Security · Top stories
Pistachio Research Challenges Conventional Phishing Simulation Metrics
Pistachio's research, based on 2.47 million simulated phishing attempts, indicates that click rate alone is an insufficient metric for assessing phishing risk. The study highlights the importance of also tracking credential leakage and reporting rates, as well as tailoring simulations to employee roles and past responses.
Cloudflare CASB Introduces Automatic Remediation Policies for SaaS Security
Cloudflare CASB now includes automatic remediation policies, allowing security teams to configure event-driven logic to revoke risky file shares and dispatch webhooks without manual intervention. This update shifts the tool from a passive alarm system to an active remediation platform, addressing the challenge of rapidly fixing misconfigurations in SaaS applications.
Login Keychain Copying Fails on Secure Enclave Macs with macOS Tahoe
Manually copying login keychain files between Macs no longer works on Secure Enclave-equipped Macs running macOS Tahoe. This change is due to keychain decryption keys being tied to the Secure Enclave of the originating Mac, preventing access on a different device.
NATO Foils Russian Training Exercise Simulating Undersea Cable Sabotage Near Norway
NATO allies reportedly foiled a Russian training exercise simulating the deployment of a "secret weapon" to disable undersea cables near Norway's Svalbard archipelago. This event highlights the increasing geopolitical significance of critical undersea infrastructure.
New Android Malware Mantax Otax Combines Ransomware and Spyware Capabilities
A new Android malware, Mantax Otax, encrypts files, steals data, and harasses victims, combining ransomware and spyware functions. This malware targets older Android versions (9 and below) and is distributed via malicious APKs outside Google Play, posing a threat to users who install apps from unofficial sources.
WebGPU vulnerability can freeze macOS devices via untrusted websites
A vulnerability dubbed "Deathray" allows untrusted websites to freeze macOS devices by exploiting WebGPU shaders, rendering the desktop UI unusable until a forced restart. This issue affects Chrome, Firefox, and Safari on macOS, but not other operating systems, and highlights a potential denial-of-service vector for Mac users.
Treasury Urges Banks to Report Cyber Scams After $13 Billion in Losses Since 2023
The U.S. Treasury Department's FinCEN released an alert and study detailing nearly $13 billion in cyber scam losses between September 2023 and December 2025, urging financial institutions to increase vigilance and reporting. The report highlights the increasing rate of transnational cyber fraud, including cryptocurrency investment scams, affecting all age groups.
33 Cybersecurity M&A Deals Announced in August 2026, Including Key Acquisitions by Brinqa, Cribl, and Fortinet
Thirty-three cybersecurity merger and acquisition deals were announced in August 2026. Notable acquisitions include Brinqa acquiring PlexTrac, Cribl acquiring Radiant Security's assets, Datavault AI acquiring CyberCatch for $94.5 million, Deel acquiring Clarity, Echo acquiring Minimus's assets, and Fortinet acquiring Virtue AI. These acquisitions integrate new capabilities like offensive security validation, AI-native SOC features, continuous compliance, deepfake detection, hardened container images, and AI security enhancements into existing platforms.
Forgejo <=16.0.3 Critical RCE Vulnerability Identified
A critical remote code execution (RCE) vulnerability has been discovered in Forgejo versions 16.0.3 and earlier. This vulnerability allows attackers to execute arbitrary code, posing a significant security risk to affected installations.
Wildberries Reports DDoS Attack Delayed Seller Payments, Ukrainian Intelligence Claims Responsibility
Russian e-commerce giant Wildberries stated a DDoS attack caused delays in payments to some sellers, with billions of rubles reportedly outstanding. Ukraine's military intelligence claimed responsibility for a cyberattack earlier in August that disrupted Wildberries' operations.
UK National Cyber Force Appoints Third Commander
The UK's National Cyber Force (NCF) has appointed its third commander since its establishment in 2020. This appointment continues the NCF's mission to consolidate offensive cyber capabilities and counter state threats, support military operations, and disrupt criminals.
Gigabud Banking Trojan Uses Android Work Profiles to Evade Malware Detection
The Gigabud banking trojan now installs a second Android app to create a work profile on infected phones, then places a tampered banking app inside it. This method allows the trojan to bypass banking app malware checks, as the work profile separates its contents from the personal space where the trojan resides.
Nearly 10% of Internet-Facing LiteLLM Gateways Exposed to Default Admin Key
Wiz Research found that nearly one in ten internet-facing LiteLLM gateways scanned in February accepted the default example admin key "sk-1234" from the setup guide. This vulnerability allows unauthorized access to stored API keys, prompts, replies, and potentially cloud IAM credentials, posing a significant security risk for organizations using the AI gateway.
