Las Vegas, United States, 5th August 2026, CyberNewswire
Category: Global Security News
Global Security News
Join Us at the Payment Industry Events of the Year
Registration is now open for the PCI Security Standards Council’s 2026 Community Meetings! Join payments industry professionals from around the world for inspiring keynotes, valuable networking opportunities, expert-led sessions, hands-on workshops, an expansive vendor showcase, and a special celebration marking 20 years of PCI SSC.
Global Security News
ArmorCode enhances attack path analysis with new AI agents and Context Risk Graph
ArmorCode has announced a major expansion of its Agentic Control Plane. Four new Anya AI agents help security teams analyze cloud risks, assess vulnerability exploitability, identify mitigation strategies, and coordinate patch orchestration. It also unveiled new Context Risk Graph capabilities for expanded attack path analysis, network reachability and patch management. These enhancements help security teams…
Global Security News
I’ve dictated over 120,000 words with my voice – these are my 3 favorite tools (and one is free)
I tested today’s leading AI voice tools to find which delivers the best accuracy, privacy, corrections, and everyday productivity without slowing down real work.
Global Security News
Open-source software’s archenemy TeamPCP goes back further than anyone thought
TeamPCP, the threat actor behind an unrelenting flurry of attacks on open-source software this year, has been active much longer than previously thought, according to research Oligo Security shared exclusively with CyberScoop. The threat actor, which gained notoriety and has captivated threat hunters as it compromised and injected malicious code into more than 1,000 software…
Global Security News
Tuskira expands exposure management with Agentic Control Plane
Tuskira has launched its Agentic Control Plane for Exposure Management, a new capability within the Tuskira platform that governs AI-discovered vulnerabilities from scan to verified closure. The capability extends Tuskira’s existing zero-day and exposure-response capabilities to frontier-model scanning. Tuskira applies enterprise policy to AI and legacy scanner workflows, maps findings to the deployed environment, determines…
Global Security News
Tenable Hexa AI: Automating exposure remediation with agentic routines
Discover how Tenable Hexa AI closes the gap between exposure management and endpoint patching using intent-driven routines, smart guardrails, and human approval. Key takeaways The problem: A slow handoff between security workflows creates a days-long remediation gap. The solution: Tenable Hexa AI bridges this gap using intent-driven Routines that automate scoping, deployment, and verification across…
Global Security News
Lumu launches live threat intelligence platform for real-time cyber defence
Lumu has announced the release of Lumu Threat Observatory as part of Maltiverse, its threat intelligence solution. Lumu Threat Observatory is Maltiverse’s live, personalized threat-intelligence experience, providing organizations with a complete, live view of the active threats targeting their specific sector, helping them spot malicious adversaries early, prioritize vulnerabilities, and automatically block them. While threat…
Global Security News
Desktop Linux just cracked 10% market share – and Windows 11 is mostly to blame
Windows is in decline, and both Macs and Linux are gaining ground at its expense.
