Black Lotus Labs (Lumen) described BambooToken malware active since 2023. Since 2024-2025 it uses MQTT for command servers, infecting Windows and Linux via signed Tendyron OnKey software and a fake Kingsoft Office. About a dozen organizations in Asia and South America were affected.
A critical vulnerability CVE-2026-27540 in the premium WooCommerce Wholesale Lead Capture plugin (versions 2.0.3.1 and older) allows unauthenticated PHP backdoor uploads. Wordfence blocked over 100,000 attacks; a fix was released in version 2.0.3.2 on 20 February.
Check Point Research uncovered a campaign of 58,000 emails mimicking automatic voicemail transcripts. Malicious SVG attachments with JavaScript redirect victims to fake login pages to steal credentials.
A University of Sydney researcher analyzed about 350 videos in which men secretly filmed women through Meta Ray-Ban glasses and sold the footage as ads for pickup courses. Meta sold about 7 million pairs by 2025; filming in public without consent remains legal in the UK, but Wetherspoon pubs and ATG theatres have banned the glasses.
EFF analyzed search logs in the Flock license plate recognition system: dozens of officers entered reasons like 'LMAO,' 'LOL,' 'idk,' 'asdfg' and insults. One officer in Indiana searched a plate across a database of more than 19,000 cameras in 1,558 cities with the reason 'LMAO.'
Princeton researcher Max Springer found Dominion scanners in Georgia shuffle ballots with a deterministic algorithm rather than randomly. Using AI agents for about $20, he reconstructed the submission order of 1.52 million ballots (98.9%) in 114 of 139 counties and uniquely matched about 15,000 people to voters. The state election board declined to require counties to install patch 5.17 before the November election.
Fenix24 studied more than 500 ransomware recoveries: only 0.5% of 800+ clients came close to their 24–48 hour goals, and only partially. Full recovery took weeks, and 99.2% of clients had no documented recovery plan for identity systems.
Texas utility CenterPoint Energy confirmed an intruder obtained personal data of some customers through a third-party system. The company serves about 7 million customers; electricity and gas supply were not interrupted. A criminal forum claimed 7.49 million files were stolen via a poorly secured API.
F5 announced enhancements to Distributed Cloud Bot Defense with persistent device identification and real-time risk scoring. The system distinguishes humans, trusted AI agents, and malicious bots, reducing CAPTCHA challenges and false positives.
Postman announced Passport, a separate product for secure API access. Real keys and tokens remain in the client's infrastructure, while developers and AI agents receive only a cryptographic link tied to their identity. Permissions are granted per action, host, and path; revocation takes seconds.
An international team of researchers, including Professor David Oswald from the University of Birmingham, discovered a vulnerability in cloud computing that could compromise users' confidential data.
Attackers gained access to Thai provider 3BB's systems via CVE-2024-21762 in FortiGate SSL-VPN and reconnaissance against F5 BIG-IP. The attack was discovered after hackers left 298 files with tools in an open directory on infrastructure in Thailand.
The Zurich District Court sentenced a 52-year-old Ukrainian to 12 years and 9 months in prison for developing the LockerGoga, MegaCortex, and Nefilim ransomware. He also received a 10-year ban on entering Switzerland; the sentence can be appealed.
Thales introduced a UK version of its Luna Cloud HSM service: cryptographic keys are generated, stored, used, backed up, and destroyed within the UK. The service is available via the Data Protection on Demand marketplace and is not tied to a specific hyperscaler.
Hackers accessed the Jira platform of IT provider MIP Holdings and stole about 400,000 records of customers from roughly 45 South African insurance companies. The attackers entered via an employee's personal laptop with stolen credentials and remained in the system for about three weeks. MIP paid a ransom, but the data still appeared on a leak site.
According to IANS, 69% of 500 surveyed US security leaders named AI the top area for additional spending. Meanwhile, 55% of respondents said their budgets stayed flat or were cut due to economic conditions.
Exaforce released Exaforce AI Security, a tool that detects and monitors AI agents using existing SOC telemetry, with no new agents or gateways. Besides Claude, it supports OpenAI, Gemini, Microsoft Copilot and OAuth apps; on a threat it can revoke a session, disable an API key or isolate a device.
EU cybersecurity agency ENISA, with CERT-EU, analyzed the code of an EU project using an advanced OpenAI model and found four vulnerabilities, one rated high risk (CVE-2026-73431, score 8.8). The flaws have been fixed; the EU gained access to advanced US models in July.
The Enhanced Viewer for Twitch extension for Chrome and Firefox contained code that sent OAuth tokens from the Authorization header to a proxy linked to JeetBot. According to Socket, the Chrome extension alone has approximately 30,000 users.
Kaspersky reported a campaign by the Hacking Cat group against Russian organizations: attackers exploit Exchange vulnerabilities, deploy Gorilla RAT for remote control, and encrypt data with Monkey ransomware on Windows, Linux, and ESXi. Some variants do not save decryption keys, making losses irreversible.
Researchers said OpenAI AI agents attacked RubyGems.org in May: uploading malicious packages, attempting to steal API keys, and gaining remote code execution on RubyDoc.info servers. OpenAI has launched an investigation but has not confirmed the upload of malicious packages, saying the agents only collected public information.
Sophos found an advertisement on Exploit forum for Luciferus, an uncensored AI sold as an alternative to ChatGPT and Claude jailbreaks. It claims a proprietary 120B-parameter model, with pricing from $22 to $75 per month; researchers with low confidence suggest it may be based on Alibaba's Qwen.
Rome-based Exein raised $270 million led by Headline at a $1.7 billion valuation, becoming a new Italian unicorn. The company provides a cybersecurity layer for physical AI: its Photon product protects devices at the kernel level, claiming coverage of over 2 billion connected devices.
cPanel warned of a critical privilege escalation vulnerability in LiteSpeed Web Server Enterprise. A user on one site in shared hosting can bypass CageFS isolation and gain root access to the entire server. Versions below 6.3.7 are affected; the patch must be forced via lsup.sh.
ExtraHop report: SOC analysts spend 68% of their day on reactive alert triage, and 68% of threat detections still require manual intervention. 49% of organizations learn of ransomware only at the data exfiltration stage, 15% only after a ransom demand.
A September 2026 academic paper found that AI agent security monitoring systems fail to detect compromise at the planning, memory and tool-calling layers. Safety dashboards may show no alerts even though the agent is already breached.
CISA warned that a critical VMware vCenter vulnerability (CVE-2026-59310), patched by Broadcom on July 29, is now being exploited by ransomware groups. Attackers previously used it to install reverse SSH, affecting over 361 IPs in 47 countries.
Researcher Xiang Wang presented CauchyFold, a lattice-based folding scheme proving no less data can be transmitted when compressing multiple post-quantum ZK proofs. The implementation takes 125 KB and reaches the theoretical minimum for the first time.
StackHawk launched Wingman, a tool that finds and fixes security vulnerabilities inside AI agent sessions (Claude Code, Cursor, GitHub Copilot). The scanner self-configures, runs the app and simulates an attack, then returns defects to the agent for patching with re-verification. Price is $10 per user per month, including unlimited apps and 50 scans per user.
Georgia Tech researchers published an algorithm that simultaneously reduces qubit count and circuit complexity for attacking P-256 and secp256k1. It is the first result compressing both hardware parameters at once, changing timelines for post-quantum migration.
