Security · Top stories
Adult Film Producer Identifies Meta Reality Labs Executive in Torrent Piracy Lawsuit
Adult film producer Strike 3 Holdings identified a Meta Reality Labs executive as the anonymous defendant in a "John Doe" BitTorrent piracy lawsuit. This development links a routine piracy case to Strike 3's larger lawsuit against Meta, which alleges the company downloaded films to train AI models.
Microsoft Cloud Patches Released, Dropbox Accounts Compromised, Texas Water Utilities Get Cyber Defense
Microsoft released server-side patches for nine vulnerabilities across its cloud services, requiring no customer action. Separately, approximately 5,000 Dropbox accounts were compromised due to an issue with Lenovo's email verification process. The White House and Texas Governor launched Project Watershed 250 to provide cybersecurity resources to Texas water utilities.
US and UK to Coordinate Efforts to Dismantle Scam Centers
The United States and United Kingdom signed a memorandum of understanding to coordinate investigations and information sharing to shut down scam centers, primarily located in Southeast Asia, that are responsible for billions in fraud. This collaboration aims to target organized crime syndicates running these centers, which often use human trafficking victims to conduct investment and romance scams.
UK account-hack losses rise 417% due to new reporting system, not necessarily more attacks
Reported financial losses from hacked online accounts in the UK increased by 417% to £6.3 million in the last financial year, with the number of victims rising 929%. This surge is primarily attributed to the introduction of the new "Report Fraud" system, which replaced the less effective "Action Fraud" system, leading to more incidents being reported rather than a direct increase in attacks.
Russian Data Centers Face New Security Requirements Amid Drone Threats
Russian data centers are increasing physical security spending due to new government requirements aimed at protecting critical infrastructure from Ukrainian drone attacks. A recent decree allows the government to take control of facilities that fail to adequately protect against such threats, impacting data centers, especially those serving government, banking, and major service providers.
Job interview scam drains £18,000 from victim's crypto accounts via malicious software
Jobseekers are being targeted by scammers on job listing websites who trick them into downloading malicious software disguised as interview tools, leading to financial loss. One victim lost £18,000 from cryptocurrency accounts after downloading a document from a fake recruiter on LinkedIn, highlighting a growing trend of sophisticated recruitment scams.
French Hospital Fined €500,000 for Data Breach Exposing 727,000 Records
France's data protection authority (CNIL) fined Hôpital privé de la Loire €500,000 after a data breach exposed sensitive information of 727,000 patients and third parties. The fine was issued due to the hospital's failure to comply with GDPR obligations, including inadequate access controls and lack of real-time monitoring.
Zscaler Stock Rises on Q4 Earnings Beat and Upbeat Guidance
Zscaler's stock increased after the company reported fiscal fourth-quarter earnings and revenue that exceeded analyst estimates. The company's performance was driven by demand for cybersecurity tools, particularly its Zero Trust architecture, amid rising AI-related security risks.
US Senator Requests NSA Guidance on VPN Best Practices for Public Use
Senator Ron Wyden has asked the National Security Agency (NSA) to provide updated public guidance on VPN configurations, specifically addressing limitations and nuances of VPN technology. This request aims to offer clear advice to the public, including government personnel, journalists, and human rights defenders, on how to protect communications from foreign surveillance.
Utah Delays Enforcement of VPN Age-Verification Law Pending Legal Challenge
Utah will not enforce its new law targeting VPN usage in conjunction with age verification for adult content, pending a federal court ruling on a legal challenge. This delay means the state's attempt to hold websites liable for users' VPN usage to circumvent age verification is on hold, impacting privacy and digital rights discussions.
China-linked hackers used USBs to backdoor executive laptops at agricultural conference
A Chinese state-linked hacking group, OVERCAST PANDA, compromised executive laptops at an agricultural conference by physically accessing hotel rooms and installing malware via USB drives. This method bypassed typical network and phishing defenses, highlighting a vulnerability in physical security protocols that many organizations have fixes for but do not implement.
BraZetsu Malware Creates Marketplace for Compromised Windows Hosts
A new Python-based Windows malware framework, BraZetsu, has been identified, which transforms compromised systems into inventory for an underground marketplace. This framework allows threat actors to sell initial access to infected hosts, primarily targeting Iberian and Latin American entities across various sectors.
RMM Phishing Campaign Targets 46 Countries, with US as Primary Target
A phishing campaign using fake documents to trick victims into installing legitimate remote monitoring and management (RMM) software has expanded to 46 countries, with 45% of observed activity targeting the United States. The campaign uses rapidly rotating infrastructure and varied lures to evade detection, impacting sectors like education, technology, and government.
WhatsApp for Android loophole allows photo access without device unlock
A loophole in WhatsApp for Android allows private photos to be viewed on a device without it being unlocked, by answering a WhatsApp call and accessing video effects. This vulnerability affects Pixel and Oppo devices, but not Galaxy devices or iPhones, and has been reported to WhatsApp and Google.