Global Security News
INTERPOL flags AI as the new engine of African cybercrime
Africa’s growing digital economy is exposing governments, businesses and internet users to a rising wave of cybercrime. The continent recorded more than 1.1 billion mobile subscriptions and over $1.1 trillion in digital transactions in 2025, while more than 570 million people relied on the internet for banking, government services, healthcare and education. The post INTERPOL…
Global Security News
AI agent deception moves from theory to reality in UK cyber tests
“During a routine cyber evaluation, AI agents took sustained, unsanctioned action directed at real people and organisations,” UK’s AI Security Institute (AISI) disclosed on Tuesday. The agents’ actions included an attempted supply-chain attack that saw them create malicious pull requests and try to socially engineer an open-source maintainer into approving the malicious code (they refused).…
Global Security News
Uppsala Security Becomes First Blockchain Intelligence Company to Join Cyber Threat Alliance
Global Security News
Critical Paperclip bugs expose AI agent trust failures
Security researchers are warning against trust assumptions in AI security with newly detailed flaws affecting the open-source AI agent platform Paperclip that could be chained into remote code execution (RCE), data exposure, and developer-machine compromise. An Oasis Security research shared with CSO ahead of its publication on Wednesday disclosed details of three recent vulnerabilities affecting…
Global Security News
New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch
A memory corruption flaw in the Linux kernel’s Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions, and a public exploit ships with pre-built records for roughly 800 kernel builds. The vulnerability, tracked as CVE-2026-64531 (CVSS score: 7.8) and codenamed OVSwrap by its discoverer, was disclosed…
Global Security News
Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk
Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled device codes that victims approve on Microsoft’s real authentication page. Once access and refresh tokens are issued, attackers may retain access to email, documents, and cloud resources, creating a direct path to data exposure,…
Global Security News
How to Build an Incident Response Plan When You Don’t Have an IT Team
In this post, I will show you how to build an incident response plan when you don’t have an IT team. Without an IT team, incident response falls to whoever notices the problem first, which is why the plan has to exist on paper before anything happens. A compromised email account, a ransom note on…
Global Security News
OpenAI, Anthropic AI agents resorted to deception in new cybersecurity incidents
OpenAI’s GPT-5.6 Sol and Anthropic’s Mythos 5 have been implicated in another series of AI security incidents after the models created fake online identities, targeted real people, and attempted to manipulate developers into approving malicious code during controlled cyber evaluations, according to the UK AI Security Institute. “On 28th July 2026, AISI’s Security Team detected unusual…
Global Security News
Code review used to be the only way to catch these bugs
An automated system called NOVA read the source code of 3,915 open-source projects over two months and came back with 14,090 vulnerabilities, each one confirmed through the system’s validation pipeline. Vulnerability researchers at Palo Alto Networks’ Unit 42 built the system and checked its output against the public record afterward. Only 85 findings matched anything…
Global Security News
Inside the Long, AI-Powered Quest to Perfect Pringle-Making
Kellanova, which manufactures Pringles in Europe, says a new AI project could be the key to improving production of the iconic chip.
Global Security News
Google’s synchronized passkeys can be stolen in ‘Pass‑ta‑key’ attacks
Passkeys were supposed to make stolen passwords a thing of the past. No password to phish, no secret to reuse, and no string of characters sitting in a database waiting to be leaked. Over time, it’s thought that passkeys will replace passwords entirely. But what happens when malware steals the master key? Researchers have found…
Global Security News
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1. The file-read flaw is tracked as CVE-2026-59774, rated Critical with…
Global Security News
Prompt Injection Remains Biggest LLM Risk, Despite Limited Incidents
Prompt injection remains the most dangerous security threat to LLMs, according to OWASP’s latest Top 10 LLM Applications list
Global Security News
Leaked n8n API Tokens Exposed Live Instances to Credential Theft
GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to access sensitive data and downstream credentials without exploiting a software vulnerability. We scanned public GitHub commits for exposed n8n API tokens and identified 4,576 unique credentials associated with 1,255 hostnames. Of the…
Global Security News
Brazil Health Surveillance Database Exposed 79GB of Sensitive Records
Brazil’s SISVISA health surveillance system left 102,215 files totaling 79GB open online, including tax IDs and identity documents, without password protection.
Global Security News
BLACK HAT ROUNDTABLE: Security pros dissect fallout from Hugging Face’s double guardrail failure
It’s come to this. A cyberattack carried out by a machine. Worse, a machine that picked its own victim. Whether that counts as agency is where the experts below part company. Related: Huggy Face break-in explained Hugging Face disclosed July 16 that intruders had moved through its production infrastructure over more than four days, harvesting…
Global Security News
The best 98-inch TVs of 2026: Expert tested
Create the ultimate movie theater experience at home with 98-inch TVs from Hisense, Samsung, and more.
