Security · Top stories
Twenty-One Cybersecurity M&A Deals Announced in July 2026
Twenty-one cybersecurity merger and acquisition deals were announced in July 2026, including significant acquisitions by Bank of America, Barracuda Networks, Cribl, CrowdStrike, Cyera, Infoblox, Okta, and Palo Alto Networks. These acquisitions expand capabilities in areas such as identity management, AI detection engineering, exposure management, data security, network intelligence, and threat detection, reflecting ongoing consolidation and strategic growth within the cybersecurity sector.
Cloudflare's Certificate Transparency Monitoring is now generally available with filtered alerts
Cloudflare has made its Certificate Transparency Monitoring generally available, now featuring a filter that removes alerts for certificates Cloudflare itself issues. This change addresses a significant "noise problem" by only notifying users of unexpected certificates, making the service more effective for identifying mis-issued certificates.
Germany's Cabinet Approves Legislation Granting Spy Agencies Hacking and Sabotage Powers
Germany's cabinet approved legislation that would allow its intelligence agencies to hack foreign systems, sabotage supply chains, and disseminate false information to extremists within Germany. This overhaul of post-war spy laws is justified by a changing threat environment, including drone incidents and terrorist attacks.
CBP Officers Accused of Misusing Surveillance Technology for Personal Reasons
US Customs and Border Protection (CBP) officers reportedly misused electronic databases, including facial recognition and license plate readers, to spy on family members, seek dates, and provide intelligence to drug traffickers. This misuse highlights concerns about privacy violations given the Department of Homeland Security's extensive access to private citizen data.
Fortinet Patches High-Severity Authentication Flaws in FortiWeb and FortiManager
Fortinet released patches for eight vulnerabilities, including high-severity authentication bypass issues in FortiWeb and FortiManager. These flaws could allow unauthorized access or device impersonation, impacting network security for users of these products.
Uber Freight Investigates Data Breach Claimed by Helix Hacking Group
The Helix hacking group claims responsibility for a data breach at Uber Freight, Uber's logistics subsidiary, stating they exfiltrated mailboxes, cloud storage, and financial documents. Uber Freight reports no impact on business operations, but the incident highlights the ongoing threat from groups like Helix, which Google tracks as UNC6671 and notes has collected over $10 million in ransoms this year.
UK Criminal Records Office Breached for Two Years Due to Unpatched Systems and Unread Alerts
The UK's ACRO Criminal Records Office received a reprimand from the Information Commissioner’s Office (ICO) after three intrusions over nearly two years exposed personal data, including that of domestic violence victims. The breaches occurred due to unpatched systems and ignored security alerts, highlighting significant security failures within the organization.
DecryptAds Tool Unmasks Ad Brokers Tracking Location Data Across Websites and Apps
A new research tool called DecryptAds has been launched to expose advertising brokers that track user location data and operate across various websites and apps. This tool consolidates data from ads.txt, app-ads.txt, and sellers.json files, making it easier to investigate the ad tech industry's data sharing practices.
Signal Introduces Automatic Key Verification to Prevent Man-in-the-Middle Attacks
Signal has launched Automatic Key Verification, a new security feature that uses third-party auditors Cloudflare and Trail of Bits to verify the integrity of encrypted chats. This system ensures the consistency of public encryption keys, protecting against scenarios where a key might be swapped without the user's knowledge.
Intel and AMD Release Patches for Over 80 Vulnerabilities Across Their Products
Intel and AMD have released patches addressing more than 80 vulnerabilities across their product lines, including high-severity flaws that could lead to privilege escalation, denial-of-service, information disclosure, and arbitrary code execution. These updates are critical for maintaining the security and integrity of systems relying on their hardware and software.
Two undersea cables off Perth damaged, Australian Federal Police investigating suspicious activity
Two Subco undersea cables, Indigo-West and Indigo-Central, reported shunt faults off the coast of Perth, Australia, shortly after each other and in close proximity. The faults occurred in a Cable Protection Zone, coinciding with suspicious vessel activity, prompting an investigation by the Australian Federal Police into a potential crime.
Siemens, Schneider Electric, Phoenix Contact Patch ICS Vulnerabilities in August 2026
Industrial control system (ICS) product vendors Siemens, Schneider Electric, and Phoenix Contact released August 2026 Patch Tuesday advisories addressing multiple vulnerabilities. These patches are important for securing critical infrastructure and industrial operations against potential cyberattacks.
Chrome's anti-abuse systems blocked 7 billion unwanted Android notifications daily in Q1 2026
Google's Chrome browser for Android blocked over 7 billion unwanted notifications per day in Q1 2026 through new anti-abuse systems. These measures combat the use of notifications for scams, malware, and phishing, improving user security and device performance.
AI Agents Fully Automate CTF Challenges at BSidesSF 2026, Outperforming Human Teams
At BSidesSF 2026, an autonomous AI agent system won the Capture The Flag competition by solving all 52 challenges in minutes, a significant shift from previous years where AI was only used as an assistant. This development indicates a transformation in how cybersecurity skills are measured and developed, as AI now excels at bounded, well-defined problems like those found in CTF challenges.
