Security · Top stories
Quest Diagnostics Reports Cyber Breach of Patient Records on Quanum Lab Services Manager
Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager platform, potentially compromising certain patient records. The company discovered the breach on Wednesday and is investigating the scope of affected data and patients, while working with federal law enforcement and cybersecurity experts.
Chrome's Safe Browsing Enhanced Protection Mode Improves Phishing and Scam Detection
Google Chrome updated its Safe Browsing Enhanced Protection mode with new features to detect suspicious and dangerous sites, and to counter ClickFix social engineering attacks. These updates aim to make users ten times safer from various online threats compared to Standard Protection by leveraging Gemini models and clipboard analysis.
Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany
An alleged member of the Qilin ransomware group was arrested in Japan and extradited to Germany, where the individual is wanted for a ransomware attack against a logistics company. This arrest targets a core member of a prolific ransomware-as-a-service operation responsible for attacks on hundreds of organizations globally.
Cloudflare to Launch Public Certificate Authority Supporting Post-Quantum Cryptography
Cloudflare announced its intent to become a public Certificate Authority (CA) and has applied for inclusion in major root programs, including Chrome, Apple, Microsoft, and Mozilla. This initiative includes plans to be among the first CAs to issue post-quantum certificates, specifically Merkle Tree Certificates (MTCs), targeting early 2027 for inclusion in Chrome's Quantum-resistant Root Store. The move aims to address the performance challenges of post-quantum cryptography at internet scale and expand Cloudflare's role in web encryption.
Attackers hijacked TLDs to mint counterfeit TLS certificates for Google and other services
Attackers compromised three country code top-level domains (.gh, .sl, .as) to modify DNS records and obtain unauthorized TLS certificates for Google and other major online services. This allowed them to impersonate affected infrastructure, prompting Google to update Chrome to block these certificates and advise domain owners on preventative measures.
International Coalition Seizes Hacking Tools Linked to China's Integrity Technology Group
An international coalition, including the FBI and U.S. Department of Justice, seized websites supporting the hacking tools Microscan and FishHub. These tools were used by China-based Integrity Technology Group, a company contracted by China's Ministry of State Security, to conduct vulnerability scanning and intrusions targeting critical infrastructure globally, including in the U.S. and Taiwan.
MonsterCloud CEO Charged for Allegedly Defrauding Ransomware Victims with Secret Payments
Zohar Pinhasi, CEO of MonsterCloud, has been charged with wire fraud for allegedly defrauding ransomware victims between June 2018 and June 2023. Prosecutors claim Pinhasi's company, MonsterCloud, secretly paid ransoms to attackers for decryption keys while falsely advertising proprietary data recovery technology. Pinhasi then charged clients significantly marked-up fees, with one instance showing an $8,200 ransom payment resulting in a $150,000 charge to the client.
Musician Sentenced to 18 Months for $10 Million AI-Assisted Streaming Fraud
Michael Smith, a 54-year-old North Carolina musician, received an 18-month prison sentence for orchestrating a $10 million streaming royalty fraud scheme. Between 2017 and 2024, Smith used AI-generated songs and automated bots to artificially inflate streaming numbers on platforms like Spotify, Apple Music, Amazon Music, and YouTube Music. This case marks the first criminal conviction in the US for AI-assisted streaming fraud, highlighting a new method of financial crime in the digital music industry.
Cloudflare remediates cross-tenant data exposure vulnerability in Containers
Cloudflare fixed a vulnerability in its Containers and Sandboxes services that could have exposed residual disk blocks from other tenants. A security researcher reported the issue, which allowed Workers Paid account users to potentially recover data from previously used storage blocks on the same host. Cloudflare found no evidence of malicious exploitation and applied a fix across its Container fleet.