Global Security News
One C2 kit. 30 customers. 2 governments
I was mapping the command-and-control infrastructure behind a state-linked intrusion set when the query came back and effectively ended the exercise I thought I was running. The malware resolved its C2 address by reading a smart contract on a public blockchain. Public reporting described one contract. Working from the chain rather than the sample, I…
Global Security News
ChainDrop Worm Hits 400+ npm Packages with Two Billion Monthly Installs
Global Security News
6 things you should know about Google’s new selfie sign-in system
Losing access to your Google account might just be the epitome of a modern-day nightmare. Especially if you’re using Android and even more so if you’re invested in lots of different Google services on top of that, the amount of access and info connected to that one single sign-in is just staggering. Think about it:…
Global Security News
15 TP-Link Omada vulnerabilities let attackers hijack routers and intercept camera traffic
TP-Link prints the serial number of an Omada router on its packaging and on a label attached to the device. Those numbers run in sequence, and feeding a guessed one to the Omada cloud service returns the matching device’s MAC address and model. Serials beginning 22460J500 appear to be ER605 routers, and serials beginning 224608100…
Global Security News
SpaceX Needs to Make Its Bigger Rockets Work
None of the company’s most ambitious plans are possible without the success of its Starship rockets.
Global Security News
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The “evil twin” extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security. The packages have…
Global Security News
Junk Cleaner clears the clutter from your Android
Your phone is full again, and the warning appears at exactly the wrong moment. Suddenly you can’t update apps, record a video, or save another photo. The cause is rarely one giant file. Storage disappears in a steady drizzle of leftovers: temporary files an app creates and forgets, caches that grow in the background,…
Global Security News
Need to run Windows or Android apps on Linux? This new release makes it easy
If you’re looking to use Linux but want an easy path to install and use both Windows and Android apps, AnduinOS is a great choice.
Global Security News
AI is getting better at election facts, but voters shouldn’t rely on it
Like seemingly everything else these days, artificial intelligence will re-shape the way voters gather information on candidates running in the 2026 midterm elections. In some ways, this is already the reality. Voters are increasingly turning to AI chatbots for information instead of Google. Political campaigns are deploying deepfakes of their opponents. And AI systems have…
Global Security News
Your orchestration framework choice is a security decision, not just an engineering one
Comparisons of LangChain, CrewAI and AutoGen are easy to find — dozens of guides this year cover the same ground: developer experience, ecosystem maturity, how easy it is to wire up multi-agent workflows. None of them ask the question I actually care about: does the framework you pick change how easily your agent gets compromised?…
Global Security News
Say Easy, Do Hard – Performance Through People – Greg Hoffman – BSW #459
Global Security News
Frontier Models Engage in Unsanctioned Behavior During Testing
Anthropic and OpenAI models attacked “real people and organizations” during AI Security Institute tests
Global Security News
Bank of America impersonators weaponize ScreenConnect, then make it hard to remove
A phishing campaign impersonating Bank of America (BoA) is underway, trying to trick Windows users into installing ScreenConnect remote access software and then making it difficult to uninstall it. Different traps for Mac and Windows users By claiming the recipient must take specific actions “to avoid account restrictions,” the email, sent from onlinebanking@ealerts[.]bkofamerica[.]com, tries to…
Global Security News
Why you need a reliable AI agent kill switch
Recent high-profile rogue agent incidents involving OpenAI and Anthropic underscore the fact that organizations can’t put blind trust in their AI guardrails. Moreover, they must able to turn off agents quickly when they deviate from intended behavior — before they can do potentially catastrophic damage. For legal services company Purpose Legal, that includes incorporating a…
Global Security News
Safeguarding 200M Users: How ChongLuaDao Scales Threat Validation with ANY.RUN
ChongLuaDao protects over 200 million users from cybercrime, having detected more than 1.4 million malicious websites since 2020. Rapid processing of community reports is essential to their operations. In our recent conversation, ChongLuaDao co-founder Hieu Ngo told us how ANY.RUN plays an integral role in the project’s infrastructure, helping it power thousands of safety checks…
Global Security News
Fake Bank of America Phishing Scam Installs Remote Access Malware
Cybercriminals are using a fake Bank of America phishing campaign to trick users into downloading a malicious script that installs ScreenConnect, enabling remote access and persistence on compromised systems
Global Security News
Angola’s Largest Telco Breached Hours Before IPO
Unitel, Angola’s dominant mobile operator, continues to recover from a cyberattack that caused outages the day of the government-owned telco’s public offering.
