Security · Top stories
CISA Warns of Exploited Ray Vulnerability; T-Mobile Cut Cable to Stop Chinese Hackers
CISA issued a directive for federal agencies to patch a critical code injection vulnerability in Ray-Project Ray, which is actively being exploited by the RondoDox botnet. Separately, T-Mobile physically disconnected a router cable to stop an intrusion by the Chinese state-sponsored hacking group Salt Typhoon.
Russian Network Monitoring Firm Microolap Confirms Cyberattack, Denies Major Data Breach
Russian software developer Microolap confirmed that some of its non-critical systems were compromised by hackers but denied claims of access to its core network monitoring platform or theft of major company data. This incident highlights ongoing cyber warfare activities and the challenges companies face in controlling narratives around security breaches.
Senator Wyden Requests GAO Review of Federal Agencies' Hacking Tool Use
Senator Ron Wyden has asked the U.S. Government Accountability Office (GAO) to investigate how federal law enforcement agencies, including the FBI and DEA, use hacking tools and spyware against Americans. This request aims to increase transparency regarding the scope, frequency, and safeguards surrounding these tools, which have been used for over two decades with little public oversight.
Critical Vulnerability in isolated-vm Node.js Library Allows Remote Code Execution
A critical type confusion vulnerability in the isolated-vm Node.js library could allow attackers to achieve remote code execution (RCE) on the host system. This flaw impacts applications using isolated-vm to execute untrusted JavaScript code within V8 Isolates, potentially leading to system compromise.
AI data company Alation confirms cyberattack after customer incident
Alation, an enterprise data software company, confirmed a cyberattack after an earlier incident caused degraded availability for some customers. The company is investigating the unauthorized activity in one of its systems, but has not specified the nature of the attack or the number of affected customers. This incident highlights the increasing targeting of companies storing large amounts of sensitive data.
Zombie Card Attack Revives Expired Visa Contactless Cards for Purchases
Researchers at the University of Massachusetts Amherst demonstrated a "Zombie Card" attack that allows expired Visa contactless credit cards to be used for in-store purchases by rewriting the expiration date read by a point-of-sale terminal. This attack requires physical access to the card and a man-in-the-middle relay, and it exploits how Visa's Kernel 3 processes expiration dates, which could lead to unauthorized transactions if banks do not re-check expiry during authorization.
CDN Tsunami Attacks Exploit HTTP/3 Translation for DoS Amplification
Cybersecurity researchers disclosed "CDN Tsunami" denial-of-service attacks that exploit how major CDNs convert HTTP/3 client requests to HTTP/1.1 for origin servers. This method amplifies low-bandwidth requests by up to 350x against the origin, affecting six major CDN providers.
Incogni Ranks 13 AI Platforms by Privacy Risk in New Report
Incogni's "Gen AI and LLM Data Privacy Ranking 2026" report analyzes 13 AI platforms, scoring them based on privacy risks, data handling, and user control over data. The study indicates that larger AI platforms generally pose higher privacy risks, with one exception, providing users with information to assess privacy implications before using these services.
Atalanta Releases AI-Assisted Argo Tool to Secure Satellite Communications After 2022 Attack
Cybersecurity company Atalanta released "Argo," an AI-assisted tool that uses "software understanding" to analyze systems for vulnerabilities. This technology is currently being used to enhance the resilience of Viasat's satellite network, which was targeted in a 2022 Russian hacking attack, and addresses growing concerns about cyber threats to critical infrastructure.
NASA AIT-GUI Flaws Allow Unauthenticated Spacecraft Command Execution
Security researchers at Cycode discovered critical flaws in NASA/JPL's AIT-GUI, an open-source operator console for spacecraft, that could allow unauthenticated attackers to issue arbitrary commands. The vulnerabilities, rated 9.4 CVSS, affect versions 2.5.1 and earlier and have been patched in version 2.5.2. This impacts the security of ground data systems used to control spacecraft and instruments.
Sakura Internet discloses data breach affecting up to 1.36 million accounts
Japanese cloud provider Sakura Internet reported that hackers accessed its sales management system, potentially exposing data for up to 1.36 million customer accounts. This incident follows a separate, less severe breach and impacts a strategic provider for Japan's Government Cloud program.
T-Mobile Physically Disconnected System to Expel Chinese Hackers from Network
T-Mobile cybersecurity staff identified and removed Chinese government-backed hackers, known as Salt Typhoon, from its network in 2024 by physically cutting a cable to a compromised system. This action prevented a widespread breach during a campaign targeting multiple U.S. telecom companies to steal customer data and information on government officials.
Bodycam Footage Reveals Officer Abused License Plate Readers to Stalk Woman
Body camera footage obtained by 404 Media shows a Florida police officer admitting to using police databases and license plate reader cameras to stalk and pull over a woman he met. This incident highlights the ongoing issue of law enforcement personnel misusing surveillance tools for personal reasons, despite claims from companies like Flock that such abuses are rare.
