Security · Top stories
Open-source 'Phantom Drive' USB hides AES-256 encrypted partition behind 8GB decoy
Rootkit Labs developed the open-source 'Phantom Drive,' a USB device that presents as an 8GB drive but conceals an AES-256 encrypted partition, accessible only by creating a specific text file. This device is designed for situations where users might be compelled to reveal storage device contents, offering a stealthy way to protect sensitive data.
Google revamps its hacking group naming system for clarity and consistency
Google has updated its system for naming hacking groups, moving away from numerical APT designations to a new two-word format that includes a country-of-origin indicator. This change aims to improve clarity and consistency for security researchers tracking the increasing number of threat actors.
Polish security researchers find thousands of public entities vulnerable to cyberattacks
Two Polish security researchers identified over 10,000 public entities with 250,000 websites containing security flaws, including critical infrastructure like airports, hospitals, and government offices. This discovery highlights significant cybersecurity weaknesses in Poland's public sector, particularly concerning given recent suspected Russian cyberattacks targeting the country.
National Rural Water Association Partners with DEF CON Franklin to Launch Water Watch Center
The National Rural Water Association (NRWA) has partnered with DEF CON Franklin to create the Water Watch Center (WWC), a program providing threat intelligence and cybersecurity services to small water utilities. This initiative addresses recent cyberattacks on water systems in multiple states and aims to support the 91% of U.S. community water systems that serve fewer than 10,000 people.
Senate Confirms Adam Cassady as US Cyber Ambassador
The US Senate confirmed Adam Cassady as the next U.S. ambassador for cyber and digital policy, filling a position that has been vacant since the previous administration. This appointment is significant as Cassady will lead the Bureau of Cyberspace and Digital Policy, which recently underwent a reorganization and staff reduction.
Military Device Manufacturer IEH Corporation Discloses Cyber Incident to SEC
IEH Corporation, a manufacturer of specialized military components, disclosed a cyber incident to the SEC after an employee fell victim to a phishing attack. Intruders gained access to an email inbox containing sensitive information, including export-controlled technical data, though there is no evidence data was exfiltrated. This incident highlights ongoing cybersecurity risks for defense contractors and the potential exposure of critical military supply chain information.
Linux SCTP Flaw Allows Local Root Privilege Escalation and Container Escape
A use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) networking code, present since 2008, allows local users to gain root privileges and escape containers. Tencent researchers demonstrated the exploit, and fixes have been released in recent stable kernel versions.
NatJack Attack Class Hijacks TCP Sessions and Spoofs DNS by Manipulating NAT Tables
Security researcher Malcolm Stagg disclosed NatJack, a new attack class that manipulates Network Address Translation (NAT) connection states to hijack TCP sessions, spoof DNS, and exhaust NAT tables. This research, presented at Black Hat USA 2026, impacts independently developed NAT implementations, including Windows and Linux, and requires an attacker to have privileged access behind the same NAT as the victim.
PortSwigger's AI-assisted HTTP Terminator discovers new desync techniques and Apache zero-day
PortSwigger's AI-assisted research system, HTTP Terminator, identified new HTTP desynchronization techniques and a zero-day vulnerability in Apache Traffic Server. This research highlights the potential for AI to uncover novel attack vectors and improve the reliability of existing exploits like Response Queue Poisoning (RQP).
Bendix EC80 Truck Brake Controller Recall Covertly Fixed Remote Code Execution Vulnerabilities
A 2024 safety recall for Bendix's EC80 heavy-truck brake controller, which publicly addressed memory corruption issues, also quietly fixed several serious vulnerabilities, including a wirelessly reachable remote code execution flaw. This discovery, detailed at Black Hat USA 2026, highlights hidden security risks in critical vehicle components that could lead to denial-of-service and loss of essential vehicle functions.
