Security · Top stories
FBI Releases CJIS Security Policy v6.1 with Stricter Encryption and Vulnerability Scanning
The FBI released version 6.1 of its CJIS Security Policy on June 25, 2026, updating encryption requirements and increasing the frequency of vulnerability scanning. This update refines the control-based structure introduced in v6.0, impacting security teams responsible for Criminal Justice Information (CJI) compliance.
University of Munich Investigates Cyberattack Exposing Student Financial Data
Ludwig Maximilian University of Munich is investigating a cyberattack that accessed student enrollment data, potentially exposing financial aid and health insurance information. The incident affects personal and financial details of students, prompting an ongoing investigation with law enforcement and cybersecurity specialists.
Dragos Acquires NetRise and runZero Following Accenture's Majority Investment
Dragos completed its acquisitions of NetRise and runZero after Accenture finalized its majority investment in the company. These acquisitions expand Dragos's operational technology (OT) cybersecurity platform with new capabilities in exposure management and software supply chain security.
Microsoft urges Entra ID admins to migrate users to passkeys before SMS sign-in retirement
Microsoft has reminded administrators to migrate Entra ID users to phishing-resistant authentication methods, such as passkeys, as SMS first-factor sign-in will be retired starting February 2027. This change aims to enhance security by moving away from methods vulnerable to phishing, requiring organizations to adopt stronger authentication protocols for user access.
ZuckOff App Detects Meta and Snap Smart Glasses via Bluetooth Signals
A new free mobile application, ZuckOff, developed by Pawel Szydlowski, identifies the presence of Meta and Snap smart glasses in a user's vicinity by scanning for their unique Bluetooth signals. The app, which has seen over 6,000 downloads across Apple's App Store and Google Play Store, addresses public safety concerns regarding unsolicited filming by smart glasses, which have led to bans in some venues. It flags devices like Ray-Ban Meta, Oakley Meta, and Snap Spectacles, providing users with alerts when these recording devices are nearby.
Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems
Two small private water utilities in Colorado experienced cyberattacks in late August that targeted their operational technology (OT) systems. The attacks altered equipment settings and disabled remote access, but did not disrupt water services or public safety. This incident follows a series of similar attacks on water systems across multiple US states, prompting CISA to urge the water sector to secure OT.
Hackers Claim Breach of Russian Election Systems Ahead of Parliamentary Vote
An anonymous hacking group, CikLeak, claims to have breached systems connected to Russia's election infrastructure, including the Central Election Commission and its contractors, days before parliamentary elections. The group states it stole internal documents, server configurations, passwords, and employee communications, providing them to an independent investigative outlet. This incident raises concerns about the security of the Vybory 2.0 platform, which is being used for the first time in a federal election.
Jade Sleet Breaches Indian IT Provider Using FLATROOF and ROOFDECK macOS Backdoors
The North Korean threat actor Jade Sleet compromised an Indian IT services organization, deploying macOS backdoors FLATROOF and ROOFDECK. This incident highlights Jade Sleet's ongoing strategy of targeting developers and supply chains to breach networks, particularly within the Web3 sector.
Google Infiltrated TeamPCP Hacking Group During Supply Chain Attacks
Google's threat intelligence group revealed an undercover researcher infiltrated the TeamPCP hacking group, which tainted hundreds of open-source programs and breached over a thousand companies. This infiltration allowed Google to monitor the group's activities, warn targets, and assist law enforcement.
TigerByte Cyber Raises $3 Million Seed Funding for AI and Edge Device Cybersecurity
Cybersecurity firm TigerByte Cyber emerged from stealth with $3 million in seed funding to scale its cyber hardening solution for AI and edge devices. The funding will be used to modernize communication and navigation systems across various sectors and expand US manufacturing capabilities.
Intel suspends bug bounty program, replaces it with unrewarded disclosure program
Intel has suspended its bug bounty program, which previously offered rewards up to $100,000 per flaw. The company replaced it with a responsible disclosure program on Intigriti that offers no financial rewards, without providing a reason for the change. This shift could reduce external security research contributions, impacting Intel's vulnerability discovery process.
UK Police Data on Microsoft Azure Vulnerable to Foreign Access, US Government
A Guardian investigation revealed that sensitive UK police data, including criminal records and victim statements, stored on Microsoft Azure cloud platforms is vulnerable to compromise by foreign actors and the US government. A 2017 police document acknowledged this risk, which persists today, despite police assurances that data remains in the UK and requires express permission for US access, contradicting Microsoft's own statements.
South Korea increases data breach fines to 10% of revenue for major incidents
South Korea's Personal Information Protection Commission (PIPC) has raised data breach fines to 10% of total revenue for companies that leak personal data of 10 million or more people due to intent or gross negligence. This change, effective Friday, aims to encourage companies to prioritize data protection as a preventive investment.