CISA Acting Director Warns of Significant Cybersecurity Vulnerabilities and Need for Rapid Change
The acting director of the Cybersecurity and Infrastructure Security Agency (CISA) warned about severe cybersecurity vulnerabilities, citing past government errors, outdated technology, and AI as major threats. CISA plans to hire approximately 600 new staff to address these challenges and improve national cybersecurity defenses.
RSA-260 Factored Using GPU Lattice Siever, Setting New Record
Researchers successfully factored RSA-260, a 260-digit number, using a new GPU lattice siever that reduces factoring costs by 10x. This achievement sets a new public record for RSA Factoring Challenge problems and demonstrates the capabilities of AI in complex computational number theory tasks.
Skullcandy Dime 3 Earbuds Vulnerable to Bluetooth Hijacking Due to Unpatchable Firmware
The CERT Coordination Center (CERT/CC) reported that Skullcandy Dime 3 wireless earbuds with firmware version 1.0.0.28 are susceptible to a high-severity Bluetooth hijacking vulnerability (CVE-2025-20701). This flaw allows nearby unpaired devices to connect without user interaction, and affected users cannot update their earbuds to a patched firmware version.
Anti-Flock Surveillance Movement Labeled as Chinese Propaganda in TV Reports
Local TV news stations aired reports claiming the anti-Flock surveillance movement is a "far-left network" funded by China and billionaires. This narrative contradicts the movement's decentralized nature and mirrors previous attempts by Flock CEO Garrett Langley to discredit critics of their ALPR camera systems.
Android September 2026 Updates Patch 180 Vulnerabilities, Including Critical RCE Flaws
Google released its September 2026 Android security updates, addressing 180 vulnerabilities after two months without security bulletins. The updates include patches for critical remote code execution flaws in the System component, which could be exploited without user interaction or additional privileges.
AMD, Arm, and Nvidia Release Security Advisories for Product Vulnerabilities
AMD, Arm, and Nvidia have issued security advisories addressing vulnerabilities in their products, including GPU drivers and inference servers. These patches prevent potential system crashes, denial-of-service conditions, and information disclosure, which are critical for maintaining system stability and data integrity for users of these chipmakers' hardware.
FBI Releases First Public Cybersecurity Strategy to Combat Cybercrime and Nation-State Hacking
The FBI published its first public cybersecurity strategy, outlining how the agency will counter malicious hackers and digital criminal gangs. This strategy aims to prioritize efforts against increasing cybercrime complexity and sophistication, building on previous classified approaches and recent operational successes.
Bipartisan US Lawmakers Request Sanctions Against Hack-for-Hire Firms
A bipartisan group of US lawmakers has asked the Commerce Department to sanction three Indian hack-for-hire firms: BellTroX, CyberRoot, and Sunkissed Organic Farms. The lawmakers accuse these firms of targeting Americans with cyberattacks and espionage to manipulate litigation and suppress reporting on their activities.
Cymphony Secures $30 Million in Funding to Address AI Agent Security Risks
Cymphony, a New York- and Tel Aviv-based startup, raised $30 million in funding, including a $25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, to develop security solutions for AI agents in enterprise environments. The funding values the company at over $100 million and will be used to expand its platform, which provides a unified view of human and AI agent access to sensitive data and systems. This development matters because the increasing use of AI agents in enterprises creates new security vulnerabilities, as these agents often access corporate data without the same controls as human employees.
Schneider Electric, Siemens, and Aveva Patch Critical Flaws in ICS Products
Schneider Electric, Siemens, and Aveva released September 2026 Patch Tuesday advisories addressing multiple vulnerabilities, including critical flaws, in their Industrial Control Systems (ICS) products. These patches are important for maintaining the security and operational integrity of critical infrastructure and industrial environments.
Critical Flaw in Alby Hub Bitcoin Wallets Could Allow Remote Takeover
Alby has disclosed a critical vulnerability in Alby Hub versions v1.7.0 through v1.18.5 that could allow an attacker to take over internet-exposed Lightning wallets. Users are advised to restrict external access to the management interface and update to version v1.24.0 immediately to mitigate the risk.
DoppelCart Fraud Network Uses 119,000 Fake Shops to Steal Credit Card Data
A network named "DoppelCart" operates over 119,000 fake e-commerce sites to steal payment card details from shoppers. The sites impersonate legitimate brands and offer large discounts to lure victims, transmitting collected data in real time to command-and-control servers.
CIA Official Credits Cyber Mission Center for Maduro's Capture
A CIA official stated that the agency's Cyber Mission Center provided critical intelligence for the capture of Venezuelan President Nicolás Maduro. This marks a rare public acknowledgment of the CIA's cyber operations and the center's role in a major military operation.
French Authorities Arrest Suspected ZeroBytes Hacker in Tax Authority Cyberattack
French prosecutors confirmed the arrest of an 18-year-old suspected member of the ZeroBytes hacking group in connection with cyberattacks targeting the country's tax authority and other organizations. This arrest addresses a recent data breach affecting the Directorate General of Public Finances (DGFiP) and highlights ongoing efforts to counter cybercrime groups operating in France.