NSA Appoints Kerianne Tobitsch as New General Counsel
The National Security Agency (NSA) has appointed Kerianne Tobitsch, formerly a senior lawyer at the Department of Homeland Security (DHS), as its new general counsel. This appointment fills a key legal role that had been vacant for approximately a year and is critical for overseeing clandestine operations and advising on legal matters like FISA Section 702.
Kimwolf v7 Android Botnet Uses HTTP/2 DDoS with Browser Fingerprints, Enhances C2 Resilience
Cybersecurity researchers have identified Kimwolf v7, a new version of the Android and IoT botnet, which now employs HTTP/2 DDoS attacks that mimic legitimate browser traffic and uses Ethereum Name Service (ENS) for more resilient command-and-control (C2) infrastructure. This development makes the botnet's attacks harder to detect and its C2 more difficult to disrupt, posing an increased threat to Android TV boxes and Linux IoT devices.
Flock Camera Glitch Leads to Woman Being Pulled Over at Gunpoint Twice
A woman in Wisconsin was stopped at gunpoint twice by police after a Flock license plate camera system incorrectly flagged her car as being connected to a homicide investigation. Milwaukee police confirmed the alert should have been removed from the system days earlier, but an employee failed to clear it. This incident highlights the critical need for accurate and timely data management in automated law enforcement systems to prevent wrongful stops.
Wesco confirms cybersecurity incident after ExfilSquad claims data theft from cloud CRM
Wesco, a global supply chain and distribution company, confirmed it is investigating a cybersecurity incident involving its cloud CRM environment after the ExfilSquad data extortion group claimed to have stolen 2.6 million records and published them. Wesco states it found no evidence of ransomware or malicious software and believes sensitive customer or employee data is not at risk, despite the group's claims of PII exfiltration.
FBI Investigates North Korean IT Worker Hired by U.S. Federal Agency
The FBI is investigating how a North Korean national was hired to work for an unnamed U.S. federal government agency, a rare confirmed instance of a sanctioned individual gaining such employment. This incident highlights the ongoing risk of North Korean IT workers fraudulently obtaining remote positions to funnel funds to the regime and potentially steal intellectual property.
Leonardo's SignalTrace links mobile device signals to license plate readers for tracking
Leonardo's SignalTrace system integrates with automatic license plate readers to associate mobile device signals with vehicles and their movements. This technology allows investigators to track patterns of movement and associations before identifying individuals, potentially shifting police investigative methods.
Cyberattacks Disrupt Government Services in California, Oklahoma, and South Dakota
Local governments in Suisun City, California, Coweta, Oklahoma, and Mitchell, South Dakota, experienced cyberattacks that disrupted public services, including 911 systems and city operations. These incidents highlight the ongoing vulnerability of municipal infrastructure to cyber threats and the immediate impact on citizen services.
Malicious SIM Cards Can Execute Code on Cellular IoT Devices and Some Phones
Researchers discovered that malicious SIM cards can force some cellular IoT modules and phones to run arbitrary commands, potentially leading to full device takeover. This vulnerability affects devices like EV chargers and industrial routers, primarily impacting machine-to-machine hardware with accessible SIM trays. Qualcomm and Quectel are addressing the issue, but no public advisories have been released.
Corma Secures $60 Million Seed Funding for Defensive Cybersecurity AI Model
Corma has raised $60 million in seed funding to develop a foundation model specifically for defensive cybersecurity operations. This funding will support the creation of AI-powered agents designed to integrate into existing security infrastructures and continuously adapt to detect and neutralize threats.
IBM and Red Hat Expand Lightwell with Commercial Offerings for AI-Era Software Supply Chain Security
IBM and Red Hat have expanded Lightwell, introducing new commercial offerings to establish verifiable software supply chains for AI-assisted development. These offerings simplify software signing, provenance, artifact verification, and policy enforcement, addressing the need to trust both human- and AI-generated software throughout its lifecycle.
Researchers Create Fake Startup to Identify Suspected North Korean IT Workers
Security researchers established a fictitious cryptocurrency startup, advertised developer positions, and hired three individuals believed to be North Korean operatives. This operation aimed to study the methods used by North Korean IT workers to gain employment and access to company systems, highlighting the risks posed to businesses.
Chrome Extension Banned for AI Chat Theft Returns with Affiliate Scheme
A Chrome extension previously removed for stealing AI chat conversations has reappeared on the Chrome Web Store and is now engaging in an affiliate monetization scheme. The extension, "AI Sidebar with DeepSeek, ChatGPT, Claude and more," triggers affiliate links on updates and uninstalls, generating commissions for its operators.
Japanese Authorities Arrest Initial Torrent Seeder Using New Identification Method
Japanese authorities arrested Masakazu Ono, an initial seeder on the Nyaa torrent website, after an investigation by anti-piracy group CODA and the Japan Hacker Association. CODA claims it identified Ono without monitoring BitTorrent swarm traffic, suggesting a new method for tracking torrent uploaders. This development indicates a potential shift in anti-piracy enforcement tactics, making it harder for initial content distributors to remain anonymous.
