific has patched a flaw in select Applied Biosystems human identification software that could allow data files to be altered before analysis software loads them. The vendor’s July 31 security bulletin says nearly undetectable changes to .fsa and .hid outputs could occur if laboratory controls are circumvented. Thermo Fisher tracks the issue as…

Read more →

Swoop has been named the winner of Postpaid Mobile Plan of the Year Large at the 2026 WeMoney Telco and Broadband Awards.

Read more →

Last week on Malwarebytes Labs: Fake Fortnite rewards are stealing players’ accounts Fake Flash Player installs AtlasRAT Malwarebytes for Windows, now available on the Microsoft Store Hims & Hers sued over alleged health data privacy failures Hidden prompt turns Microsoft Copilot into an AI worm Apple accused of letting fake crypto app steal $1.8 million…

Read more →

N-able said attackers exploited an authentication bypass in N-central to gain remote administrative access and reach the customer systems managed through those servers. Its first fix was incomplete. CVE-2026-18577 affects N-central builds prior to 2026.3.1.7. N-able shipped build 2026.3.1.7 on August 2 as the first unaffected version. N-central is the remote monitoring and management platform

Read more →

Three high-severity security flaws have been disclosed in Hugging Face’s Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence (AI) supply chain to security risk. “These vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the

Read more →

Today, we welcome the 47th government onboarded to Have I Been Pwned’s free gov service: Nepal. Their National Cyber Security Centre now has access to monitor Nepalese government domains against the data in HIBP. This gives the NCSC the ability to identify exposure across government email addresses and respond quickly when those accounts appear in…

Read more →

Ruby on Rails fixed a critical vulnerability that could let unauthenticated attackers read files and achieve remote code execution. Ruby on Rails has patched CVE-2026-66066, a critical vulnerability (CVSS score of 9.5) that could allow unauthenticated attackers to read arbitrary files from vulnerable servers. In the default configuration, applications that generate image variants may expose…

Read more →

In this interview with Help Net Security, Mike Wiacek, founder and CTO of Stairwell, explains Backstory, an AI agent that takes a single alert and works outward to map how far a malware campaign spread. He walks through the research behind the claim that each published sample hides an average of 2.4 undocumented variants, describes…

Read more →

In this Help Net Security video, Mike Boyle, VP of Business Units at GMO GlobalSign, and Rahul Powar, CEO and founder of Red Sift, unpack the evolution of email security and why it matters for business trust. With a combined 45+ years worth of experience in tech, they dissect email from the very beginning, before…

Read more →