Security · Top stories
Tectonic Crypto Platform Suffers $6 Million Exploit, Cronos Blockchain Halted
The Tectonic decentralized lending platform experienced a security incident where fraudsters manipulated the price of its TONIC token, inflating it over 100 times to borrow assets. Approximately $6 million in Ethereum was stolen, leading the Cronos blockchain to halt activity and then restart, with an additional $68 million prevented from leaving the platform.
Hasbro discloses data breach affecting employee personal and financial information
Toy manufacturer Hasbro has disclosed a data breach impacting an undisclosed number of employees, with personal and financial information exposed. This incident follows a separate cyberattack in March that caused $25 million in revenue loss, though Hasbro has not linked the two events.
Trump Order Declares National Emergency to Block Foreign Backdoors in US Power Grid
President Trump issued Executive Order 14420, declaring a national emergency to address vulnerabilities in the US bulk power system from foreign-supplied electrical equipment. The order prohibits the acquisition, import, transfer, or installation of certain foreign-produced bulk-power equipment after August 26, 2026, if deemed to pose security risks. This aims to mitigate supply chain risks and potential embedded hardware backdoors in critical infrastructure.
Okta Exceeds Q2 Estimates, Reports Increased Demand for AI Identity Security
Okta surpassed Wall Street's fiscal second-quarter earnings and revenue estimates, driven by increased demand for identity security solutions related to AI agents. The company's shares rose 20% in extended trading, reflecting strong financial performance and strategic moves in the evolving AI security landscape.
GPUThor Rowhammer Attack Bypasses NVIDIA ECC on Ampere GPUs for Root Access
Researchers at the University of Toronto developed GPUThor, a new Rowhammer attack that bypasses NVIDIA's ECC protections on Ampere-class GPUs, enabling denial-of-service and root-level privilege escalation. This attack significantly increases bit-flip rates compared to previous methods, making exploitation practical within minutes.
MS Paint and Photos embed invisible GUID watermarks in AI-generated images
Microsoft's Paint and Photos applications invisibly watermark AI-generated images, even those created locally, with a GUID after sending prompts to a remote server for moderation. This occurs regardless of visible watermark settings and applies to images saved in C2PA-preserving formats like PNG, JPEG, GIF, and .paint. The practice raises questions about user privacy and the traceability of AI-generated content.
AnonyMousKIT PhaaS uses AI voice agents to phish iPhone passcodes and disable Activation Lock
A new phishing-as-a-service (PhaaS) platform named AnonyMousKIT automates the retrieval of iPhone passcodes and disables Apple's Activation Lock feature. This service facilitates a criminal ecosystem for selling stolen iPhones, harvesting Apple IDs, and accessing iCloud backups and Keychain credentials.
UK to use Ukraine battlefield data to train AI for critical infrastructure protection
The UK has partnered with Ukraine to use battlefield data from Ukraine's Avengers AI lab to train AI models for protecting UK defense sites, railways, and energy plants. This initiative aims to identify threats like protesters or hostile state attacks using AI-optimized sensors in fiber-optic cables, with private companies also gaining access to the data.
ReliaQuest employee targeted in social engineering attack by ShinyHunters
Cybersecurity firm ReliaQuest confirmed that an employee was targeted in a social engineering attack by the ShinyHunters group, which attempted to gain access to internal systems. Although one employee entered credentials on a fake SSO page, device-trust controls prevented the attackers from accessing applications or customer data. This incident highlights the ongoing threat of social engineering and the importance of multi-layered security controls.
Apple Releases Sixth RCs for macOS Sonoma 14.8.8 and Sequoia 15.7.8 with Security Updates
Apple has released the sixth set of Release Candidates for macOS Sonoma 14.8.8 and Sequoia 15.7.8, focusing on security improvements. These follow a series of RCs prompted by AI-related security risks.
Apollo Global Management Confirms Data Breach Affecting Personal Information
Private equity firm Apollo Global Management confirmed a data breach where hackers stole personal information from its cloud systems between July 6 and July 10. The incident involved a social engineering attack and is part of a wider hacking campaign targeting financial institutions.