Latvian Officials Resign After Cyberattack Exposes Data of 1.2 Million People
Latvia's Road Traffic Safety Directorate (CSDD) confirmed a cyberattack exposed data from payment receipts for 1.2 million people and 200,000 businesses, leading to resignations of officials. This breach affects a significant portion of Latvia's population and raises concerns about potential social engineering and fraud schemes.
Oracle Releases 943 Security Patches in August 2026 Critical Security Update
Oracle has released 943 new security patches as part of its August 2026 Critical Security Patch Update, addressing over 1,000 unique CVEs across two dozen products. This update is significant because it includes over 460 remotely exploitable vulnerabilities without authentication, with more than 150 critical-severity bugs, necessitating prompt application by customers.
AWS Security Hub Extended adds Supply Chain Security as its tenth category
AWS Security Hub Extended now includes Supply Chain Security as its tenth category, integrating solutions from partners like Chainguard and Socket. This addition addresses growing concerns about software supply chain risks, offering a consolidated approach to security management within the AWS ecosystem.
University of Texas at San Antonio takes systems offline after cyberattack
The University of Texas at San Antonio (UTSA) took several systems, including phones, offline after detecting cyberattack activity on its academic campus. This disruption occurred just before classes were set to begin, affecting student services like course registration and payment deadlines. UTSA's chief technology officer stated that the threat was contained at the network edge, with no evidence of data access or exfiltration found so far.
Ukrainian Agency Managing Seized Russian Assets Reports Cyberattack
Ukraine's Asset Recovery and Management Agency (ARMA) reported a cyberattack targeting its operations, which occurred amidst preparations to select a manager for seized corporate rights in IDS Ukraine. The agency is investigating whether the incident is part of a coordinated effort to disrupt its work, particularly concerning assets linked to sanctioned Russians.
Fortinet Acquires AI Security Company Virtue AI to Enhance AI Model Protection
Fortinet has acquired Virtue AI, a company specializing in security and governance for AI models, conversational applications, and autonomous agents. This acquisition allows Fortinet to integrate Virtue AI's automated testing, real-time protection, and compliance oversight capabilities into its existing AI security offerings.
Microsoft removes WMIC tool from Windows 11 24H2 and 25H2 to enhance security
Microsoft has removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2, 25H2, and beta builds. This removal aims to improve operating system security by eliminating a tool frequently abused by malware and threat actors.
Snowflake GitHub Actions Flaw Allowed Command Injection via Crafted Issues
Cybersecurity researchers at Wiz discovered a GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository. This flaw allowed command execution through crafted GitHub issues, potentially exposing internal Jira credentials. Snowflake quickly patched the vulnerability, confirming no evidence of unauthorized access.
Geekom Shipped Malware-Laced Network Drivers for AMD Mini PCs
Geekom acknowledged that network drivers for its A7, A8, AE7, AE8, AX7 Pro, and AX8 Pro mini-PCs contained the Asruex backdoor malware. The company removed the malicious package and advised users who installed it to perform a full system wipe, as the malware granted administrator-level permissions and could steal data or intercept keystrokes.
Ukraine Claims Cyberattack on Russian E-commerce Giant Wildberries Amid Drone Strikes
Ukraine's military intelligence claims it disrupted operations of Wildberries, Russia's largest online marketplace, through a cyberattack. This action was intended to amplify the impact of recent drone strikes on the company's infrastructure, which Ukraine states plays a role in Russia's logistics and war financing.
Unisoc VoLTE Exploit Chain Grants Full Android Kernel Access, No Fix Available
Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that allows full Android kernel access on devices using Unisoc modem firmware via a VoLTE video call. The chipset maker has not provided a fix for this vulnerability, which affects devices from Motorola, Realme, and Xiaomi.
Threat Actors Acquire Expired Domains to Redirect Traffic to Scams and Malware
Threat actors are acquiring expired domains, termed "dropcatch domains," to exploit their inherited reputation and traffic for redirecting users to scams and malware. This practice accounts for nearly 20% of all daily new domain registrations, posing a significant security risk by leveraging previously legitimate web addresses.
Mustang Panda's CoolClient Backdoor Now Uses Signed Windows Kernel-Mode Rootkit
The threat actor Mustang Panda (HoneyMyte) has updated its CoolClient backdoor to include a signed Windows kernel-mode rootkit, enhancing its ability to hide malicious activity. This new component allows the malware to conceal processes, files, registry objects, and C2 network information, making detection and removal more difficult for cybersecurity defenses.
China-Linked Jewelbug Group Uses XG-Web for Espionage and Crypto Fraud
The China-linked threat actor Jewelbug conducts cyber espionage against governments and militaries while simultaneously engaging in cryptocurrency fraud, utilizing a single control panel called XG-Web. This group operates parallel missions, targeting entities in the Middle East, Southeast Asia, and South Asia for espionage, and Chinese-speaking victims for financial gain through crypto fraud.