Global Security News
Cloudflare gives AI agents wallets with built-in spending controls
Cloudflare’s Wallets will give AI agents running on its platform a human-readable wallet handle for paying APIs and online content within limits set by their creator. Handle reservations have opened, while the service will become available in the coming months. It will include two types of digital wallets: Account Wallets and Virtual Wallets. Wallets (Source:…
Global Security News
Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself
An agent running Anthropic’s Claude Mythos 5 spent 34 hours trying to get a malware dropper merged into a real open-source project during a cyber evaluation by the UK’s AI Security Institute. When a bystander publicly warned that the code was malicious, the agent denied it, force-pushed a rewritten branch history to erase the evidence,…
Global Security News
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows – CVE-2026-9198 (CVSS score: 9.8) – A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve…
Global Security News
Kali365 Exploits Microsoft Device Login to Access US Corporate Data
Learn how Kali365 has been abusing Microsoft device login to gain OAuth tokens, targeting US firms, and how SOC teams can detect, hunt, and stop these phishing attacks.
Global Security News
AI threat report: Rogue agents, workflow attacks
Malicious AI use and threats to AI systems are requiring cyber teams to double down on security fundamentals and rethink the future of their approaches to defense. Newly emerging AI-enabled attacks, proofs of concept, and in-the-wild techniques, as well as the latest AI vulnerability and risk research, present inklings not only about what enterprises presently…
Global Security News
One millionth vehicle connects to Australian-built eCall platform – a milestone for road safety
Intelematics, a leading provider of emergency call eCall and connected vehicle services across Australia and New Zealand, has today connected its one millionth vehicle.
Global Security News
SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access
SMOKE#SCREEN uses fake Zoom updates to install ScreenConnect RMM, giving attackers persistent remote access while bypassing defenses. Securonix Threat Research has been tracking an active multi-wave campaign they’ve named SMOKE#SCREEN, in which unknown attackers use rotating social engineering lures, fake Zoom updates, Adobe software notices, business document reviews, system maintenance utilities, to silently install ConnectWise…
Global Security News
QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
Cybersecurity researchers have disclosed what has been described as a “long-standing supply chain attack” on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attack has been ongoing since at least August 2025 and involves a trojanized version of the application…
Global Security News
Future AGI: Open-source platform for shipping self-improving AI agents
Future AGI is an open-source platform for tracing, evaluating, simulating, and guardrailing LLM agents, licensed Apache 2.0 and self-hostable. Self-hosted instances register with Future AGI on first boot and send an instance ID, a version string, a deployment type, and the email addresses and domains of active admin users. That registration fires once, before anyone…
Global Security News
Most small businesses survive data breaches. Here’s how to make sure yours does too
Despite scary made-up statistics, most small and medium businesses do beat data breaches and ransomware incidents.
