Security · Top stories
Supabase databases expose sensitive user data due to misconfigurations, UpGuard research finds
Cybersecurity firm UpGuard discovered approximately 16,000 Supabase-hosted databases publicly exposing personal data, including names, addresses, phone numbers, and passwords. This exposure stems from common misconfigurations by developers, highlighting security risks associated with rapidly developed applications and the platform's handling of user security.
Radicle Discloses Critical Vulnerabilities in Network Protocol Affecting All Versions
Radicle has disclosed two critical security vulnerabilities in its network protocol, affecting all versions of its peer-to-peer code collaboration stack. These flaws allow for unencrypted data transmission and node impersonation, posing a risk of information leakage for private repositories.
Compromised GitHub Actions Re-enabled, Resuming Mini Shai-Hulud Malware Execution
Two GitHub Actions repositories, previously compromised in May 2026 by the Mini Shai-Hulud campaign, were re-enabled on September 16, 2026, without the malicious code being removed. This allowed workflows referencing these actions to resume downloading and executing the malware, posing a software supply chain risk.
New Research Reveals Faster Classical Method to Break RSA Cryptosystem
New research has uncovered a novel classical computing method that significantly reduces the security level of the RSA cryptosystem by enabling signature forgery without factoring. This method decreases the computational resources required to break RSA keys by orders of magnitude, making 1024-bit RSA breakage more feasible and reducing the security of 2048-bit and 4096-bit keys to unacceptable levels.
GitLab Email Address Vulnerability Allows Unauthorized Code Pushes and CI Job Execution
A vulnerability in GitLab's issue-by-email feature allows anyone with a user's private email address to push code and run CI/CD jobs as that user. This occurs because the email address acts as a credential, and GitLab does not verify the sender, enabling unauthorized actions on any project the user can access.
Placeholder domain "third-party.com" used in dev docs now hosts ClickFix attacks
The domain "third-party.com", commonly used as a placeholder in developer documentation, is now serving a fake Cloudflare verification page that attempts to trick Windows users into executing malicious PowerShell commands. This development is significant because it turns a widely accepted documentation practice into a security vulnerability, potentially exposing developers and users to malware through a trusted, yet compromised, resource.
Astrana Health Reports Data Breach After Social Engineering Attack
Astrana Health, a healthcare management company, disclosed a data breach where private and confidential information was exfiltrated from its servers following a social engineering attack on employees. The company is assessing the extent to which patient, employee, and business data may have been accessed.
F-35 Fighter Jet Components Reportedly Diverted to Hong Kong
F-35 stealth fighter components, including a cockpit canopy and weapons bay door, were reportedly diverted to Hong Kong while in transit from Australia to the U.S. The incident raises concerns about the security of sensitive military technology, given China's past efforts to acquire F-35 related data.
UK to establish new agency to counter disinformation and deepfakes from hostile states
The UK will create a National Centre for Information Defence to combat disinformation and deepfakes from hostile states like Russia, as announced by Andy Burnham. This initiative aims to detect, attribute, and disrupt information attacks, many of which are AI-enabled, by integrating intelligence agencies, law enforcement, and social media companies.
BigCommerce Merchants Alerted to Data Breach via Compromised Ribon App Credentials
BigCommerce has notified merchants of data breaches stemming from compromised credentials for third-party Ribon applications, which attackers used to inject malicious scripts into online stores. The breach exposed shopper information such as names, email addresses, phone numbers, and shipping addresses, affecting multiple BigCommerce customers.
LinkedIn wins dismissal of "BrowserGate" lawsuits over scanning user browser extensions
A US District Court judge dismissed two class-action lawsuits against LinkedIn regarding its practice of scanning users' browser extensions. The judge ruled that the plaintiffs lacked standing as they did not adequately allege that private information was conveyed to LinkedIn, indicating that a privacy violation is unlikely to be proven.
ZCode AI Coding Agent Silently Uploads User Git History to Alibaba Cloud
A developer reverse-engineered ZCode, an AI coding desktop application, and discovered it silently uploads users' entire workspace, including Git history and configurations, to Alibaba Cloud's object storage. The data is encrypted with a key only accessible by Z.ai's servers, meaning users cannot decrypt their own archived data. This raises significant privacy and security concerns for developers using the tool.
Browser Extension Vulnerability Affects AI Assistants in Chrome, Edge, and Other Browsers
Security researchers at Forever Security demonstrated that a common browser extension could hijack AI assistants in five Chromium-based products, including Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension. This vulnerability allows an attacker's extension to control the AI agent, and in some cases, access user files or activate the camera and microphone, by impersonating the AI vendor's trusted web page.
US Coast Guard and FBI Board Two Oil Tankers After Cyberattacks During Voyage
US Coast Guard and FBI personnel boarded two oil tankers bound for Texas last month following cyberattacks that disrupted the vessels during their journey. Investigators found evidence of a malicious cyber actor on one ship, the VL Prosperity, which reportedly experienced interference with engine, navigation, and communication systems. This incident highlights ongoing cyber threats to the maritime sector, prompting the Coast Guard to establish a dedicated Office of Maritime Cybersecurity Policy.