Slovakia discovers Russian backdoors and vulnerabilities in 279 new traffic cameras
Slovakia's national security service, the NBU, found SMS-activated Russian backdoors and passwordless live feed access in 279 new NERO R-ONE speed cameras. These cameras, suspected to be rebranded Russian CORDON PRO.M units, were part of a €30 million EU-funded modernization project and have since been deactivated. The discovery highlights significant national security and privacy risks associated with critical infrastructure procurement.
ToxicPanda 2.0 Android Malware Expands Global Banking and Cryptocurrency Targeting
The Android banking malware ToxicPanda has been updated to version 2.0, significantly expanding its targeting scope to over 140 banking and cryptocurrency applications globally, up from 16. This new version includes 167 remote commands, improved credential harvesting, and new methods for privilege escalation and evading battery optimization policies, posing an increased threat to Android users.
New technique "skitter-creek-bath-salts" bypasses DRAM memory protections on AMD CPUs
A new technique called "skitter-creek-bath-salts" allows manipulation of DRAM controller registers to scramble platform memory, bypassing security features like the Platform Security Processor, System Management Mode, and CPU microcode. This method was developed and tested on AMD Family 16h CPUs, which are the last generation with publicly documented DRAM controller translation registers.
China Orders State Agencies to Uninstall Government-Specific Windows 10 Edition
China's Ministry of State Security has reportedly instructed some state-linked organizations to remove a customized Windows 10 version, accelerating its planned retirement due to data security concerns. This directive led to a surge in shares for Chinese OS vendors, indicating a push towards domestic software alternatives.
Google Threat Intelligence Group Identifies Three Russian Cyber Espionage Clusters Abusing Authentication Flows
Google Threat Intelligence Group (GTIG) has identified three distinct suspected Russian cyber espionage clusters, UNC6293, UNC7005, and UNC5976, that are abusing legitimate authentication flows to target individuals in academia, aerospace, defense, government, and think tanks across Europe and the United States. These groups employ persistent phishing and social engineering tactics to compromise accounts, often by tricking users into setting app passwords or abusing OAuth flows. This matters because these techniques exploit trusted authentication processes, making them harder for targets to recognize as malicious and posing a significant threat to sensitive information.
ClarityCheck facial recognition service exposed millions of face photos online
ClarityCheck, a facial identification service, exposed over nine million face photos on an unsecured cloud server for several months. This data breach allowed public access to images likely uploaded without consent, raising significant privacy and security concerns.
Ransom Busters Affiliate Claims Hacking Ransomware Servers, Demands Payment from Victims
A ransomware affiliate named Ransom Busters is emailing victims, claiming to have hacked ransomware group servers and offering to delete stolen data for $20,000 to $60,000. This activity is unusual as it involves a third party proactively contacting victims with an offer to recover data and delete backups held by ransomware groups. The practice raises legal concerns under the U.S. Computer Fraud Abuse Act.
Microsoft Copilot revealed undocumented parameter allowing data exfiltration without user consent
Security researchers discovered a vulnerability in Microsoft 365 Copilot Enterprise that allowed data exfiltration without explicit user consent by querying Copilot itself. The AI assistant disclosed an undocumented prompt parameter, "?autorun=1", which, when combined with the "?q=" parameter, enabled silent execution of malicious prompts upon a user clicking a link. Microsoft has since mitigated this vulnerability.
Apple Releases Security Updates for macOS, iOS, and iPadOS Addressing WebKit Vulnerabilities
Apple released security updates for macOS, iOS, and iPadOS to fix dozens of vulnerabilities, primarily in the WebKit browser engine. These patches are important for user security, as the flaws could lead to crashes, data disclosure, and arbitrary code execution.
Heights Finance Data Breach Exposes Financial and Personal Information of Nearly 750,000 Customers
Heights Finance, a debt consolidation loan company, experienced a data breach in May that exposed sensitive financial and personal information, including Social Security numbers, for approximately 734,828 customers. The breach occurred on a third-party cloud platform and did not affect the company's internal loan management systems. This incident highlights the ongoing risks associated with third-party cloud service providers and the potential for widespread data compromise in the financial sector.
