Security · Top stories
cPanel Patches Critical Flaw Allowing Hosting Customers to Execute SQL as Database Root
cPanel has released a security update to address CVE-2026-58048, a critical vulnerability that allowed authenticated hosting customers to execute SQL commands with root privileges within the database context. This flaw could lead to a server compromise depending on the system configuration and affects all supported versions of cPanel & WHM, along with WP Squared.
Madera Community Hospital Data Breach Impacts Over 150,000 Individuals
Madera Community Hospital is notifying 150,810 individuals that their personal, financial, and medical information was compromised in a data breach that occurred in May 2025. This incident highlights ongoing cybersecurity risks for healthcare providers, impacting patient data security and privacy.
Microsoft Paid Over $20 Million in Bug Bounties to 562 Researchers in Past Year
Microsoft announced it paid over $20 million through its bug bounty programs to 562 researchers from July 2025 to June 2026, marking an increase from previous years. This indicates a growing engagement in vulnerability research, but also highlights ongoing issues with researcher dissatisfaction regarding Microsoft's handling of reports.
Norwegian Government IT Infrastructure Hit by DDoS Attack Affecting Public Services
A Distributed Denial of Service (DDoS) attack targeted ID-porten, a key component of Norway's digital public services, causing disruptions and login issues for users. The incident, which began on August 3, 2026, affected multiple Digdir solutions and required intervention from their operations partner, Vivicta.
NuGet.org to Limit API Key Lifetimes to 30 Days Starting August 2026
NuGet.org will restrict new API keys to a 30-day maximum duration starting August 17, 2026, and all existing keys will expire by November 1, 2026. This change aims to reduce the risk of supply chain attacks by limiting the window of opportunity for attackers if credentials are compromised.
CrowdStrike Report Warns AI is Both a Cyber Weapon and a Target for Attackers
CrowdStrike's 2026 Threat Hunting Report states that AI models and tools are being weaponized by cybercriminals, making AI both a target and a weapon in cyberattacks. This development forces businesses to re-evaluate defensive strategies as AI-driven attack signals outpace manual handling capabilities.
AI assists in bypassing BIOS RSA-2048 signature checks and unlocking hidden settings on HP laptop
An AI enthusiast used Claude Code to successfully unlock a BIOS-locked HP 15-dw1036ne laptop, bypassing RSA-2048 signature checks and revealing 55 hidden settings. This demonstrates AI's capability in reverse-engineering firmware security, potentially impacting how individuals approach locked devices and highlighting new applications for AI in security research.
Critical CVE for SQLite found to be a hallucinated vulnerability, likely AI-generated
JFrog security researchers debunked a critical SQLite vulnerability (CVE-2026-51302) that was flagged by NVD and CISA, determining it to be non-existent and likely AI-generated. The alleged vulnerability cited non-existent code and failed proof-of-concept tests, highlighting issues with automated vulnerability reporting and assessment systems.
ICE Collected Nearly 1 Million DNA Samples in 2025, Including from Children
Immigration and Customs Enforcement (ICE) collected approximately 920,000 DNA profiles in 2025, including from young children, funneling these into the FBI's criminal DNA database. This expansion of DNA collection from individuals held for civil immigration violations raises concerns about privacy and the use of genetic data for criminal investigations, as most individuals in ICE custody lack criminal convictions.
Chinese Threat Actor Uses Leaked DarkSword Exploit Kit to Deploy GHOSTBLADE on iOS
A Chinese threat actor is using a publicly leaked version of the DarkSword exploit kit to target Apple iOS devices, deploying the GHOSTBLADE information-stealing malware. The campaign involves over 100 web properties, many impersonating AWS sign-in pages, to deliver the exploit chain. This development indicates the broader proliferation of the DarkSword kit following its source code leak, enabling more threat actors to conduct iOS attacks.