Global Security News
Product showcase: Material unifies Google Workspace email, file & OAuth defense
Here’s an uncomfortable truth: the attack that gets you won’t look like an attack. It’ll look like a normal login, a normal file share, a normal permission request you clicked past without reading. You don’t have a phishing problem, a DLP problem, or an OAuth problem. You have one problem wearing three masks, and most…
Global Security News
News alert: Airlock extends endpoint control to govern AI agents and define operating boundaries
Atlanta, GA—August 4, 2026—Airlock Digital, a leader in preventative endpoint security, today announced Agentic AI Control & Governance at Black Hat USA 2026. The new capabilities build on application control by providing command- and session-level visibility into trusted AI agent behavior, centralized policy management for trusted applications and AI agents, and real-time governance over what…
Global Security News
What stops attackers wrecking industrial plants is knowing how
Engineers at an Israeli food producer spent most of a week rebuilding a refrigeration system after an intruder switched the gas cooler and receiver valves to manual and pinned them open. Liquid CO2 flooded the compressors and destroyed them. The replacement units did not match the originals, so the whole system had to be reworked…
Global Security News
News alert: Mallory links threat intelligence to governed response as exploit timelines shrink
Las Vegas, United States, August 4th, 2026, CyberNewswire – Mallory, the AI-native Threat and Exposure Management platform, today introduced a unified context and intelligence layer for security teams. The architecture has three parts: a context graph that correlates attack surface, threat, and vulnerability data; an intelligent reasoning layer that determines what matters and why; and a…
Global Security News
News alert: Community voting shapes 2026 Cybersecurity Excellence Awards
LAS VEGAS, Aug. 4, 2026, CyberNewswire – The Cybersecurity Excellence Awards today announced the winners of the 2026 Community Choice Award, selected through 79,455 votes cast during the awards season. AI security ranked among the highest-voted award categories this season. The results arrive during Black Hat USA week, where AI risk is also among the…
Global Security News
Your enterprise AI footprint is about three times bigger than your model list
Organizations are building AI systems that combine models, agents and external tools instead of relying on standalone AI, according to Snyk’s latest State of Agentic AI Adoption report. The study analyzed 3,044 enterprise environments and 1.39 million code repositories to examine how enterprises are deploying AI. Adopting agentic architectures Of organizations using AI, 46.9% have…
Global Security News
National cyber director lays out White House plans to secure AI without writing new rules
The Trump administration executive order on artificial intelligence tried to strike the balance between responsible use, security and mutual benefit, all with an eye toward not making it regulatory in nature, National Cyber Director Sean Cairncross said Tuesday. “Everyone is working towards the same goal in terms of protecting the country and securing our systems,…
Global Security News
CETA System Validates Staged Move to Automation
Completion of a staged validation sequence confirms that controlled automation cooling operates inside operator-defined thermal limits, with approval gates, failsafe operating…
Global Security News
Economic confidence on the rise? Daily GTM job roles jump nearly 20% in July, says Pointer Index
Job openings in the go-to-market sector, including Marketing, spiked nearly 20% in July with an average of 917 roles posted daily and more than 25,000 roles posted during the…
Global Security News
Ingram Micro Helps Australian Partners Lead the AI Workplace Transition with ‘The Great Migration’
Initiative unifies major tech vendors and offers channel partners a proven framework to help organisations transform productivity, strengthen security and modernise for the age…
Global Security News
Commvault Integrates Threat Scan with Google Threat Intelligence to Enable Fast, Clean Recoveries Following Cyberattacks
New threat-informed recovery capabilities help organizations identify clean recovery points quicker, reduce downtime after cyberattacks, and restore operations with confidence
Global Security News
Ingram Micro Helps Australian Partners Lead the AI Workplace Transition with ‘The Great Migration’
Initiative unifies major tech vendors and offers channel partners a proven framework to help organisations transform productivity, strengthen security and modernise for the age…
Global Security News
ISC Stormcast For Wednesday, August 5th, 2026 https://isc.sans.edu/podcastdetail/10038, (Wed, Aug 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News
Ruby on Rails critical bug puts every image upload under scrutiny
A new critical vulnerability in the Ruby on Rails (“Rails”) web application framework, CVE-2026-66066, could turn a seemingly innocuous image into a front door to your secrets. Disclosed July 30, the high severity CVE (scored 9.5 out of 10) poses a significant risk to enterprises running apps that handle user-uploaded images in Rails. Dubbed “KindaRails2Shell,”…
Global Security News
Darktrace Among First Cybersecurity Companies Selected to Integrate Risk Signals into Microsoft Agent 365
Darktrace / SECURE AI will bring its organization-specific behavioral risk signals into Microsoft Agent 365, helping customers identify anomalous or suspicious agent behavior…
Global Security News
AI Just Went Rogue Again. This Time It Turned to Deception.
A U.K. government-backed research group said OpenAI and Anthropic systems took unsanctioned actions and behaved deceptively during testing.