FreeIPA Flaw Chain Allows Anonymous Clients to Create Administrator Credentials
A critical flaw chain in FreeIPA, tracked as CVE-2026-76578, allows unauthenticated clients to create Kerberos identities and gain administrator privileges. This vulnerability stems from a combination of a FreeIPA access control rule and a separate flaw in the 389 Directory Server, which FreeIPA uses for identity management.
Belgian-Chinese Researcher Arrested for Alleged GaN Semiconductor Trade Secret Theft
A Belgian-Chinese researcher was arrested in Brussels on suspicion of industrial espionage, accused of transferring gallium nitride (GaN) semiconductor intellectual property from his former employer, BelGaN, to a Chinese chip firm, GanKool. This incident highlights increasing global competition and intellectual property disputes within the semiconductor industry.
Instagram users targeted by scammers demanding ransoms over fake copyright claims
Instagram creators are losing money and accounts due to scammers filing bogus copyright claims and then demanding ransoms to withdraw them. Meta's appeal process is reportedly slow, leading some users to pay extorters to restore their accounts quickly.
Suspected Sabotage Devices Found Near German Power Plant
German police discovered multiple suspected launch devices near a high-voltage power line close to the Weisweiler power plant in North Rhine-Westphalia. This discovery follows reports of a suspicious person and is being investigated for connections to previous sabotage attempts on Germany's electricity infrastructure.
PEEP Toolkit Turns Chrome/Edge into Backdoors for Host Command Execution
Cybersecurity researchers have detailed PEEP, a Chromium-based post-exploitation toolkit disguised as a browser extension that enables host-level command execution and data exfiltration. PEEP requires prior administrative access for installation and expands on the open-source RedExt framework, allowing attackers to control compromised machines and steal sensitive information.
Rogue ScreenConnect Clients Distribute Four-Stage VBScript Chain to New Hosts
Cybersecurity researchers have identified worm-like activity using ConnectWise ScreenConnect to deploy a malicious four-stage VBScript payload on newly connected systems. This activity was observed in three separate incidents, each using different initial access methods to install rogue ScreenConnect instances that then execute the VBScripts.
CodePen 2.0 transmits user input to servers in real-time, raising security concerns
CodePen 2.0 sends all user input from its editor to its servers almost immediately, even before the user explicitly saves the code. This behavior means any sensitive information typed into the editor could be compromised, regardless of whether it was saved or published.
Signing TLS Handshakes Inside a TPM for Enhanced Machine Identity Security
A new method uses a Trusted Platform Module (TPM) to sign TLS handshakes, preventing private keys from being exposed in memory or on disk. This approach secures machine identities against attackers who gain read access within a guest system, as the key never leaves the TPM.
Former Old School RuneScape Developer Sentenced for $400,000 Virtual Gold Theft
A former Jagex employee, Andrew Lakeman, was sentenced to a three-year prison term, suspended for two years, for stealing over $400,000 worth of virtual gold from Old School RuneScape players and selling it on the black market. Jagex discovered the internal theft by modifying its firewall to track the illicit activity, leading to Lakeman's arrest and conviction.
Study Alleges Widespread GDPR Non-Compliance by UK Online Gambling Sites
A study by Swansea University's GREAT Centre found that 86% of licensed British gambling websites appear to violate GDPR rules regarding cookie banners and data collection. This research indicates that online bookmakers and casinos are lagging behind other industries in adhering to data privacy regulations, despite ongoing efforts by the Information Commissioner's Office to enforce compliance.
Figma uses AI agents to automate security investigations and vulnerability detection
Figma's engineering team developed AI agents to assist its security operations, automating alert investigations and vulnerability detection. This system reduced resolution times for complex alerts by 70% and identified over 100 previously unknown vulnerabilities, including critical flaws.
Google Introduces Beyond Zero Security Model for AI Agents, Successor to BeyondCorp
Google published Beyond Zero, a new security model extending Zero Trust to autonomous AI agents, moving access decisions from application to individual resources and actions. This model combines static authorization with dynamic AI-driven decisions to enable machine-speed enforcement for humans and AI agents. It addresses the limitations of BeyondCorp, which assumed human accessors and human-speed actions, by adapting to the scale and speed of AI in enterprise security.
US Offers $10 Million Reward for Information on Iranian Cyberattack Leader
The U.S. State Department has offered a $10 million reward for information leading to the location of Amir Yaryab, a senior Iranian official accused of leading the Islamic Revolutionary Guard Corps’ (IRGC) Cyber-Electronic Command (CEC). Yaryab allegedly directs multiple Iranian hacking groups that have targeted critical infrastructure sectors in the U.S., Europe, and the Middle East, impacting defense, energy, and telecommunications systems.