HashiCorp Releases Public Beta of Vault Kubernetes Key Management for Encryption at Rest
HashiCorp has released the public beta of Vault Kubernetes key management, enabling Kubernetes clusters to use Vault Enterprise as their Key Management Service (KMS) provider for encryption at rest. This allows the Kubernetes API server to offload envelope encryption to Vault, protecting Kubernetes Secrets and other API resources stored in etcd by moving the encryption keys outside the cluster.
Over 68% of Domains Lack DMARC Enforcement, Leaving Them Vulnerable to Email Spoofing
A recent analysis of 67,336 domains by CipherCue revealed that 68.4% either do not have a DMARC record or have one set to a policy that does not enforce email authentication, such as "p=none". This widespread lack of DMARC enforcement, despite the standard being public since 2012, leaves many organizations susceptible to email spoofing and phishing attacks.
Thermo Fisher Patches DNA File Tampering Flaw in Human Identification Software
Thermo Fisher Scientific has released patches for a high-severity vulnerability (CVE-2026-17583) in its Applied Biosystems human identification software that could allow nearly undetectable alteration of DNA data files. The flaw, rated 8.2 CVSS v4.0, affects five supported product lines and could enable malicious actors to combine or modify DNA profiles without detection, impacting forensic and diagnostic integrity.
UK Government Investments Reports Data Breach Exposing Management Information and Official Details
UK Government Investments (UKGI) experienced a data breach where "high-level management information" and personal details of 51 government officials were publicly accessible for nearly two days. The incident was attributed to a staff member not following security policies, prompting UKGI to enhance its internal security controls and incident preparedness.
Former Apple Engineer Sues, Alleging Firing After Refusing to Share Customer Device IDs with AT&T
A former Apple Enterprise Systems Engineer, Toby Boardman, has filed a lawsuit alleging he was fired after refusing to fulfill requests from AT&T for customer device identifiers (IMEIs) without customer consent, a practice he claims violated Apple's internal privacy policies. This lawsuit brings to light potential privacy concerns regarding how Apple handles customer data when interacting with wireless carriers and the consequences for employees who raise such issues.
IETF Freezes TLS 1.2 Features and Deprecates Obsolete Key Exchange Methods
The Internet Engineering Task Force (IETF) has issued RFC 9851, placing TLS 1.2 into a feature freeze, allowing only urgent security fixes and specific protocol identifiers. Concurrently, RFC 10015 deprecates Diffie-Hellman (DH) over a finite field and RSA key exchanges in TLS 1.2 and DTLS 1.2, and discourages static Elliptic Curve Diffie-Hellman (ECDH) cipher suites. These actions aim to improve security and encourage the adoption of TLS 1.3.
California's DROP Platform for Data Deletion Requests Becomes Enforceable August 1
California's Delete Request Opt-out Platform (DROP) becomes enforceable on August 1, allowing residents to submit a single request to registered data brokers to stop selling their personal information. This initiative provides a centralized method for consumers to exercise their data privacy rights, addressing concerns about personal data collection and its potential misuse.
EU Age Verification Project Mandates Hardware-Bound Attestation, Raising Open-Source Concerns
The European Union's open-source age-verification project requires hardware-bound attestation, a decision confirmed by a project maintainer. This mandate raises concerns for users of Linux, custom Android ROMs, and independently compiled applications, as it ties credentials to specific hardware environments, potentially limiting compatibility and fostering reliance on approved devices.
Google Chrome to Block New Tab and Search Engine Hijacking by Policy-Installed Extensions
Google is implementing a new security feature in Chrome that will block policy-installed extensions from hijacking the New Tab page or changing the default search engine on unmanaged consumer devices. This change addresses malware abuse that uses enterprise policy features to force-install malicious extensions, improving user control and browser security.
Trump Blames Minnesota Governor for Water System Cyberattacks, Despite Suspected Iranian Involvement
Donald Trump attributed recent cyberattacks on Minnesota's water systems to Governor Tim Walz, contradicting the consensus among federal agencies that Iran is likely responsible. This statement follows FBI warnings about spreading cyberattacks on American infrastructure, with CISA previously linking similar incidents to Iran.