Global Security News
ClickHouse launches ClickHouse Labs with Andy Pavlo as VP of Database Research
Renowned database researcher will lead a new group dedicated to advancing foundational database technology and sharing its work openly with the broader community
Global Security News
SpaceX Says Spending Spree Is Supercharging AI Revenues
The Elon Musk-led rocket company spent $15.8 billion on AI projects in the second quarter and doesn’t plan to slow down.
Global Security News
BeyondTrust Showcases the First Wave of Native Pathfinder Capabilities for Every Identity at Black Hat USA 2026
Marks a major milestone in the evolution of the BeyondTrust Pathfinder platform as it advances BeyondTrust’s vision for redefining privilege management Further extends…
Global Security News
KnowBe4 Appoints Andrew Kanzer as Chief Growth Officer
FinTech veteran joins leadership team to accelerate growth, extend the channel and support the industry leader’s next phase of innovation
Global Security News
Exabeam Collaborates with Google Cloud to Give Security Teams Deeper Insider Threat Visibility in Google Security Operations
Integration enables security teams to identify insider threats faster and accelerate security threat detection, investigation, and response workflows without moving data or…
Global Security News
Cloudflare Gives AI Agents an Identity and a Wallet
New tools mean businesses will be able to see who’s behind an AI agent, and those agents will be able to pay for things safely on their owner’s behalf
Global Security News
SailPoint eliminates blind spots with unified protection across human, non-human, and AI agent identities
The definitive identity security solution built to protect, govern, and empower the converged workforce of the future
Global Security News
Rubrik Unveils Agent Identity to Secure Agentic Actions in Real-Time
Rubrik Agent Cloud now monitors every agent and MCP server, controls access per tool call, and remediates unwanted actions
Global Security News
Guidewire Introduces Qusar Release to Help Insurers Build and Control AI Agents
Qusar includes Guidewire-built claims and underwriting agents, plus Developer Assistants that help developers ship features more than 40% faster than with generic coding assistants
Global Security News
Sporting events are getting bigger, and so are the cyberthreats
The FIFA World Cup is one of the largest tournaments in the world. We saw Scottish fans bring joy to Boston, Japanese and Dutch fans chanting together, and South Korean and…
Global Security News
Sophos DNS Protection update for GenAI
Global Security News
Telstra Health Receives Frost & Sullivan’s 2026 APAC Company of the Year Recognition for Leadership in Native Healthcare Enterprise Interoperability Platforms
This recognition highlights Telstra Health’s innovation, clinician-led approach, and leadership in advancing connected healthcare through FHIR-native interoperability.
Global Security News
From bean counters to token counters: Chris Griffith on how government’s AI story grew up at Tech in Gov 2026
Government’s AI pitch used to be all promise. On day 1 of Tech in Gov 2026 in Canberra, one of Australia’s most experienced technology reporters told me the promise has been…
Global Security News
OpenAI, Anthropic AI agents targeted real people and systems in cyber tests
OpenAI and Anthropic have confirmed that their AI models were involved in separate, newly disclosed third-party cybersecurity testing incidents that resulted in a real website being breached and social engineering attacks against people outside the intended testing boundaries. […]
Global Security News
D-Link’s expanded industrial switch range is built for 6kV surges, 75°C heat and the sites where ordinary networking gear quietly dies
Walk into a mine substation, a food plant wash-down bay or a roadside camera cabinet cooking in the summer sun, and the cheap switch blinking away in the corner is living on…
Global Security News
AISI, OpenAI report more ‘unsanctioned’ model hacks
The UK’s AI Security Institute said that their AI research system took “unsanctioned” actions over the internet to engage in “sustained, potentially harmful activity directed at real people.” According to a blog post and technical report released Tuesday, the organization noticed “unusual data transfers” leaving their research systems through the pseudo-anonymous Tor network on July…
Global Security News
ChainDrop credential stealing worm infects over 400 npm packages
A self-propagating worm-like attack is hitting the npm registry, having infected 444 packages from more than a dozen publishers so far. The impact is massive, with the packages affected amounting to more than 2 billion monthly downloads combined. The attack began with the compromise of a GitHub account belonging to Jared Wray, who maintains Keyv,…
Global Security News
White House’s AI Guidelines Exempt U.S. Open Models From Government Review
The new framework, completed in recent days, is seen as most likely to affect OpenAI, Anthropic and Google.