Public Exploits Released for Four Linux Kernel Flaws Allowing Local Root Access
A security researcher released working exploit code for four Linux kernel flaws, DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, which allow a local user to gain root access. While kernel maintainers have already fixed these vulnerabilities, the public release of exploit code increases risk for systems not yet updated. These exploits primarily affect multi-user servers where an attacker already has low-privileged access.
Fake Calendar Invite Malware Attacks Surge by Over 1,200% in August
Cybersecurity firm Sublime reports a significant increase in calendar-based malware attacks, with a 1,216% rise in August and a projected 2,852% increase for September. These attacks exploit default settings in email programs like Outlook and Gmail, which automatically add malicious invites to users' calendars, bypassing typical email security measures.
Nations Act on North Korean IT Worker Scheme After UN Report
Multiple countries have initiated legal actions against North Korean IT workers or their facilitators following a UN report detailing Pyongyang's illicit IT worker scheme. These actions include investigations, asset freezes, and detentions in response to North Koreans using stolen or purchased IDs to secure high-paying IT roles and funnel earnings back to North Korea.
Microsoft Teams to allow custom blocking of file extensions for security
Microsoft Teams will introduce a feature allowing administrators to customize blocked file extensions within its Weaponizable File Protection. This update, rolling out in November 2026, enables organizations to tailor security policies for file attachments in chats and channels.
Plugin4Shell Flaw Allows Malicious Code Swap in Four AI Coding Agents
A security flaw, dubbed Plugin4Shell, allows repository owners to swap a plugin's code for a malicious version in four AI coding agents, even when the agent is locked to a specific version. This vulnerability enables attackers to access user files and credentials, impacting Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI.
Symbiosis DeFi Exchange Hacked for $770,000 Due to Smart Contract Vulnerabilities
The Symbiosis DeFi network was exploited for at least $770,000 after a hacker leveraged a privilege escalation flaw and a negative transaction fee vulnerability in its smart contracts. The attacker minted 46 billion fake syBTC by setting transaction fees to a negative value, then traded these unbacked tokens to drain liquidity pools. This incident highlights critical security risks in DeFi smart contract design and auditing.
Man arrested for selling 3D-printed machine gun conversion kits to undercover agents
A 19-year-old in Florida was arrested for selling 3D-printed "Glock switches" that convert semi-automatic firearms into fully automatic weapons. This incident highlights ongoing concerns among authorities regarding the proliferation of 3D-printed firearm components and conversion devices.
MIND Secures $72 Million in Series B Funding for AI-Powered Data Loss Prevention
MIND, a data loss prevention (DLP) startup, raised $72 million in Series B funding, bringing its total funding to $112 million. This investment will accelerate platform development and market expansion for its AI-native DLP solution, which protects data across enterprise environments.
Apple Challenges UK Government's Secrecy Order on Encrypted Data Access Demands
Apple is challenging the UK government's refusal to publicly confirm whether it has issued an order requiring the company to provide access to encrypted user data. This legal action highlights ongoing tensions between tech companies and governments over data privacy and national security.
CISA Retires Weekly Vulnerability Bulletin, Shifts to Risk-Based Approach
The US Cybersecurity and Infrastructure Security Agency (CISA) is discontinuing its weekly vulnerability bulletin on September 28. This change aligns with a broader shift towards prioritizing vulnerabilities based on real-world risk factors, such as active exploitation, rather than solely on severity scores.
BlackCore trained Angolan officials in online influence operations, Citizen Lab reports
Israeli contractor BlackCore reportedly trained Angolan government officials in online influence operations, including creating fake social media personas and promoting government narratives. This highlights the growing use of private firms for state-sponsored online manipulation, raising concerns about information integrity and democratic processes.
Poland's Orlen energy group lost $230 million in cryptocurrency attempting to buy Venezuelan oil
Poland's state-backed Orlen energy group lost $230 million in USDT cryptocurrency during a failed attempt to purchase Venezuelan oil in 2023. The funds were lost through a series of transactions involving intermediaries and alleged scammers, highlighting the risks of using cryptocurrency for large-scale, complex international dealings, especially in sanctioned environments.
CISA Releases Guidance on Cyber Decoy Systems for Critical Infrastructure Defense
The US Cybersecurity and Infrastructure Security Agency (CISA) has published new guidance for critical infrastructure organizations on deploying cyber decoy systems. This guidance aims to strengthen cyber defenses by helping organizations detect adversaries, collect threat intelligence, and allocate resources more effectively, complementing existing Zero Trust models.
Google confirms Pixel phones exploited by modem vulnerability, patched in September 2026 update
Google confirmed that a limited number of Pixel phones were targeted and exploited through a modem vulnerability, CVE-2026-58704, which allowed remote privilege escalation without user interaction. This vulnerability was patched in the September 2026 security update, making it critical for Pixel users to update their devices.