New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
A new backdoor named PATCHCORD is targeting Afghan telecom providers and South Asian critical infrastructure organizations. This campaign, attributed to the Pakistan-aligned APT36, uses sector-specific lures like fake VPN installers and impersonated government domains to deliver malware capable of remote command execution and data exfiltration.
Engineer indicted for attempting to steal DRAM process tech using hidden camera, detected by Wi-Fi signals
A senior engineer at Nanya Technology was indicted in Taiwan for allegedly attempting to steal 32 files related to the company's DRAM manufacturing process. The engineer used a hidden 360-degree camera, but its wireless signals were detected by Nanya's IT security team, leading to the indictment under Taiwan's Trade Secrets Act.
IETF TLS Working Group Opposes NSA-backed Proposal to Remove ECC from Hybrid ML-KEM
The Internet Engineering Task Force (IETF) TLS working group has largely opposed a specification, supported by the NSA, that would remove Elliptic Curve Cryptography (ECC) from hybrid ECC+ML-KEM in TLS. This opposition highlights concerns about the security implications of relying solely on ML-KEM without the added protection of ECC, particularly given the potential for future mathematical breaks in ML-KEM.
Tor Project Releases Snowflake Volunteer Android App to Combat Censorship
The Tor Project, in collaboration with Bloco and Guardian Project, released the Snowflake Volunteer Android app on the Google Play Store. This app allows users to turn their smartphones into Snowflake proxies, enabling others in censored regions to access the Tor Network.
AI-powered crypto investment scams lead to significant financial losses in Australia
A Queensland man lost over $166,000 to an AI-generated cryptocurrency investment scam, highlighting a growing trend where AI is used to create sophisticated fraudulent schemes. Australian consumers have lost over $45 million to investment scams in 2026, with AI enabling scammers to bypass traditional red flags and create hyper-realistic deception at scale.
Cargo Thieves Hijack AI Hardware Shipments in California Using PIT Maneuvers
Cargo thieves disabled private security escorts and stole millions of dollars worth of AI data center hardware in two separate incidents on California roads. These thefts contribute to a significant increase in cargo theft losses, with restricted Nvidia servers selling for double their U.S. retail price in China, indicating a black market demand for these components.
US Courts to Publicly Report Spyware and Hacking Tool Authorizations Starting 2029
The Administrative Office of the U.S. Courts will begin publicly disclosing the number of judicial authorizations for wiretaps conducted using hacking tools and spyware, starting with the 2028 Wiretap Report published in 2029. This change will provide public data on the government's use of network investigative techniques (NITs) for real-time communication surveillance, which has previously been unreported.
Boeing 737 Hacking Demonstrated, LexisNexis Investigates Third Potential Breach
Academic researchers demonstrated how a small hardware device could compromise Boeing 737 systems, potentially allowing data spoofing and flight plan alteration. Separately, LexisNexis took several services offline to investigate unusual activity, marking a potential third data breach for the company.
Beacon CRM Data Breach Affects Over 1,000 Charities
Beacon, a UK-based CRM provider for non-profits, reported that a data breach likely exposed the entire customer database of over 1,000 charities. Attackers accessed data via a compromised AWS access key, potentially exposing personal information of supporters.
New Universal RCE Deserialization Gadget Chain Affects Ruby 3.3 to 4.0.6
A new universal Remote Code Execution (RCE) deserialization gadget chain has been released, enabling command execution via Marshal.load on Ruby versions 3.3 up to 4.0.6. This development follows a 2026 disclosure by OpenAI regarding AI agents exploiting Ruby deserialization to gain administrative control, highlighting an ongoing vulnerability in Ruby's deserialization process.
AWS Certificate Manager Adds ACME Support, Deprecates Email Validation by September 2027
AWS Certificate Manager (ACM) now supports the Automated Certificate Management Environment (ACME) protocol for automated public certificate issuance and renewal, addressing the operational burden of reduced certificate validity periods. Concurrently, ACM will discontinue support for email-validated public certificates by September 30, 2027, requiring users to migrate to DNS validation in alignment with CA/B Forum standards.
Ukraine Shuts Down 94 Fraudulent Call Centers, Seizes Millions in Cash and Assets
Ukrainian authorities, in collaboration with German police, shut down 94 fraudulent call centers that engaged in investment scams and attempted to gain access to bank accounts. This operation led to the seizure of millions in cash, computer equipment, and the identification of 26 suspects, significantly disrupting a widespread cybercrime network.
Akira Ransomware Affiliate Bypasses EDR by Booting into Safe Mode, Steals Data
An Akira ransomware affiliate disabled endpoint detection and response (EDR) by restarting a compromised system into Safe Mode with Networking, allowing data exfiltration. Although the ransomware payload failed to execute due to low virtual memory, the attackers successfully stole credentials and files. This incident highlights a known tactic, previously seen with other ransomware families, now observed in an Akira attack.