Global Security News
TP-Link patches Omada ZTP flaws allowing hackers to breach networks
TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices that could be chained with previously disclosed flaws to achieve remote code execution (RCE). […]
Global Security News
Massive supply-chain attack compromises 440 packages under four hours
In less than four hours early Tuesday, an attacker compromised a GitHub maintainer account and unleashed a self-replicating piece of malware which injected malicious code into more than 440 distinct npm packages, according to multiple security firms. The worm, built on the open-source Mini Shai-Hulud repository that TeamPCP published in May, was initially let loose…
Global Security News
Micropatches released for Windows Internet Key Exchange Service Extensions RCE (CVE-2026-33824)
April 2026 Windows Updates brought a patch for CVE-2026-33824, a remote code execution vulnerability in Windows IKE Extension, allowing an unauthorized attacker in the network to cause memory corruption in a privileged service on another computer in the network and potentially execute privileged arbitrary code there. The vulnerability was found internally by Microsoft WARP &…
Global Security News
Phishing service spoofs RingCentral to steal Microsoft 365 accounts
The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts. […]
Global Security News
AMD Shares Slip as Company Narrowly Beats Revenue Forecasts
Sales to data centers grew to 58% of revenue for the company, which has pivoted hard to serving the fastest-growing types of AI workloads.
Global Security News
Randomness, Grey, Deepseek, Sonicwall, Spice, CaptiveCrunch, eBay, and Aaran Leyland – SWN #604
Global Security News
Microsoft Warns Russian Hackers Use Hotel Wi-Fi to Steal Credentials
Connecting a work laptop to hotel Wi-Fi could expose corporate credentials and sensitive data. Microsoft has uncovered a Russian state-backed campaign that uses compromised hospitality networks to target travelers. Tracked as CaptiveCrunch, the campaign has affected networks in several countries since early May 2026. Malicious prompts appear during the normal connection process, allowing them to…
Global Security News
Apple battles it out again with the UK over encrypted iCloud access
The UK Home Office has once again demanded Apple allows it access to encrypted iCloud data. The Guardian reports that the Home Office issued a Technical Capability Notice to Apple, this time targeting only British users. A Technical Capability Notice is a formal government order that compels tech and telecommunications companies to build or maintain…
Global Security News
OpenAI Calls Apple’s Trade-Secret Suit ‘Careless’ and ‘Oddly Personal’
Apple asked the court for a preliminary injunction, and OpenAI followed up by alleging the iPhone maker was sloppy about security.
Global Security News
SpaceX Revenue Rises 92% in Second Quarter
SpaceX brought in $7.8 billion in revenue in the second quarter as the company released its first earnings report as a public company.
Global Security News
SharePoint Flaws Used to Hack Switzerland’s Federal IT Agency
Swiss Federal IT Agency FOITT says attackers exploited SharePoint flaws to compromise about 200 accounts. Servers are being rebuilt as investigations continue. Switzerland’s Federal Office for Information Technology and Communications, known as BIT or FOITT, disclosed that unknown attackers had compromised approximately 200 accounts on its on-premises SharePoint servers. The FOITT said the unknown attackers…
Global Security News
New npm packages deliver remote access trojan targeting Alibaba developers
A new set of malicious npm packages were discovered targeting users of Alibaba developer tools with a cross-platform remote access trojan (RAT).
Global Security News
Bogus SQLite vulnerabilities highlight flaws in CVE pipeline
The Register reports that a batch of critical and high-rated SQLite CVEs, which were recently added to the National Vulnerability Database (NVD) with enrichment from CISA, were identified as technically invalid by security researchers.