Parallels Desktop Flaw Allows Root Access on Macs; Intel Macs Cannot Install Fix
JFrog discovered a vulnerability in Parallels Desktop for Mac that allows a local, non-administrative user to execute code as root. The fix for this flaw, Parallels Desktop 27, is not compatible with Intel-based Macs, leaving those users vulnerable.
AWS Releases Security Reference Architecture Deep Dive for PCI DSS Compliance
Amazon Web Services (AWS) has published a new AWS Security Reference Architecture (SRA) Payment Card Industry (PCI) Data Security Standard (DSS) Deep Dive guide. This guide provides prescriptive architectural guidance for organizations handling cardholder data on AWS, extending the core AWS SRA to address specific PCI DSS compliance requirements.
Telus Notifies Customers of Account Breaches, Personal Data Accessed
Telus, a major Canadian telecom provider, is informing customers about account breaches that occurred between February 2025 and June 2026. Attackers used compromised credentials to access personal information and make unauthorized service changes, with some data used to solicit customers to switch providers.
Malicious Twitch Browser Extension Leaks OAuth Tokens from Nearly 31,000 Users
A malicious Twitch browser extension, "Twitch Enhanced Viewer | JeetBot," has been found leaking OAuth tokens from approximately 31,000 users to proxy servers operated by a Russian commercial bot service. These tokens, which grant access to user chat, whispers, and account settings, are exposed in cleartext via URL query strings when users watch channels not on a hardcoded allowlist.
Chess.com User Data Leak Exposes 7.3M Records, Likely Due to Scraping
A 15.5 GB file containing over 7.3 million Chess.com user records, including email addresses, usernames, and internal marketing tags, appeared on data-leak forums. Analysis indicates the data is genuine and recent, but evidence suggests it was obtained through scraping over several days rather than a system hack, as no passwords or payment information were included.
NSA reorganizes into five mission centers focusing on cyber, AI, and global intelligence
The National Security Agency (NSA) is undergoing a rapid reorganization, replacing existing directorates with five new mission centers focused on China, cybersecurity, artificial intelligence, combat support, and global intelligence. This restructuring aims to accelerate the delivery of intelligence to operational environments, impacting how the agency addresses modern threats and leverages emerging technologies.
Flawed Netgear Routers Flood University of Wisconsin Internet Time Server
A flaw in Netgear routers caused them to continuously flood the University of Wisconsin's Internet Time Server with Simple Network Time Protocol (SNTP) requests, leading to a denial of service. Netgear is cooperating with the university to resolve the issue and provide code upgrades for affected products. This incident highlights the potential for widespread network disruption from device firmware vulnerabilities.
FTC Penalizes GM for Selling Driver Data; Mozilla Finds Widespread Auto Data Collection
The Federal Trade Commission issued a five-year ban preventing General Motors from selling customer driving data to third-party brokers after GM collected and shared data like speeding habits, leading to increased insurance rates for some drivers. This action highlights a broader industry issue, as a Mozilla Foundation report found all major car companies have poor privacy practices, collecting extensive user data through various services.
New Android VPN bypass vulnerability allows apps to leak traffic outside VPN tunnel
A newly discovered vulnerability in Android's network stack allows any app to send UDP traffic outside an active VPN tunnel, even when the "Block all connections without VPN" setting is enabled. This leak exposes the device's real IP address, potentially enabling tracking or surveillance, and does not require special app permissions. Google reportedly closed the issue without action after it was reported through their Vulnerability Reward Program, though GrapheneOS is working on a fix.
Trail of Bits Audits Signal's New Automatic Key Verification System
Signal has launched Automatic Key Verification, a new feature designed to validate chat security without manual safety number comparison. Trail of Bits built and operates one of the three independent auditors for this system, continuously checking its integrity. This enhances the security of Signal chats by making key mismatch attacks harder to conceal.
US Customs Supervisor Arrested for Stealing PC Hardware from Homeland Security Computers
A US Customs and Border Protection supervisor, Terry Liu, was arrested for allegedly stealing Intel Core i7 CPUs, RAM, and hard drives from 46 Department of Homeland Security computers. Liu replaced the stolen components with inferior hardware and used Newegg's trade-in program to convert the stolen parts into store credit, causing an estimated $105,800 in damages.
Iran Captures Defective US Navy Underwater Drone, May Attempt Reverse-Engineering
Iranian forces recovered a malfunctioning 19-foot Dive-LD autonomous underwater vehicle belonging to the U.S. Navy near the Strait of Hormuz. Iran is expected to study and attempt to reverse-engineer the drone, providing it with an opportunity to examine American undersea technology despite U.S. claims the vehicle was unclassified and defective.
Rustls Celebrates 10th Anniversary, Details Evolution, Benchmarks, and Future Plans
Rustls, the Rust-based TLS library, marked its tenth anniversary by releasing a retrospective on its development, community growth, and future roadmap. Benchmarks show Rustls outperforming OpenSSL and BoringSSL in full and resumed handshakes, and in data received throughput, while being marginally slower in data sent throughput compared to BoringSSL.