From SecurityWeek · 40 stories
Critical Flaws Found in Belgian eID Software Affecting 2 Million Users
Security researcher James Arnott discovered critical vulnerabilities in Connective digital identity software, used by over two million people in Belgium for digital identity authentication and electronic signatures. These flaws allowed malicious websites to read eID details, trick users into revealing PINs, forge electronic signatures, and execute remote code, impacting the trust model of Belgium's digital ecosystem.
RingCentral Data Breach Impacts 1.6 Million Accounts After Social Engineering Attack
RingCentral experienced a data breach in July, affecting 1.6 million individuals, following a "sophisticated social engineering campaign." The ShinyHunters extortion group claimed responsibility and leaked data after RingCentral did not meet their demands, leading to the information being added to HaveIBeenPwned.
EU Establishes New Team to Enforce AI Act, Targeting Deepfakes and Illicit Imagery
The European Union launched a new team in Brussels to enforce its AI Act, which comes into force on Sunday. This team will monitor AI companies for violations related to deepfakes, illicit imagery, and cyber threats, requiring AI-generated content to be labeled.
AI Weaponizes Dangling DNS Takeovers, Expanding Attack Surface and Automation
Security firm Silent Push demonstrated how AI can significantly scale 'dangling DNS takeover' attacks, a method where attackers exploit forgotten DNS records pointing to deleted cloud resources. This research, dubbed 'DangleGeddon', shows AI's capability to automate discovery, script generation, and exploitation, making these attacks a more potent threat for nation-state actors focused on disruption.
Oracle Patches 1,449 Vulnerabilities in July 2026 Security Update
Oracle released its July 2026 Critical Patch Update, addressing 1,449 vulnerabilities across 334 products, many identified using AI. With around 600 patches allowing remote exploitation, organizations are urged to update immediately to mitigate the risk of attacks.
Trump Executive Order Mandates Mapping of Defense Supply Chains for Cybersecurity
President Trump signed an executive order requiring the mapping and securing of critical defense supply chains, emphasizing software and technology used in national security. This initiative aims to enhance visibility and security against cyber and economic threats across all tiers of suppliers, impacting both prime and subcontractors.
VMware Avi Load Balancer Patches 7 Critical Vulnerabilities
Broadcom announced patches for seven vulnerabilities in VMware Avi Load Balancer, including critical authentication bypass and remote code execution issues. Organizations are advised to update promptly to prevent potential exploitation, especially as VMware flaws have been targeted in past attacks.
Centers Laboratory Data Breach Impacts Over 540,000 Individuals
Centers Laboratory reported a data breach affecting 542,377 individuals, revealing personal and health information. The breach occurred due to limited access by cybercriminals from the WorldLeaks group, which highlights ongoing threats to healthcare data security.
Keyfactor Secures Over $1 Billion for AI and Post-Quantum Security Solutions
Keyfactor has raised over $1 billion to enhance its Trust Control Plane, addressing identity sprawl and preparing for post-quantum security. This investment will help expand its global operations and advance product innovation amid rising demand for unified cryptographic solutions.
Prompt Injection Attacks Target AI Agents for Fraudulent Crypto Payments
Threat actors are using prompt injection attacks to deceive AI agents into making cryptocurrency payments. Zscaler identified two tactics, including a payment scam disguised as API documentation and a typosquatting operation impersonating a crypto service, which could significantly undermine trust in AI-integrated financial transactions.
Trezor Customers Affected by Data Breach at Shipping Partner ShipMonk
Hardware wallet manufacturer Trezor disclosed a data breach impacting nearly 14,000 customers after its shipping provider, ShipMonk, experienced unauthorized access to its systems. The incident exposed customer order data, including names, addresses, emails, and phone numbers, for orders placed between May 10 and August 8, 2026. Trezor's own systems were not compromised, but the breach raises concerns about potential phishing attempts targeting affected users.
City-Forum Campaign Targets Salesforce and ServiceNow Guest Users with Custom Tools
A campaign named 'City-Forum' is exploiting guest user access in Salesforce Experience Cloud (Aura and LWR implementations) and ServiceNow customer portals to steal data. The attacks use a custom multi-platform toolset and target telecommunications, banking, financial services, enterprise software vendors, and public-sector portals globally.
New York Funds Water System Cybersecurity; Senate Bill Proposes $300M Annual Federal Aid
New York State has allocated over $9 million to 153 drinking water and wastewater systems to enhance cybersecurity defenses and comply with new state standards. Concurrently, Senate Democrats introduced the Water Cyber Shield Act, proposing $300 million annually for national water infrastructure cybersecurity improvements and expanded EPA authority, following recent cyberattacks on water systems.
Chrome 150 Update Addresses 27 Vulnerabilities, Enhances Security
Google released Chrome 150, patching 27 security vulnerabilities, including two critical use-after-free flaws in Ozone and Views. This update is part of a broader effort to improve browser security, with most flaws discovered internally by Google. Regular updates are essential due to frequent exploitation of memory safety vulnerabilities in browsers like Chrome.