Cybersecurity Vendors Announce New Products and Research at Black Hat USA 2026
Multiple cybersecurity vendors, including Acalvio, Artiphishell, Astelia, AvePoint, ArmorCode, and 1Password's Off-By-1 Labs, announced new products, services, and research at Black Hat USA 2026. These announcements focus on AI agent protection, vulnerability remediation, exposure management, data classification, and the effectiveness of AI-generated security patches.
Explosive Drone Found Near Ukrainian Cargo Aircraft at German Airport
German police disarmed an explosive-laden drone found near Ukrainian cargo aircraft at Leipzig airport, leading to a counterterrorism investigation. The incident also involved a mid-air collision with a possible second drone, forcing the airport to close and diverting flights.
Google Reports Vishing Attacks Targeting Financial Firms for Data Extortion
Google security researchers identified multiple hacking groups using vishing (voice phishing) to compromise U.S. financial and investment firms, aiming to steal sensitive data for extortion. These groups, potentially part of a larger collective, trick employees into providing credentials and multi-factor codes over the phone, highlighting the continued effectiveness of social engineering tactics.
LightSpy Spyware Expands Global Reach, Targets 13 Countries Including US
The China-linked LightSpy spyware, previously identified in 2018, has expanded its targeting to include victims in 13 countries, including the US and European nations. This modular spyware platform now features new capabilities for data exfiltration and remote device wiping, and has been observed infecting routers, including some in NATO member countries.
New Zapscape KVM Flaw Allows L1 Guest Code to Escape to Linux Hosts
A new Linux kernel vulnerability, tracked as CVE-2026-64561 and named Zapscape, allows an attacker with kernel privileges in an L1 guest VM to escape KVM isolation and execute code on the host. This flaw affects KVM/x86's shadow memory management unit and has a merged upstream fix, requiring administrators to update their kernels.
Weekly Security Roundup: China-linked telecom risks, ClickOnce phishing, and npm supply chain attack
This week's security report highlights several active threats, including a U.S. Congressional committee report on China-linked telecom infrastructure risks, a new ClickOnce phishing chain used by SideWinder, and an npm supply chain attack involving 846 malicious packages. These incidents demonstrate ongoing vulnerabilities in telecommunications, software delivery, and supply chain security, posing risks to various organizations and users.
75% of European Businesses Fear US Tech 'Kill Switch', Proton Survey Reveals
A Proton survey of 1,500 European business decision-makers found that 75% fear a "kill switch" scenario where access to US tech services is revoked, with over half estimating they could operate for only one day or less without these services. This concern highlights growing anxieties about digital sovereignty and geopolitical risks associated with reliance on a few major US tech providers. The survey indicates a potential shift in strategy for businesses globally, including those in the US, to mitigate such risks.
Weak CryptoJS RNG Led to $5.7 Million in Crypto Wallet Drains Across Five Apps
Coinspect identified that the CryptoJS.lib.WordArray.random() function, introduced 12 years ago, contained a weak random number generator that allowed for the theft of approximately $5.7 million from five crypto wallet applications. This vulnerability reduced the entropy of recovery phrases, making them guessable and compromising user funds.
Attackers use SQL injection to compile and run 'khunt' toolkit within Oracle databases for SYSTEM access
Attackers exploited a SQL injection vulnerability in a public-facing web application to gain access to an Oracle database, then compiled and ran a post-exploitation toolkit named 'khunt' directly within the database engine. This technique allowed them to achieve SYSTEM-level code execution on the underlying Windows server without writing executables to disk, bypassing typical endpoint detection and response systems.
House Committee Report: Chinese Telcos Maintain US Presence Despite Security Concerns
A bipartisan House Select Committee on China investigation found that China Mobile, China Unicom, and China Telecom retain significant presence in the U.S. internet ecosystem, despite previous FCC license revocations due to cybersecurity risks. The committee concluded these companies are not independent from the Chinese government and urged Congress to strengthen the FCC's authority to remove their technology from U.S. infrastructure. This matters because it highlights ongoing national security concerns regarding foreign influence in critical telecommunications networks.