New Android Malware WindRelay and SpyNote Steal Credit Card Data and Facilitate Loan Fraud
A new Android NFC relay malware, WindRelay, is being used with the SpyNote remote administration tool (RAT) to steal credit card data and take out loans in victims' names. This combination allows attackers to gain remote access to devices and relay live NFC transactions, enabling real-time financial fraud.
Seven Arrested in €30M Commerzbank Fraud Exploiting Service Provider Flaw
Seven individuals have been arrested in Brazil and Europe in connection with a €30 million bank fraud that impacted Commerzbank customers in November 2023. The fraud exploited a vulnerability in a service provider's system, leading to unauthorized withdrawals, though Commerzbank states customers suffered no financial losses.
RingCentral Data Breach Impacts 1.6 Million Accounts After Social Engineering Attack
RingCentral experienced a data breach in July, affecting 1.6 million individuals, following a "sophisticated social engineering campaign." The ShinyHunters extortion group claimed responsibility and leaked data after RingCentral did not meet their demands, leading to the information being added to HaveIBeenPwned.
Trezor Customers Affected by Data Breach at Shipping Partner ShipMonk
Hardware wallet manufacturer Trezor disclosed a data breach impacting nearly 14,000 customers after its shipping provider, ShipMonk, experienced unauthorized access to its systems. The incident exposed customer order data, including names, addresses, emails, and phone numbers, for orders placed between May 10 and August 8, 2026. Trezor's own systems were not compromised, but the breach raises concerns about potential phishing attempts targeting affected users.
Brazil Orders Discord to Suspend Livestreaming Feature After Teen's Death
Brazil's National Data Protection Authority (ANPD) has ordered Discord to suspend its "Go Live" livestreaming feature. This action follows an investigation into the death of a 13-year-old girl who was allegedly encouraged to take her own life during a Discord livestream. The suspension will remain until Discord implements adequate protective measures for minors, as the ANPD found the platform lacked real-time access to livestream content for automated violation detection.
Hundreds of Fake Chrome VPN Extensions Route User Traffic Through Proxies
Security researchers identified 737 Chrome VPN extensions that routed user browser traffic through a single SOCKS5 proxy infrastructure. These extensions, downloaded nearly 75,000 times and primarily targeting Russian-speaking users, impersonated legitimate VPN brands, allowing an adversary-in-the-middle to observe browsing activity and data.
Researchers demonstrate 'Plug And Pwn' attack for Windows SYSTEM access via USB auto-install
Security researchers Alejandro Hernando and Borja Martinez have unveiled "Plug And Pwn" attacks that exploit the Windows Plug and Play (PnP) feature to achieve SYSTEM-level code execution. This method abuses the automatic installation of vendor software for emulated USB devices, allowing an unprivileged user to gain high-level access on Windows 11 machines. The attack can be triggered physically or remotely under specific conditions.
Wisconsin Police Used Flock Cameras to Track Man for Marijuana Possession
Wisconsin police utilized Flock license plate readers to track Edward Abrams-Phillips' frequent travel between Wisconsin and Michigan, where marijuana is legal. This tracking was used as part of the probable cause to search his car for marijuana, leading to his arrest and conviction for possession, despite an initial bail jumping charge being dismissed. The case highlights concerns regarding law enforcement's use of surveillance technology to establish pretexts for searches.
New York Funds Water System Cybersecurity; Senate Bill Proposes $300M Annual Federal Aid
New York State has allocated over $9 million to 153 drinking water and wastewater systems to enhance cybersecurity defenses and comply with new state standards. Concurrently, Senate Democrats introduced the Water Cyber Shield Act, proposing $300 million annually for national water infrastructure cybersecurity improvements and expanded EPA authority, following recent cyberattacks on water systems.