Liechtenstein's Register of Beneficial Owners Breached, 31,000 Records Exfiltrated
A cyberattack on Liechtenstein's Register of Beneficial Owners resulted in the exfiltration of data belonging to approximately 31,000 individuals. The breach, which occurred from Wednesday night into Thursday last week, compromised a critical financial transparency tool used to combat money laundering and terror financing in the principality.
Visa Acquires Fraud Prevention Firm BioCatch for $2.4 Billion
Visa is acquiring BioCatch, a fraud prevention company, for $2.4 billion in cash. This acquisition integrates BioCatch's behavioral biometrics technology into Visa's services to enhance cybersecurity and financial crime detection, addressing a global economy cost of over $1 trillion annually from scams and account takeovers.
Horizon3 Raises $250M Series E, Reaching $2 Billion Valuation
Cybersecurity startup Horizon3 secured $250 million in Series E funding, increasing its valuation from $650 million to $2 billion in 14 months. The funding, co-led by NightDragon and NEA, will support the company's growth as enterprises seek solutions for continuous, automated vulnerability testing against escalating AI-driven threats.
ShinyHunters Leaks Brinks Home Data After Breach Affecting 4.9 Million Records
Brinks Home, a residential security company, experienced a data breach identified on July 20, with the ShinyHunters extortion group claiming responsibility. ShinyHunters has leaked over 41 gigabytes of data, including 4.9 million Salesforce records with personally identifiable information (PII), after Brinks Home did not pay a ransom. The breach did not affect alarm monitoring or system functionality.
Okta Acquires AI Identity Security Startup Permiso for Reported $200 Million
Okta has signed an agreement to acquire Permiso Security, an AI identity security startup, for a reported $200 million in an all-cash deal. This acquisition expands Okta's identity management capabilities to include continuous monitoring and threat detection for human, non-human, and AI agent identities in multi-cloud environments, addressing the growing need for securing autonomous software deployments.
Hush Security Raises $30 Million to Secure Enterprise AI Agents
Hush Security, a Tel Aviv-based cybersecurity startup, secured $30 million in Series A funding, bringing its total raised to $41 million. The funding will be used to expand its platform for securing enterprise AI agents, focusing on identity and access management for autonomous AI within sensitive systems.
CISA and ACSC Release Guidance for Isolating Critical Infrastructure OT Systems During Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Cyber Security Centre (ACSC) have issued joint guidance, "CI Fortify – Advice for isolating vital systems," for critical infrastructure organizations. This guidance advises preparing to isolate operational technology (OT) systems from less trusted networks to maintain essential services during cyberattacks or other disruptions, addressing threats from state-sponsored actors.
Spur Intelligence Secures $200 Million Investment from Insight Partners for Bot Detection
Spur Intelligence, a cybersecurity startup specializing in IP intelligence and bot detection, raised $200 million in a funding round led by Insight Partners. This investment will accelerate and scale Spur's operations, which help organizations distinguish legitimate human users from increasingly sophisticated bot traffic and anonymized web activity. The funding addresses the growing challenge of bot activity, which now surpasses human internet traffic.
Cyera Acquires Oasis Security for $1 Billion to Secure AI Agents and Non-Human Identities
Data security company Cyera is acquiring agentic access management provider Oasis Security in a $1 billion deal, with approximately $700 million paid in cash and the remainder in shares. This acquisition integrates Oasis's non-human identity and agentic access governance platform into Cyera's offerings, addressing security challenges posed by the increasing use of AI agents in enterprise environments.
Apple Releases iOS 26.6 and iPadOS 26.6 with 87 Security Fixes
Apple released iOS 26.6 and iPadOS 26.6, addressing 87 vulnerabilities across its mobile operating systems. These updates fix flaws that could allow arbitrary code execution, privilege escalation, and data access, enhancing device security for iPhone and iPad users.
Google Threat Intelligence Group Unifies Threat Actor Naming System
Google Threat Intelligence Group (GTIG) has introduced a new unified naming schema for tracking threat actors, replacing the previously separate systems used by Mandiant and Google's Threat Analysis Group (TAG). This change aims to standardize threat actor identification across platforms and public reporting, making it easier for defenders to understand and respond to threats.
Dolphin X Malware Uses AI Profiling to Rank High-Value Targets
A new remote access trojan named Dolphin X incorporates an "AI Profiler" feature to score and rank infected users, helping cybercriminals prioritize victims. This development allows attackers to automate the identification of high-value targets from a large pool of compromised accounts, potentially increasing the efficiency of cyberattacks.
Chick-fil-A reports data breach from credential stuffing attacks
Chick-fil-A has alerted customers about a data breach caused by credential stuffing attacks affecting accounts. The breach may involve sensitive information like names, email addresses, and partial credit card numbers.