Researchers Exploit Samsung Bixby and Software Vulnerabilities to Hack Galaxy Phones
Security researchers demonstrated an exploit chain leveraging vulnerabilities in Samsung Members, Samsung Account, and Bixby to achieve remote system-level compromise on Samsung Galaxy S25 devices. This exploit chain, which earned $50,000 at Pwn2Own, highlights potential security weaknesses in preloaded Samsung applications and the Bixby virtual assistant.
De Bijenkorf warns customer data may be exposed after cyber incident at logistics partner
Dutch retailer De Bijenkorf reported a cyber incident affecting one of its logistics providers, potentially exposing customer data and causing delays in orders, returns, and refunds. The incident highlights the ongoing risk to retailers from attacks targeting third-party contractors.
Veeam, Terraform MCP, and Django Patch Critical Vulnerabilities, Including CVSS 10.0 Flaw
HashiCorp, Veeam, and the Django Software Foundation have released patches for 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django, including a critical cross-tenant flaw in HashiCorp's MCP server rated 10.0 CVSS. These updates are crucial for operators to secure their systems against potential exploitation, as several flaws could lead to credential compromise or remote code execution.
Kali365 Phishing Kit Exploits Microsoft Authentication to Target US Organizations
A new phishing kit named Kali365 is actively targeting US organizations by weaponizing legitimate Microsoft authentication processes. It tricks victims into approving attacker-controlled device codes on Microsoft's own login page, granting attackers continued access to Microsoft 365 resources like email and documents. This method bypasses typical phishing indicators, increasing the risk of financial fraud, data exposure, and operational disruption for affected businesses.
Leaked n8n API Tokens Exposed 321 Instances to Credential Theft
GitGuardian researchers discovered 321 n8n instances that accepted API tokens exposed in public GitHub commits, allowing unauthorized access to sensitive data and downstream credentials. This exposure affects a significant portion of reachable instances and demonstrates how attackers can bypass security measures without exploiting software vulnerabilities.
QuickFox VPN Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
Cybersecurity researchers have uncovered a supply chain attack targeting QuickFox, a VPN service, that has been ongoing since at least August 2025. The attack involved a modified Windows installer delivering the FDMTP backdoor, attributed to the Chinese state-sponsored threat actor Mustang Panda. This incident highlights the ongoing risk of supply chain compromises, particularly for software used by specific user demographics.
Bugtraq Mailing List Relaunched for Full Vulnerability Disclosure
The Bugtraq mailing list, originally created in 1993 by Scott Chasin for open vulnerability disclosure, has been relaunched after years of inactivity. The new owner acquired securityfocus.com and the Bugtraq name to restore its original mission of researcher-first, corporate-filter-free vulnerability sharing, aiming to preserve cybersecurity history.
TP-Link Patches 15 Omada ZTP Vulnerabilities Allowing Network Breaches
TP-Link has released patches for 15 vulnerabilities found in the zero-touch provisioning (ZTP) mechanism of its Omada network devices. These flaws, when chained with previously disclosed command-injection vulnerabilities, could enable remote code execution and allow attackers to infiltrate networks. The vulnerabilities affect TP-Link's business networking product line, Omada, which is used by small to medium-sized businesses and enterprises.
Interpol Report: AI Powers Over Half of African Cybercrime, Financial Losses Surge to $484M
Interpol's African Cyberthreat Assessment Report 2026 indicates that 55% of reported cybercrime in Africa now involves AI, leading to faster and more convincing attacks. Financial losses from cybercrime in Africa increased from $192 million in 2024 to $484 million in 2025, primarily due to AI-powered fraud and social engineering. This surge in AI-driven cybercrime poses a significant threat to Africa's expanding digital economy.
EFF warns Android app developers about inadvertent location data sharing with advertisers
The Electronic Frontier Foundation (EFF) found that many Android apps inadvertently share users' precise location data with third-party advertisers and data brokers due to default settings in software development kits (SDKs). This occurs because SDKs inherit app permissions, and developers may not realize they need to disable this data collection. The EFF urges developers to disable unnecessary data collection to protect user privacy and prevent data from being sold to various entities.