ChromeOS Rolls Out Critical Security Updates in LTS Versions 144 and 150
Google has released updates for ChromeOS, with LTS-144 (144.0.7559.257) addressing multiple severe vulnerabilities and LTS-150 (150.0.7871.150) extending support continuity. These updates are crucial for reinforcing system security and stability across ChromeOS devices.
Pioneer Rekordbox PRO DJ LINK Vulnerability Exposes User Data
AlphaTheta identified a security vulnerability in the PRO DJ LINK function of Rekordbox and certain CDJ/XDJ models, allowing unauthorized third parties on the network to view data on connected Windows PCs, Macs, or USB/SD cards. This vulnerability impacts users who utilize the PRO DJ LINK feature, potentially exposing sensitive information.
Brex develops CrabTrap for securing AI agents by monitoring network activity
Brex CEO Pedro Franceschi announced CrabTrap, a new network-level security layer designed to secure AI agents like OpenClaw in production environments. This development addresses the challenge of safely deploying AI agents that can self-bootstrap and maintain their own codebases, which traditional security models struggled to control.
Cybersecurity Stocks Rise After Black Hat Conference Highlights AI Threat Landscape
Cybersecurity stocks, including CrowdStrike and Palo Alto Networks, saw significant gains following the Black Hat conference, where the increasing threat posed by AI agents was a central theme. Analysts noted that AI has fundamentally changed the threat landscape, driving demand for new AI security tools and creating a modernization cycle in the endpoint security space.
Klaviyo inadvertently shared customer sign-up passwords with advertisers due to misconfiguration
Marketing platform Klaviyo inadvertently exposed new customer sign-up information, including passwords, to third-party advertisers due to a web form misconfiguration. This issue, active from at least February 2024 to November 2025, highlights risks associated with third-party website trackers and misconfigured pixels.
Cloudflare for Government Achieves FedRAMP Class D (High) Certification
Cloudflare for Government has achieved FedRAMP Class D (High) certification, allowing it to handle the U.S. government's most sensitive unclassified data. This certification enables Cloudflare to provide its security and performance services to federal agencies managing critical national security and infrastructure information.
New Zealand Sanctions Russian Hackers and Propaganda Groups Over Ukraine War Involvement
New Zealand imposed sanctions on 33 Russian individuals and entities, including hackers and propaganda groups, for their roles in supporting Russia's war against Ukraine. These sanctions target those involved in cyberattacks, disinformation campaigns, and alleged abductions of Ukrainian children. The action aligns New Zealand with other Western governments that have previously sanctioned some of these individuals for malicious cyber activities.
LexisNexis takes Diligence, Metabase API, and Newsdesk services offline due to suspicious activity
LexisNexis disconnected its Diligence, Metabase API, and Newsdesk services after detecting unusual activity on servers managed by a third-party vendor. The company is investigating the incident with a cybersecurity forensic firm and rebuilding systems in a new environment before restoring services. This incident impacts users of LexisNexis's risk research, data feed, and media monitoring platforms.
UK Royal Navy Drones Sent Data to China via Camera Component
The UK Royal Navy's K3 Scout surveillance drones contained camera components that secretly transmitted data to China, as reported by The Telegraph. The Ministry of Defence (MoD) has since removed internet connectivity from these cameras, stating that the transmitted data was limited to "heartbeat communications" and no sensitive MoD data was compromised. This incident highlights ongoing concerns about Chinese technology in critical infrastructure and potential supply chain vulnerabilities.
Malicious VS Code Extension "Solidity Pro" Steals Crypto Wallets and Credentials
Cybersecurity researchers identified a malicious Visual Studio Code extension, Solidity Pro, that exfiltrates cryptocurrency wallets, API keys, and other credentials. The extension used obfuscation and delayed activation to bypass security checks and steal sensitive user data.
UK Manufacturers Face Rising Cyber-Attack Risk; 30% Hit Last Year
A survey by MakeUK reveals that nearly a third of British manufacturers experienced a cyber-incident in the past year, leading to production losses and increased costs. This highlights a growing risk as factories become more connected and hackers more sophisticated, with only half of affected companies having a response plan.
UnYOLO Introduces Credential Broker and Policy Engine for GitHub and Other Services
UnYOLO is a new framework designed to act as a credential broker and policy engine for services like GitHub, Hugging Face, and Google Workspace. It enhances security by preventing agents from directly holding sensitive credentials and enforces fine-grained access policies through a local JSON rules file.
New Adversarial Pattern Blocks Surveillance Camera Detection
Bill Swearingen developed a computer-generated pattern, named noRecognition, that prevents common license plate readers and surveillance cameras from detecting objects or people it covers. This technology allows individuals to avoid automatic detection by algorithmic surveillance systems, offering a method to opt-out of tracking.