AegisAI raises $36M Series A to combat AI-driven spear phishing with AI agents
AegisAI, a startup founded by former Google security executives, secured $36 million in Series A funding to develop AI agents that detect and prevent AI-crafted spear phishing attacks. The company's technology analyzes email messages for anomalies that traditional rule-based systems often miss, addressing the increasing sophistication of AI-powered cyber threats.
White House Launches AI-Driven Gold Eagle Initiative for Cybersecurity Coordination
The White House has launched the Gold Eagle initiative, an AI-supported federal clearinghouse for cybersecurity vulnerabilities. This program aims to enhance vulnerability detection and remediation across government and private sectors by facilitating collaboration between software maintainers and infrastructure operators. Gold Eagle is backed by multiple federal agencies and uses AI to manage cybersecurity risks efficiently.
Upbound Group discloses $13M fraud in Acima leases following data breach
Upbound Group reported a cybersecurity incident where threat actors stole non-sensitive customer information and documents, leading to $13 million in fraudulent Acima lease-to-own agreements. The stolen data was used to obtain goods, resulting in financial losses for the company when fraudsters failed to make payments. Upbound has implemented enhanced security measures and notified federal law enforcement.
Cyberattack Halts Operations of Japanese Cold-Chain Operator Nichirei, Impacts Food Supply
A cyberattack on Nichirei Logistics Group disrupted frozen food shipments in Japan, affecting major chains like KFC. Operations began partial restoration post-attack, with a focus on data safety due to potential personal data compromise.
AI-Driven Security Startup Glow Emerges With $180M Funding at $1.2B Valuation
Glow, a cybersecurity startup leveraging AI to bolster endpoint security, has emerged from stealth with a $1.2 billion valuation and $180 million in Series A funding. Founded by former Meta and Snowflake executives, the startup seeks to address AI-related cyber risks by providing tools that manage software on employee devices. This reflects the growing concern over AI-augmented cyber threats and the need for enhanced security strategies.
Estée Lauder Data Breach Exposes Sensitive Details Through Oracle E-Business Vulnerability
Estée Lauder disclosed a significant data breach resulting from the exploitation of a zero-day vulnerability in Oracle E-Business Suite. The attack occurred in August 2025 and was revealed in June 2026, impacting personal data including Social Security numbers, financial, and health information of employees. The breach was connected to the Cl0p cybercrime group and affected multiple companies.
Israeli Startup Oak Launches AI-Driven Identity Management Solution with $60M Funding
Startup Oak has raised $60 million in funding, launching an AI-powered identity management system. This aims to unify identity governance across enterprises, addressing challenges exacerbated by AI. Oak's system combines various identity management tools into a single control plane, already deployed by some enterprise clients.
Critical RabbitMQ Vulnerabilities Risk Exposing OAuth Secrets and Tenant Data
A critical vulnerability in RabbitMQ, CVE-2026-5721, exposes OAuth secrets, enabling unauthorized access to sensitive information. An additional flaw can allow logged-in users to access cross-tenant data. These flaws, present since early 2024, have been patched in recent updates. These vulnerabilities underscore the importance of applying security updates to prevent unauthorized access risks.
Attackers Use Dormant GitHub Accounts for Reconnaissance via API
Datadog Security Labs has identified multiple attack campaigns exploiting dormant GitHub accounts for organizational reconnaissance. Attackers use these accounts with automated tools to gather data, occasionally accessing private repositories. This is significant due to potential risks of further targeted attacks.
200 GitHub Repositories Used to Spread Malware in 'Operation Muck and Load'
A threat actor has leveraged 200 GitHub repositories to distribute malware in 'Operation Muck and Load'. The campaign uses a deceptive Go module posing as a DNS scanner, distributing over 700 malicious variants since January 2023 to execute spyware, trojans, and other malware. This highlights significant risks in software supply chain security.
Armenian Man Pleads Guilty to Involvement in Ryuk Ransomware Attacks
Karen Serobovich Vardanyan, a 34-year-old Armenian national, pleaded guilty in the US to charges related to deploying Ryuk ransomware. Extradited from Ukraine, Vardanyan facilitated attacks from November 2019 to April 2020, securing approximately $15 million in ransoms. His case underscores ongoing cybersecurity threats impacting various sectors.
GigaWiper: New Sophisticated Windows Backdoor with Destructive Capabilities
Microsoft has uncovered GigaWiper, a sophisticated malware targeting Windows machines. This backdoor combines older destructive programs to offer disk wiping, fake ransomware, and spyware functions, showcasing a shift in wiper malware to extortion activities. Its likely connections to cyber threats against Israeli organizations highlight the need for vigilance and strong cyber defenses.
UK Unveils AI-Driven 'Cyber Shield' for Enhanced National Cybersecurity
The UK announced the Cyber Shield initiative to improve national cybersecurity through agentic AI systems. The initiative, led by the National Cyber Security Centre, focuses on countering advanced threats that exploit AI to rapidly identify vulnerabilities. This collaboration with academia and industry aims to hardwire AI advancements into national security defenses against increasingly sophisticated cyber threats.