New XCSSET v40 malware targets macOS developers via compromised Xcode projects
A new version of the XCSSET malware, v40, is infecting macOS users by injecting downloader scripts into Xcode projects within vulnerable GitHub repositories. This updated variant includes enhanced evasion techniques and new modules for Chrome hijacking and Telegram trojanizing, allowing for credential theft, data exfiltration, and cryptocurrency manipulation.
cMCP Runtime Launches for Secure AI Agent Tool Call Enforcement in TEEs
The cMCP (Confidential MCP Runtime) has launched in developer preview, providing a secure gateway for AI agents to enforce tool-call policies within a hardware Trusted Execution Environment (TEE). This system intercepts and evaluates every tool call against a Cedar policy, blocking or redacting denied actions and generating a tamper-evident TRACE Claim as proof. It addresses security vulnerabilities in software-only policy enforcement by ensuring policy integrity and decision-making within a protected environment.
AWS renews PCI DSS and PCI 3DS compliance, expands scope to new services and region
AWS has renewed its Payment Card Industry Data Security Standard (PCI DSS) and Three Domain Secure (PCI 3DS) certifications, adding three new services and the Asia Pacific (New Zealand) region to its compliance scope. This update allows customers to use these additional AWS services and the new region for handling payment card data while maintaining compliance, reducing their compliance overhead.
Żabka convenience store chain hacked via third-party account, internal systems exposed
Polish convenience store chain Żabka experienced a cyberattack that exposed internal company systems after attackers compromised a third-party contractor's account. The breach did not affect payment systems, transaction data, the Żappka loyalty app, or day-to-day store operations, according to the company and Polish authorities. This incident highlights the supply chain risk posed by third-party vendor access to internal systems.
Oligo Security Raises $60 Million in Funding Round, Totaling $140 Million
Oligo Security, a runtime security company, announced it raised $60 million in a new funding round, bringing its total funding to $140 million. This funding will be used to accelerate product innovation and expand global operations for its platform, which provides runtime visibility and real-time protection for application code, cloud workloads, and AI systems.
Varonis Introduces Agent IBAC for AI Agent Security in Atlas Platform
Varonis has launched Agent Intent-Based Access Control (IBAC) within its Atlas platform, designed to prevent AI agents from performing unauthorized or out-of-policy actions when accessing enterprise data. This new capability addresses the security risks associated with AI agents needing broad data access by enforcing permissions at runtime and responding to deviations in real time.
SEC Purchased Global Airline Ticketing Data, Including International Flights
The SEC acquired access to over a billion airline ticketing records, encompassing domestic and international flights, from the Airlines Reporting Corporation (ARC). This data included passenger names, credit card numbers, and travel itineraries, raising concerns about privacy and government access to personal information without warrants.
Attackers Could Use Email AI Assistants for Account Hijacking and Privilege Escalation
Barracuda Networks researchers demonstrated a proof-of-concept attack where compromised email AI assistants can be weaponized to escalate privileges and hijack accounts. This method allows attackers to operate undetected within an email system, bypassing traditional security measures by leveraging the AI's capabilities for stealth, reconnaissance, and crafting convincing phishing emails.
Django Releases Security Updates 6.0.8 and 5.2.17 to Address Multiple Vulnerabilities
The Django team released versions 6.0.8 and 5.2.17 to patch three security vulnerabilities, including a high-severity server-side file-write and request forgery flaw. Users are advised to upgrade to mitigate potential risks such as remote code execution and denial-of-service attacks.
Chinese Research Vessel Spotted Over US-Taiwan Undersea Cable
A Chinese-flagged research vessel was observed by the Taiwan Coast Guard hovering over the Pacific Light Cable Network (PLCN), an 8,000-mile fiber-optic system connecting Taiwan, the U.S., and the Philippines. This incident raises concerns about intelligence gathering and potential sabotage of critical undersea infrastructure, especially given past incidents involving Chinese vessels and the geopolitical tensions between China and Taiwan.