International Law Enforcement Dismantles KillSec Ransomware Group, Identifies Teen Leader
An international law enforcement operation, "Operation KillSwitch," has dismantled the KillSec ransomware group, seizing its dark web leak site and five core servers. Authorities identified a 16-year-old as the alleged administrator and main operator, made three provisional arrests, and blocked access to 110TB of stolen data. This action disrupts a group linked to approximately 1,000 suspected attacks worldwide.
Apple Patches CoreGraphics Vulnerability Potentially Exploited in Targeted Attacks
Apple released security updates for iOS, iPadOS, and macOS to fix a CoreGraphics vulnerability (CVE-2026-86950) that could allow arbitrary code execution. Apple stated the flaw may have been exploited in targeted attacks against specific individuals on older iOS versions. The updates address the issue with improved bounds checking.
Microsoft and Partners Dismantle EvilTokens AI Cybercrime Platform, Two Arrested
Microsoft, in collaboration with partners including Health-ISAC, Cloudflare, and OpenAI, has taken down EvilTokens, an AI-powered cybercrime platform. The platform, which offered AI tools for account compromise and financial fraud, led to the arrest of two men, aged 32 and 38, in the UK by the Metropolitan Police Service.
Microsoft sets new Patch Tuesday record with over 650 security fixes for Windows
Microsoft released over 650 security fixes for Windows in its September Patch Tuesday, setting a new record. This increase in patched vulnerabilities is attributed to new AI models, like Anthropic's Mythos and OpenAI's cybersecurity model, which are discovering software flaws at a rapid pace.
Revolut confirms customer data breach via fraudulent government agency requests
Revolut disclosed that an unauthorized third party obtained sensitive customer data by submitting fraudulent requests from a legitimate government agency email domain. The exposed information includes identity details, contact information, and potentially verification selfies, account statements, and transaction histories for a limited number of customers. This incident highlights vulnerabilities in data access protocols, even when dealing with seemingly legitimate government communications.
Trezor Discloses ShipMonk Breach Exposed Data of 67,000 U.S. Customers
Hardware wallet manufacturer Trezor announced that 67,000 U.S. customers had their personal data exposed due to a breach at its shipping provider, ShipMonk. This incident is significant because it adds to previously disclosed exposures and highlights the risks associated with third-party data handling, even after assurances of data deletion.
PaperCut warns of active exploitation of zero-day vulnerability in NG and MF software
PaperCut issued an urgent security advisory regarding a zero-day vulnerability in all versions of its PaperCut NG and PaperCut MF print management software, which is actively being exploited in attacks. The company released emergency patches and advised organizations to restrict access to web interfaces of Internet-exposed servers, as this vulnerability poses a significant risk to affected systems.
Craneware Reports Data Breach Affecting US Hospitals and Pharmacies
Craneware, a UK-based software provider for over 2,000 US hospitals, reported a data breach involving employee and customer information. The breach resulted in the theft of significant data, impacting hospitals' billing and patient management services. The incident has been contained, with investigations ongoing.
Russian National Charged in US for Malware Campaign Targeting 80,000 Freelancers
Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national, has been extradited to the US and charged with orchestrating a phishing campaign that infected 80,000 freelancers with TVRAT and DarkVNC malware between 2016 and 2017. Aktulaev used 255 fake accounts on an unnamed freelance employment platform to distribute malicious Excel attachments, gaining remote control and stealing data from victims' systems. This case highlights international efforts to prosecute cybercriminals.
Two Berlin State Ministries Disconnected from Government Network Following Security Breach
Two Berlin state ministries, responsible for urban development and mobility, have been isolated from the city government's IT network due to a security breach. This incident has disrupted internal communications and some public services, highlighting vulnerabilities in government IT infrastructure.
Hackers deliver malicious Virtualizor update via BGP hijacking
Hackers used BGP hijacking to redirect traffic for Virtualizor's update infrastructure, delivering malicious updates to a small number of installations. Softaculous, the vendor, released a new Virtualizor version and advised users to check for a malicious service and reset credentials.