China-Aligned FamousSparrow Group Deploys New SparroWocky Backdoor in Latin America
The China-aligned threat actor FamousSparrow has been deploying a new C++ backdoor named SparroWocky in attacks targeting government agencies across Latin American countries since at least August 2025. This new modular backdoor, which replaces SparrowDoor as the group's primary implant, is capable of executing arbitrary files, acting as a TCP proxy, running commands, and collecting system information. Researchers theorize the campaign aims to monitor local government reactions to U.S. pressures in the region.
BIND 9 Updates Address 14 Vulnerabilities, Including Critical DoH Crash Flaw
The Internet Systems Consortium (ISC) released BIND 9.20.29 and 9.21.26 to fix fourteen security vulnerabilities in its open-source DNS server software. One critical flaw, CVE-2026-77692, allows an unauthenticated attacker to crash a BIND server configured for DNS-over-HTTPS (DoH) with a single crafted request. These updates are important for maintaining the stability and security of DNS infrastructure.
ConnectWise warns of new ScreenConnect vulnerability, provides temporary mitigations
ConnectWise issued a security advisory regarding a new vulnerability in its ScreenConnect Remote Access platform that affects file transfer behavior. While a permanent patch is expected later this week, the company has provided temporary mitigation steps for administrators to implement. This vulnerability is significant because ScreenConnect is widely used by IT professionals, and previous flaws in the platform have been actively exploited by threat actors, including ransomware gangs and state-backed groups.
Microsoft Reports AI-Enhanced Invoice Scam Emails Targeting Businesses
Microsoft security researchers identified a new wave of business email compromise (BEC) invoice scams using AI to create more convincing and tailored fraudulent emails. Attackers are combining executive impersonation, vendor branding, and fabricated email chains to increase legitimacy, with a campaign in early August targeting over a million users, primarily in the US.
WeChat Zero-Click Worm Demonstrated via Incoming Calls, Patched by Tencent
Security researchers at Calif developed and demonstrated a zero-click worm that could take over WeChat accounts on iPhone and Android via incoming calls from existing contacts. Tencent has since patched the exploit for all users, blocking the attack vector. This vulnerability was significant because it allowed account compromise without user interaction, affecting a platform with 1.439 billion monthly active users.
ShinyHunters claims breach of Florida DMV database, stole 200,000 driver records
The ShinyHunters hacking group claims to have breached Florida's Driver and Vehicle Information Database (DAVID) and stolen over 200,000 driver records. The group stated they exploited a password-reset flaw to gain access and are threatening to leak the data if the Florida Highway Safety and Motor Vehicles (FLHSMV) agency does not negotiate. This incident highlights vulnerabilities in government systems holding sensitive personal data.
Amazon appoints cybersecurity expert Kevin Mandia to its board of directors
Amazon has added Kevin Mandia, founder of Mandiant and a cybersecurity veteran, to its board of directors. This appointment comes as companies face increasing cybersecurity threats, particularly those related to artificial intelligence.
Deceptive Android Apps Exploit Google Play Early Access Program to Evade Reviews
Threat actors are misusing Google Play's Early Access program to distribute deceptive Android applications. These apps, which promise rewards or premium content, bypass public reviews and ratings, primarily serving ads to users to generate revenue. Bitdefender identified this activity, noting that some apps, like a Grand Theft Auto imitator, accumulated over a million downloads before removal.
U.S. Disrupts Xinbi Guarantee Scam Marketplace, Seizes $52.8 Million in Crypto
The U.S. Department of Justice (DoJ) and Treasury Department took coordinated actions against Xinbi Guarantee, an illicit online marketplace, seizing $52.8 million from 52 cryptocurrency wallets and sanctioning the platform. Xinbi Guarantee, created in 2022, facilitated cyber scams, money laundering, and human trafficking, processing at least $24 billion in transactions.
Ohio Man Sentenced to 15 Years for AI-Generated Porn Sextortion and Cyberstalking
An Ohio man received a 15-year prison sentence for cybercrimes including sextortion and cyberstalking, utilizing over 100 AI models to generate explicit content of victims. This case marks the first conviction under the Take It Down Act, a 2025 law prohibiting non-consensual online publication of explicit content and AI forgeries.
Reconstructed Stuxnet Source Code Released for Educational and Research Purposes
A reconstructed source code of the Stuxnet worm, derived from decompiled binaries, has been made available for educational and research use. This release provides a structured codebase for analyzing the cyber-weapon's logic and attack vectors, which is significant for cybersecurity professionals studying industrial control system threats.
Plex urges users to update desktop clients and media servers for security patches
Plex has released updates for its Media Server and Desktop client to address multiple security vulnerabilities and is urging users to update immediately. These patches are critical as Plex has emailed affected users, a rare action, indicating the severity of the flaws.
