Researchers cloned a stolen Flock Safety camera and found an encryption key on an unencrypted partition. The clone contained 1.6 million images and 27,321 video clips over 21 days, contradicting the company's data protection claims.
CERT-In rated CVE-2026-67276 in MikroTik RouterOS as critical: a forged RSA key and signature allow bypassing SSH authentication and gaining full administrative control. Fixes are in versions 7.24.2, 7.23.4, and 6.49.21.
Hacktron researchers using Claude and Codex found the HEIF Heist vulnerability in libheif and libde265: malformed HEIF/HEIC/AVIF files can cause memory corruption, data leaks, and remote code execution. OpenAI, AWS, GitHub Enterprise, and Discourse were at risk; OpenAI paid $6,500 bug bounty.
A Guardian investigation found sensitive data from over 40 UK police forces is stored in Microsoft Azure, which a 2017 official security assessment deemed vulnerable to compromise by foreign actors and the US government. Some files exceed the official level, and Microsoft admitted it cannot guarantee data sovereignty.
WordPress released patches for a new set of core vulnerabilities. The Click2Shell chain allows installing a theme from the official WordPress.org directory without clicking the Install button, requiring only that an administrator opens a specially crafted link. The vulnerability can lead to arbitrary code execution.
An international warning says North Korean group WaterPlum posed as recruiters and sent fake coding tests, infecting over 30,000 devices and stealing more than $10.71 million. Over 7,000 crypto wallets were affected, with funds going to finance North Korea.
Google's cyber threat intelligence group detailed how one of its employees infiltrated the hacker group TeamPCP and helped stop a series of software supply chain attacks that affected thousands of companies.
iProov published an experimental HAPS (Human Approval and Presence Specification) to bind human presence and approval to machine-readable AI agent actions. The protocol on GitHub under Apache-2.0 includes a partial Rust implementation and test vectors; the approach is risk-based and independent of the presence verification method.
From January 2025 to July 2026, IC3 received about 61,000 complaints about scammers impersonating police and government officials, with average losses over $26,000 per complaint. The most profitable variant involved video calls with fake uniforms and government backdrops: 1,809 complaints and over $140 million in losses.
Fraudulent car listings using AI have spread on Facebook Marketplace, featuring fake dealer licenses, window stickers, and bogus GPS trackers. Photographer Will Matthews lost $36,240 after paying for a nonexistent Toyota 4Runner TRD Pro via a Tier 1 bank loan.
The FBI, US Department of Defense and agencies of Japan, Australia and Germany warned about the WaterPlum (Contagious Interview) group, which poses as employers such as AI and crypto companies to attack developers and IT specialists. More than 30,000 devices in 100+ countries were infected, and about $11 million in crypto was stolen from 7,000 wallets.
From August 21 to 24, the FBI and US Coast Guard boarded two oil tankers heading to the US after reports of network hacks. Hackers gained control of navigation, propulsion and cargo systems on at least one vessel. The US is investigating possible Iranian involvement.
In August 2026, China's National Network and Information Security Notification Center named five cross-border botnet families — Mirai, CondiBot, Gafgyt, TBot and SoftBot. They gain initial access through Telnet and SSH brute force using factory passwords and exploitation of old vulnerabilities.
T-Mobile COO Jon Freier posted a photo on X of a warehouse with iPhone 18 Pro boxes, showing IMEIs and serial numbers of dozens of devices. The post was deleted, but the numbers could have been copied by automated tools, risking false blocking or cloning before activation.
The Pakistan-linked group Transparent Tribe (APT36) is attacking government and defense targets in India and Afghanistan. Zscaler ThreatLabz discovered new tools RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH, with private GitHub repositories used for C2.
Flock Safety created a fictitious police account 'Flock City PD' and used its FreeForm AI search to query real city cameras in Georgia and Texas for people with Stars of David, political stickers, and protest signs. Moderation failed to block some sensitive queries, as revealed by audit logs obtained by 404 Media.
A campaign uses SEO-optimized GitHub repositories impersonating LastPass and 39 other companies to deliver the new Rapuncel infostealer. It also installs a Microsoft-signed Alinubx.sys driver that disables 145 antivirus and EDR solutions.
eSentire researchers found the GhostCode phishing kit abusing Microsoft's legitimate OAuth device authorization flow to steal Microsoft 365 access tokens. The attack registers devices in Intune and obtains a Primary Refresh Token with a 14-day lifetime, enabling persistent access.
Microsoft Security Research linked cloud account compromises to attacks in which criminals call employees posing as IT support and ask them to update a passkey or sign-in settings. Attacks tracked since May: hackers added their own authentication methods, explored resources via Microsoft Graph and downloaded files from SharePoint and OneDrive, sometimes accessing Exchange Online mail.
MSMT released a report on the North Korean IT worker scheme: in 2024 they earned up to $800 million. Argentina, Pakistan, Vietnam, and Laos took measures—investigations, arrests, and sanctions against intermediaries. China increased surveillance, making it harder for workers to enter.
A Zurich court sentenced a Ukrainian developer of Lockergoga, MegaCortex and Nefilim ransomware to nearly 13 years in prison, with damages estimated at $123 million. SecurityWeek also reported CVE-2026-44756, a critical SAP Extended Passport flaw allowing unauthenticated code execution, and the Plugin4Shell attack on AI agents Claude Code, Codex and Copilot.
Iran and China, along with Israeli companies, have for the first time used open Chinese AI models and AI agents for autonomous online influence campaigns. According to NYT, this heralds a new stage of online manipulation.
Hacker group The Gentlemen has published data stolen from insurer Hollard in the dark web following a June attack on its contractor MIP Group. According to ITWeb, the attackers demanded a ransom; data of clients of about 45 South African insurance companies, mainly funeral policyholders, was affected.
The US cybersecurity agency CISA released recommendations for deploying cyber decoys—honeypots, lures, and honeytokens—to detect intrusions. The decoys complement the Zero Trust model by identifying attacker activity that uses legitimate credentials and living-off-the-land (LOTL) techniques.
An LNG tanker en route from the US to Europe experienced system failures that the crew believed was a likely cyberattack. Details of the incident and possible damage were not disclosed.
The Zeek project released 9.0, an LTS version of its network security monitoring system. It adds cluster event streaming, parsing of encapsulated traffic (GRE, VXLAN) and the Spicy 2.0 parser generator with up to 40% faster compilation and support for QUIC-v2 and HTTP/3.
Huntress described a new Settra ransomware variant used against a retailer in July and a manufacturer in September. Attackers deployed the MeshAgent RMM tool, disabled Windows recovery features and used a vulnerable driver (BYOVD).
ServiceNow unveiled a set of security features, including Agentic Exposure Management and AI agent access control, building on its acquisitions of Armis and Veza. The company proposes 'shift zero' — real-time vulnerability detection as AI accelerates attacks.
Cyber-espionage group NightEagle (APT-Q-95), which previously attacked Chinese defense and technology companies, has shifted to Russian organizations. According to Kaspersky, the hackers entered networks via VPN using stolen credentials, then deployed the GhostContainer backdoor on Microsoft Exchange servers.
Russian forces claimed strikes on Ukrainian infrastructure, including the De Novo data center in Kyiv — one of the country's largest. According to TASS, the facility served Ukrainian military servers. De Novo calls itself a sovereign cloud and AI provider serving Ukraine's largest banks.