Sality P2P Botnet Dismantled After 23 Years of Operation
The Sality peer-to-peer (P2P) botnet, active since 2003, has been disrupted through an international law enforcement effort involving the U.S. Department of Justice, Europol, Eurojust, and private partners like CrowdStrike and the Shadowserver Foundation. The operation, which took place on August 31, 2026, included a P2P sinkhole and domain seizures, effectively neutralizing a long-standing threat that infected over 15,000 devices and distributed various malware, including the EggJagger clipjacking tool.
Boston Scientific reports cyberattack disrupting global operations and order processing
Medical technology company Boston Scientific experienced a cyberattack on August 25 that disrupted its IT systems, causing a network outage and affecting its ability to process and ship customer orders globally. The incident impacts a major medical device manufacturer, potentially affecting the supply chain for critical medical equipment worldwide.
ATF confirms "major incident" after Qilin ransomware group claims breach
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a "major incident" involving a breach of one of its standalone systems, following claims by the Qilin ransomware group. The agency stated that its main enterprise network, eForms system, and other ATF systems were not affected, and operations remain uninterrupted.
Grok AI Vulnerable to Data Exfiltration via Encrypted Malicious Instructions
Researchers discovered a new prompt injection attack against Grok that uses encrypted malicious instructions to bypass guardrails and exfiltrate user data. This method exploits the LLM's inability to distinguish between trusted user input and harmful content, allowing it to steal chat data and personal information.
Ransom Cartel Creator Sentenced to 16 Years for Ransomware-as-a-Service Operation
Maksim Silnikau, the 40-year-old Belarusian creator and administrator of the Ransom Cartel ransomware-as-a-service operation, was sentenced to 16 years in prison in Virginia. Silnikau developed the ransomware and recruited affiliates to attack at least 18 companies globally between 2021 and 2023, providing them with tools and infrastructure for intrusions and ransom negotiations.
SafePal data breach exposes order information for 39,798 customers
Cryptocurrency hardware wallet provider SafePal reported a data breach affecting approximately 39,798 customers, exposing names, email addresses, shipping addresses, phone numbers, and purchase information. A threat actor is now claiming to sell this stolen data on a cybercrime forum. This breach could lead to targeted phishing and social engineering attacks against affected customers.
New 'ShieldBreak' Zero-Day Exploit Bypasses Microsoft Defender Patch, Grants SYSTEM Privileges
Security researcher Nightmare Eclipse released "ShieldBreak," a new zero-day exploit for Microsoft Defender that bypasses a previous patch for the RoguePlanet vulnerability (CVE-2026-50656). This exploit allows SYSTEM privileges on fully updated Windows 10, Windows 11, and Windows Server systems, highlighting an incomplete patch for a privilege escalation flaw.
FBI Warns of Cybercriminals Hacking Accounts to Steal Explicit Images for Extortion
The FBI has issued a public warning about cybercriminals hacking into social media and online accounts of adults and children to steal explicit images and videos. These stolen materials are then used for blackmail, sold on criminal marketplaces, or shared with other criminals to facilitate further sextortion, with student-athletes and young boys frequently targeted.
Mozilla Replaces GPG Signing Key for Firefox and Thunderbird After Accidental Exposure
Mozilla has replaced the GPG signing subkey used for Firefox and Thunderbird Linux tarballs, RPM packages, and checksum files. The previous key was inadvertently committed in an unencrypted copy to a private GitHub repository. This change primarily affects users who manually verify GPG signatures or use Firefox RPM packages on older Linux distributions, who will need to import the new key and the old key's revocation.
UNC6671 Extortion Group Rebrands and Continues Vishing Attacks on Financial Firms
The UNC6671 extortion group has rebranded its operations under new names including Redact, Pink, Helix, and Falcon, despite an alleged retirement of its previous BlackFile brand. The group continues to use voice phishing (vishing) to target enterprise employees, particularly in financial services, private equity, and professional services, leading to data theft from cloud environments like Microsoft 365 and Okta.