Anthropic Claude accounts compromised by infostealer malware replaying session cookies
Anthropic notified users that infostealer malware compromised their Claude accounts by replaying stolen session cookies, bypassing two-factor authentication and SSO. This incident highlights a vulnerability where session cookies, once stolen, grant access to accounts without needing login credentials, posing a risk to data accessible through these sessions.
UK Amends Cyber Security Bill to Block High-Risk Tech Suppliers in Critical Infrastructure
The UK government has introduced amendments to its Cyber Security and Resilience Bill (CSRB) to grant ministers powers to prevent critical infrastructure organizations from using technology suppliers deemed high-risk. This move follows a recent cyberattack on a UK energy facility, highlighting supply chain vulnerabilities in critical sectors.
VantaCore, a new pro-Ukraine hacker group, targets Russian companies with custom ransomware
A new pro-Ukrainian hacker group named VantaCore is targeting Russian organizations with custom ransomware, demanding multi-million dollar payments. This group, believed to be a rebrand of the Thor ransomware operation, uses proprietary tools for encryption, distribution, and system control, indicating an evolution in their tactics.
GrapheneOS reports Pixel 11 lacks hardware memory tagging (MTE) support
The GrapheneOS project announced that the Pixel 11 series does not support ARM hardware memory tagging (MTE), preventing a full port of their operating system. This omission means the Pixel 11 lacks a security feature present in hardware, firmware, and software, which GrapheneOS attributes to cost-cutting measures by Google.
Hackers Expose Donor Data from Russian Fundraisers for Ukrainians and Political Prisoners
Two Russian fundraising projects, Davayte and You Are Not Alone, reported that hackers accessed their payment accounts in mid-August, exposing donor email addresses and partial payment card information. The breach occurred through an integration between Stripe and WooCommerce used for online auctions, affecting projects supporting Ukrainian civilians and Russian political prisoners.
StreamRat Android Trojan Distributed via Meta Ads Gains Near-Complete Device Control
A new Android banking trojan named StreamRat is being distributed through fake TV streaming ads on Meta, primarily targeting Spanish-speaking users. This sophisticated malware can gain extensive control over infected devices, including keystroke logging and remote control, after users grant a series of permissions.
Microsoft Defender for Office 365 flags legitimate Google search links as malicious
Microsoft is investigating an issue where Defender for Office 365's Safe Links feature incorrectly flags legitimate Google search links as malicious, preventing users from accessing them. This issue impacts users attempting to open blocked hyperlinks and causes alerts for IT administrators, stemming from an inaccurate security classification.
Researchers Use Claude to Port RCE Exploit Between WAGO PLC Models
Forescout Research's Vedere Labs used Anthropic's Claude to port a pre-authentication remote code execution (RCE) exploit for a WAGO programmable logic controller (PLC) to a different model, executing ARM shellcode on live hardware. This demonstrates AI's capability in adapting complex exploits, though the process required significant human guidance and incurred costs, with researchers noting it might have been faster and cheaper without AI.
Consumer Group Creates Fake 10 Downing Street Listing on Booking.com, Citing Security Flaws
Consumer group Which? successfully created a fake listing for 10 Downing Street on Booking.com, including a bogus booking and review. Booking.com did not remove the listing for two months, prompting Which? to criticize the platform's fraud detection systems as "unfit for purpose."
Palo Alto CEO States $1 Trillion in Cybersecurity Infrastructure Unprepared for AI Threats
Palo Alto Networks CEO Nikesh Arora stated that approximately $1 trillion of existing cybersecurity infrastructure is not equipped to handle AI-driven threats, necessitating a complete overhaul. This shift is creating new business opportunities for cybersecurity firms as companies modernize their defenses against automated attacks.
Samsung accounts deactivated for security reasons, locking out some Galaxy users
Many Samsung Galaxy users report their Samsung accounts have been deactivated for "security reasons," preventing access to services like SmartThings and Samsung Wallet. Samsung has not provided a public explanation, though some users suspect alias email addresses may be a contributing factor.
X users targeted with password reset attempts following X Money launch
X users are receiving unsolicited password reset emails, which the company attributes to attackers attempting to gain unauthorized access after the launch of X Money. X is investigating the issue but has not found evidence of successful breaches, advising users to enable two-factor authentication.
US Coast Guard Establishes Office of Maritime Cybersecurity Policy
The US Coast Guard has created the Office of Maritime Cybersecurity Policy (CG-MCP) to centralize policy development and implementation for cyber safety and security within the Marine Transportation System. This new office addresses increased cyber risks to ports, vessels, and critical infrastructure due to the maritime industry's growing reliance on information and operational technology.