US Government Designates Privacy-Oriented Host Autistici/Inventati as "Global Terrorist"
The US government classified the Italian collective Autistici/Inventati as a "Specially Designated Global Terrorist" on August 26, 2026, citing its "far-left" politics and alleged provision of tools to extremist groups. This designation impacts a volunteer-run service that offers privacy-oriented communication tools to approximately 16,000 mailboxes, 1,500 websites, 5,500 mailing lists, and 10,000 blogs.
Mathspace discloses data breach affecting over 1 million students, staff, and parents
Online learning platform Mathspace reported a data breach impacting over 1 million individuals in Australia and New Zealand. Attackers exploited a vulnerability in the company's self-hosted Metabase internal reporting system to steal personal information.
Google open-sources Mantis, an AI-powered bug finding and fixing harness
Google has open-sourced Mantis, a framework designed to automate the discovery, triage, reproduction, and patching of software vulnerabilities using AI. Mantis aims to improve the effectiveness and scalability of vulnerability analysis by combining agentic techniques with sandboxed reproduction, offering a tool for developers to integrate AI into their security practices.
Google releases HEIR, an open-source compiler for private AI inference using homomorphic encryption
Google has released HEIR (Homomorphic Encryption Intermediate Representation), an open-source compiler designed to enable private AI inference using homomorphic encryption. This tool addresses the challenge of performing computations on encrypted data without exposing underlying information, making homomorphic encryption more practical for developers.
OpenAI Expands Daybreak Initiative with $1 Billion for Critical Infrastructure Cyber Defense
OpenAI announced Daybreak for Frontline Defenders, an expansion of its existing Daybreak initiative, committing $1 billion to help critical infrastructure sectors like power, water, and banking use frontier cyber AI for defense. This initiative provides subsidized access to AI models, training, and support to cyber defenders protecting essential services globally and within the United States.
12-Year-Old PostgreSQL Vulnerability Allows Database and Server Takeover
A cybersecurity firm discovered a critical vulnerability, CVE-2026-6471 (PostGREShell), in PostgreSQL versions released since 2014, enabling attackers with low privileges to achieve remote code execution and privilege escalation. This flaw, stemming from missing authorization in logical decoding, allows unauthorized file loading and execution, posing a significant risk to the tens of thousands of companies using PostgreSQL.
US Military Disables Ad Tracking on Devices to Protect Troops from Location-Based Threats
The U.S. Department of Defense has disabled advertising tracking on government-issued phones and computers across all military branches. This action was taken to prevent adversaries from using commercially obtained location data to target service members, following reports of such incidents in the Middle East.
Thomson Reuters C-Track Platform Breach Exposes US and Canadian Court Data
Thomson Reuters disclosed a data breach affecting its C-Track court case management platform, exposing sealed court information and sensitive personal data from courts in at least 12 U.S. states, the U.S. Virgin Islands, and Canada. The breach, discovered on June 30, involved unauthorized access to files from March through June, potentially compromising names, Social Security numbers, and medical information, though no misuse has been reported.
AIR Raises $50M to Secure AI Agent Software Supply Chain
AI security startup AIR emerged from stealth with $50 million in seed funding to develop a platform for vetting AI agent skills and add-ons. The platform discovers AI agents, continuously vets their components, and blocks interactions that fail security criteria, addressing risks associated with AI agents operating autonomously across enterprise systems.
Palo Alto Networks Acquires AI Agent Platform Console to Enhance Cortex Capabilities
Palo Alto Networks has acquired Console, an AI-native platform that enables organizations to build agentic workflows and automate operational tasks using natural language. This acquisition will integrate Console's technology into Palo Alto's Cortex platform, allowing security teams to automate investigation, prioritization, and action across enterprise environments.
Microsoft to Enable Memory Integrity Security Feature on More Windows 11 Devices
Microsoft will enable the memory integrity security feature on additional Windows 11 devices next month, a kernel-level protection designed to prevent malicious code. This change may impact PC gaming performance, particularly on older processors, as it restricts untrusted kernel-mode code and drivers.
US Military Uses High-Energy Laser to Down Three Suspected Cartel Drones
The U.S. military shot down three drones suspected of being operated by Mexican cartels using an Army Multipurpose High Energy Laser System. This event marks a continued deployment of directed-energy weapons for border security and counter-surveillance operations against illicit activities.
Dropbox users affected by security breach due to SSO authentication flaw
Dropbox notified users of unauthorized account access between August 4 and August 21, 2026, stemming from a vulnerability in its single sign-on (SSO) integration with Lenovo IDs. Attackers exploited a missing email verification step in Lenovo's process to create rogue Lenovo IDs, which Dropbox then implicitly linked to existing user accounts without further authentication. This incident highlights critical flaws in federated identity management and the need for robust verification during SSO setup.
Cloudflare introduces task-based OAuth consent with scope customization
Cloudflare has launched OAuth scope customization, allowing users to deselect optional scopes during authorization. This change moves from an all-or-nothing consent model to a more granular, task-based approach, enhancing user control over application permissions.