Apple Implements Bug Report Caps Due to Surge in AI-Generated Submissions
Apple has introduced a cap on open security reports and a 30-day cool-off period for submissions to its bug bounty program, effective June. This change was made in response to a significant increase in AI-assisted reports, many of which were not genuine vulnerabilities, leading to review teams being overwhelmed. The new policy impacted Italian cybersecurity company Bynario, which used GPT-5.5 to find a critical macOS bug (CVE-2026-43760) but was initially unable to report it due to reaching the submission limit.
Over 24,000 Internet-Exposed Servers Leak BMC Password Hashes via Decades-Old Flaw
More than 24,000 internet-exposed servers are leaking authentication password hashes due to CVE-2013-4786, a 20-year-old vulnerability in the Intelligent Platform Management Interface (IPMI) v2.0 specification. This flaw allows remote attackers to obtain password hashes before login and conduct offline password guessing attacks, potentially leading to full control over physical servers and broader management plane compromise.
Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts
Hackers are redirecting users to fake Microsoft 365 login pages by changing DNS settings on Wi-Fi devices in hotels and conference centers. This campaign, ongoing since June, affects organizations across various sectors by potentially compromising sensitive business information.
Origin Energy Confirms Customer Data Breach Affecting Personal and Partial Banking Details
Origin Energy confirmed a data breach affecting its 4.8 million customer accounts, compromising personal details and partial banking information. This incident exposes customers to potential identity theft and phishing, highlighting ongoing cybersecurity risks for critical service providers.
Symlink Vulnerability in AI Coding Assistants Poses Security Threat
Researchers discovered that a vulnerability in six AI coding assistants allows malicious repositories to execute code on developers' machines. By exploiting symbolic link (symlink) flaws, attackers could bypass user consent and access sensitive files, raising significant security concerns.
Adobe Acrobat Integration in WhatsApp Web Exposes User Data Through Chrome Extension Vulnerability
Adobe Acrobat tools are now available within WhatsApp Web and Windows app, allowing users to handle PDFs easily. However, a critical vulnerability in the Adobe Acrobat Chrome extension, affecting 329 million users, could enable unauthorized access to WhatsApp Web chats. The flaw has been patched, ensuring data security moving forward.
Researcher Releases Windows Zero-Day Exploit 'LegacyHive' Post-Patch Tuesday
Security researcher Chaotic Eclipse released a zero-day exploit for Windows shortly after Microsoft's Patch Tuesday. The exploit, called LegacyHive, targets the Windows User Profile Service and allows privilege escalation on all supported Windows versions. This revelation underscores ongoing security challenges and may necessitate urgent updates from Microsoft.
AliExpress Fined €550 Million for Selling Counterfeit and Unsafe Products
AliExpress has been fined €550 million ($629 million) by the European Commission for failing to prevent the sale of illegal and counterfeit products, marking the largest fine under the Digital Services Act. The investigation revealed shortcomings in product verification and removal processes, posing risks to consumer safety. This fine underscores the EU's commitment to stringent e-commerce regulations.
San Francisco Orders Apple and Google to Remove Nudify Apps for Legal Violations
San Francisco City Attorney David Chiu ordered Apple and Google to remove 13 nudification apps from their app stores, citing violations of California laws against deepfake pornography. The apps are accused of creating non-consensual explicit images, which impact women and minors. The city claims the companies have profited from these apps and warns of potential civil penalties if they do not comply within 28 days.
US Charges Russians for Operating 'Bulletproof' Hosting Services Linked to $62M in Cybercrime Losses
U.S. prosecutors have unsealed charges against three Russian nationals linked to bulletproof hosting providers Media Land and ML.Cloud. The Russians allegedly supported ransomware attacks through these services, causing over $62 million in damages. A $10 million reward is offered for information leading to their arrests.