Novocure data breach exposes information of over 1,400 cancer patients and employees
Healthtech company Novocure reported a data breach in mid-August that exposed ID numbers for over 1,400 U.S. cancer patients and identifying information for fewer than 50 other patients. The incident also compromised contact details for an undisclosed number of employees, highlighting ongoing cybersecurity challenges in the healthcare sector.
Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Cybersecurity researchers identified 13 malicious Composer theme packages on Packagist that inject JavaScript into websites, deploying spyware on unpatched iOS devices to steal cryptocurrency wallet seeds and other sensitive data. This campaign leverages WebKit vulnerabilities and a kernel escape flaw to gain read and write privileges on affected iPhones.
House Intelligence Committee Warns of 'Black Swan' AI Risks for Terrorist Attacks
The House Permanent Select Committee on Intelligence issued a report urging U.S. spy agencies to prepare for "Black Swan" AI risks, specifically warning that AI could enable terrorists or adversaries to develop more dangerous weapons and plan deadlier attacks. The report emphasizes that frontier large language models could simplify the creation of destructive attacks by rogue actors, necessitating accelerated adoption of AI capabilities by the U.S. intelligence community.
North Korean Job Fraud Extends Beyond IT to Healthcare and Sales Sectors
North Korean threat actors, previously known for infiltrating IT roles, are now seeking and obtaining jobs in healthcare and sales sectors to generate income for Pyongyang's weapons programs. This expansion indicates a broader scope for their fraudulent employment schemes, posing new challenges for companies in diverse industries.
McKesson reports 'service degradation' and data exfiltration after cyberattack
Pharmaceutical and healthcare technology company McKesson is investigating a cyberattack on a third-party application that caused service degradation and data exfiltration from its oncology and surgical business units. The ShinyHunters cybercriminal group has claimed responsibility for the attack, which could impact customer data and service availability for a major healthcare provider.
Cybercrime Researchers Tracked Sextortion Scammer to Nigeria
Cybercrime experts Erin West and Paul Raffile successfully tracked a sextortion scammer to his location in Nigeria by posing as a target. This operation provided direct insight into the methods and living conditions of some scammers, highlighting the prevalence and impact of sextortion targeting youth.
Ruby on Rails Vulnerability CVE-2026-66066 Actively Exploited, Affecting 7,000 Instances
Hackers are actively exploiting a critical Ruby on Rails vulnerability, CVE-2026-66066 (KindaRails2Shell), which allows remote code execution and arbitrary file reads. This flaw impacts Rails applications using libvips for Active Storage image processing and permitting untrusted image uploads, with approximately 7,000 instances identified as vulnerable.
Nigerian Men Extradited to US on Sextortion Charges Linked to Teen Deaths
Two Nigerian men, Adebola Festus Adekunle and Mudasiru Afeez Olawale, were extradited to the U.S. and charged with involvement in sextortion schemes that led to the deaths of two minors. This action is part of an international law enforcement effort, "Operation Artemis," targeting sextortion rings preying on U.S. minors.
Microsoft resolves Windows Defender crashing bug after recent security update
Microsoft has fixed a bug causing Windows Defender to crash with 0xc0000005 access violation errors following a recent security update. This resolution is important as the crashes prevented the security software from functioning, leaving systems vulnerable.
Omarchy Linux Distribution Vulnerability Allowed User Processes to Escalate to Root
A security vulnerability in Omarchy's default Docker configuration allowed any user process to escalate to root privileges without authentication. The issue stemmed from the default user being a member of the Linux docker group, which grants root-level access through the Docker daemon. This vulnerability meant that a compromise of a normal user application could lead to full machine compromise, necessitating an immediate update to Omarchy version 4.0.1.
European Commission's ProtectEU Strategy Revives Push for Encryption Backdoors
The European Commission has introduced ProtectEU, a new internal security strategy that includes a renewed effort to mandate encryption backdoors for law enforcement access to encrypted data. This initiative is presented as a response to growing online threats but raises concerns among tech companies and privacy advocates about the security implications of such backdoors.
QubesOS Vulnerability Allows Dom0 Arbitrary Code Execution via qvm-copy-to-vm Error Reporting
Qubes Security Bulletin 118 details a vulnerability in QubesOS where using `qvm-copy-to-vm` to copy a file from dom0 to a malicious qube allows the qube to inject an arbitrary command into dom0. This vulnerability enables an attacker to take control of Qubes OS if a user initiates a file copy to a compromised qube.
DHS uses obscure customs law to obtain journalist's data without judicial oversight
The Department of Homeland Security (DHS) used an obscure customs law (19 USC 1509) to obtain YouTube account information for a journalist, Georgia Fort, after a judge rejected warrant requests. This method bypasses judicial review, requiring only a DHS official's sign-off, and has raised concerns about government overreach in obtaining private data.