Canada Signs UN Cybercrime Convention, Reversing Previous Opposition
Canada has signed the United Nations Convention against Cybercrime, a treaty it previously opposed due to concerns it could expand state surveillance powers. The convention, initiated by Russia, is described as a cross-border surveillance and electronic evidence-sharing agreement, despite Canada's stated focus on child protection and human rights safeguards.
Defcon 32 Badges Feature Open-Source Baochip-1x for Verifiable Hardware Security
Defcon 32 badges incorporate a new open-source microcontroller, the Baochip-1x, designed by Andrew "bunnie" Huang, which aims to improve security transparency. The chip's core module is removable and functions as a hardware security token, extending its utility beyond the conference.
AWS Releases HIPAA Security Rule Technical Safeguards Implementation and Readiness Guidance
AWS has released new guidance to help healthcare entities configure and implement HIPAA Security Rule Technical Safeguards when using AWS services. This guidance covers current regulations and proposed 2025 NPRM changes, including mandatory encryption and multi-factor authentication, providing a practical reference for compliance.
Chinese-Speaking Hackers Target Central Asian Governments with New OctLurk and SilkLurk Backdoors
A Chinese-speaking threat actor has been targeting government organizations in Central Asia since January 2025, deploying new backdoors named OctLurk and SilkLurk. These attacks compromise various sectors, including healthcare and government ministries, to steal credentials and perform remote actions, highlighting an ongoing cyber espionage campaign.
U.S. Cyber Command to open Silicon Valley office to foster tech sector relationships
U.S. Cyber Command plans to establish an outpost in Silicon Valley, named Cyber Command-West (CC-W), to build relationships with the tech sector and accelerate the development of cyber capabilities. This initiative is part of the "CYBERCOM 2.0" modernization effort, aiming to bridge the gap between technology demonstration and government acquisition for timely deployment in digital operations.
OpenAI Releases Open-Source Codex Security CLI for Repository Scanning and CI/CD Integration
OpenAI has open-sourced its Codex Security CLI, a tool designed for scanning code repositories, tracking security findings, verifying fixes, and integrating security checks into CI/CD pipelines. This release provides developers with a new open-source option for automating security analysis within their development workflows.
Anti-fraud tools struggle against scammers exploiting cheap internet calling and AI
Industry experts state that existing anti-fraud tools like STIR/SHAKEN cannot keep pace with scammers who exploit cheap internet calling and artificial intelligence to conduct phishing, robocalls, and spam. The shift to internet-based calling has removed traditional network trust, making it easier for bad actors to spoof identities and obtain legitimate numbers for fraudulent activities. This situation highlights the need for a multi-faceted approach and potentially new authentication methods to combat evolving scam tactics.
ESET H1 2026 Threat Report details rise in malicious AI skills and adaptable malware
ESET's H1 2026 Threat Report indicates a growing trend of attackers using AI to enhance efficiency and scalability, identifying tens of thousands of suspicious AI skills and the first Android malware, PromptSpy, leveraging generative AI. This development signifies an expanding attack surface and increased flexibility in future threats, alongside continued growth in social engineering tactics like QR code phishing and ransomware activity.
Researchers Identify 84 Flaws in 4G and 5G Core Networks, Including Session Hijacking
Researchers from Nanyang Technological University have disclosed 84 security vulnerabilities in 4G and 5G core networks, stemming from implicit trust errors between network functions. These flaws could enable denial-of-service attacks and session hijacking, impacting both research testbeds and commercial deployments. The findings highlight increased attack surfaces due to the transition to cloud-native deployments.
South Korea fines KT Corporation $39 million for 11-month data breach
South Korea's Personal Information Protection Commission (PIPC) has fined telecommunications giant KT Corporation $39 million for data protection violations stemming from an 11-month internal network compromise. The breach exposed personal information of 16,647 subscribers and led to fraudulent mobile payments, highlighting significant security inadequacies in KT's network management.