Cloudflare Reports 519% Surge in 1 Tbps DDoS Attacks in Q2 2026
Cloudflare's H1 2026 DDoS Threat Report indicates a 519% quarter-over-quarter increase in network-layer DDoS attacks exceeding 1 Tbps between Q1 and Q2 2026. The report, based on data from Cloudflare's network, highlights a shift in attack vectors, with DNS-based attacks becoming the primary method, and notes the influence of geopolitical events on the threat landscape.
BdThemes WordPress Plugins Removed After Supply Chain Attack Creates Rogue Admins
A supply chain attack on BdThemes, a WordPress plugin vendor, led to the compromise of their infrastructure and the modification of a remote JSON feed. This allowed attackers to create rogue administrator accounts on WordPress sites using affected plugins, prompting WordPress.org to remove all BdThemes products, impacting over 350,000 active installations.
Security Researcher Receives 400,000 Sensitive Emails Due to Misconfigured 'Noreply' Domains
Security researcher Cory Solovewicz has received over 400,000 emails containing sensitive personal and company information since December 2024. This data leakage occurs because organizations are misconfiguring their internal systems to send information to his purchased domains, noreply.us and noreply.net, which they mistakenly believe are unmonitored placeholder addresses.
UK Man Sentenced for Blackmail and Sextortion of 117 Victims as Part of 'The Com'
Justin Swaddle, a 20-year-old from Leeds, was sentenced to two years in prison for blackmail and sextortion offenses against 117 victims aged 13 to 17. Operating under aliases like 'Epstein' and 'Moscow' on platforms including Snapchat, Telegram, and Discord, Swaddle was a member of 'The Com,' an online collective whose members coerce victims into self-harm and sexual activity for peer status.
Windscribe Releases deGDID Script to Block Microsoft's Global Device Identifier
Windscribe, a VPN provider, has developed an open-source PowerShell script called "deGDID" that removes existing Microsoft Global Device Identifiers (GDIDs) from Windows PCs and prevents new ones from being created. This tool addresses privacy concerns related to persistent device tracking, but using it may disrupt some Microsoft cloud services that rely on device authentication.
New CSS Attacks Bypass Webmail Defenses, Enabling Password and Token Theft
New research by PortSwigger's Gareth Heyes, presented at Black Hat USA 2026, demonstrates CSS-based attacks that allow email content to escape its message boundary and interact with webmail interfaces. These techniques can capture passwords, exfiltrate tokens, and hijack UI actions across major webmail providers like Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.
North Carolina Ports Hit by Cyberattack, Forcing Manual Operations
North Carolina Ports experienced a cyberattack that disrupted IT systems and forced a shift to manual operations across its three locations: Wilmington, Morehead City, and Charlotte. The incident, detected on August 4, led to system-wide outages and delays, though operations are gradually returning to normal with manual processing still in effect. This event highlights the ongoing vulnerability of critical infrastructure to cyber threats.
Zbtlink Routers Found with Factory-Shipped Backdoor, Codename ENDLESSDOORS
Cybersecurity researchers at VulnCheck discovered a factory-shipped backdoor, codenamed ENDLESSDOORS, in at least 20 Zbtlink router models. This implant, present in all 21 available firmware images over two years, establishes an unauthenticated root shell and beacons to Chinese command-and-control infrastructure, posing a significant security risk by allowing remote control and bypassing typical network defenses.
Civilian Medevac Plane Crash in New Mexico Linked to Military GPS Jamming
A twin-engine Beechcraft King Air medevac plane crashed in New Mexico, killing all four occupants, after encountering GPS jamming from a US military exercise at White Sands Missile Range. The incident, which occurred in May, marks the first fatal civilian plane crash in the US attributed to GPS jamming, raising concerns about the impact of military electronic warfare activities on civilian aviation.
77 Malicious "Evil Twin" Extensions Removed from Open VSX Marketplace
Manifold Security discovered 77 malicious "evil twin" extensions on the Open VSX marketplace between July 26 and August 1, 2026. These extensions mimicked legitimate developer tools and exfiltrated system and development environment information, leading to their removal from Open VSX on August 3, 2026.