Bank of America to Acquire UK Cybersecurity Firm MDSec
Bank of America announced its plan to acquire MDSec Consulting Limited, a UK-based information security consultancy. This acquisition will expand Bank of America's cybersecurity capabilities and its presence in northern England.
Man paralyzed by police in swatting incident seeks $176 million from Pima County
Axeel Melendez, paralyzed after being shot by Pima County deputies during a swatting incident, is seeking $176 million from Pima County. Melendez had previously alerted authorities to his fears of being swatted, raising questions about the response protocols for such calls. This case highlights the severe physical and legal consequences of swatting, a malicious act of falsely reporting emergencies to dispatch law enforcement to an innocent person's location.
Amazon Inspector SBOM Generator Adds Plugin System for Custom Package Collectors
Amazon Inspector's SBOM Generator (inspector-sbomgen) now includes a plugin system, allowing users to create custom package collectors for unsupported software ecosystems. This update enables immediate inventorying of new or niche package formats without requiring source code compilation or official releases, addressing a previous visibility gap for security teams.
Discern Security Raises $13 Million in Series A Funding for AI-Powered Security Platform
Discern Security secured $13 million in Series A funding, bringing its total raised to $16 million. The company will use the capital to expand its engineering and product teams, accelerate platform development, and grow its AI capabilities, which matters as it aims to enhance security posture evaluation and control improvement for organizations.
Microsoft Copilot for Word Vulnerable to Hidden Prompt Injection, Copies Instructions to Output
A security researcher discovered that Microsoft 365 Copilot for Word can be manipulated by hidden instructions within a document, causing it to alter content and then copy those hidden instructions into the generated output. This vulnerability allows malicious documents to influence Copilot's behavior and conceal the changes, posing a risk for data integrity and information disclosure in AI-assisted document creation.
Silver Fox Group Uses New 3-Driver BYOVD Chain to Deliver ValleyRAT to Japanese Manufacturer
The Chinese cybercrime group Silver Fox has deployed a new three-driver Bring Your Own Vulnerable Driver (BYOVD) attack chain against a Japanese industrial manufacturing organization to install ValleyRAT for persistent remote access. This campaign introduces previously unreported vulnerable drivers and combines them with DLL sideloading and defense evasion techniques to maintain control and bypass security controls. The use of multiple drivers enhances the attack's resilience and adaptability across different environments.
Critical Vulnerability in Ruflo AI Orchestration Platform Allows Unauthenticated Remote Code Execution
A critical-severity vulnerability (CVE-2026-59726) has been discovered in Ruflo, an open-source AI agent orchestration platform, allowing unauthenticated attackers to execute commands within the container. This flaw, dubbed "RufRoot," enables shell access, API key theft, and manipulation of AI outputs, posing a significant risk to organizations using the platform.
Claroty Research Finds 18% of Data Center Infrastructure Assets Vulnerable to Attack
Claroty research indicates that nearly one in five cyber-physical systems in data centers are one network connection away from internet-exposed systems, creating potential attack vectors. This proximity to internet-exposed systems could allow attackers to disrupt critical data center functions like cooling, power, and environmental controls.
US and Allied Governments Release Updated SBOM Guidance
Government agencies from the US and 13 allied countries have released updated guidance for Software Bill of Materials (SBOM) minimum elements. This update reflects advancements in supply chain security and software transparency, providing a baseline for technologies and practices in SBOMs.
noyb Files GDPR Complaint Against dict.cc for 1,741-Partner Consent Request
noyb has filed a GDPR complaint against the online dictionary dict.cc, alleging that its consent request for 1,741 tracking partners with a single click violates the requirement for informed consent. This complaint highlights a common issue where websites using online advertising present users with overly broad consent requests, making it difficult to understand data usage.