Security · Top stories
Grindr to pay £26M to settle claims of sharing user HIV status and personal data
Grindr has agreed to pay £26 million to settle a class-action lawsuit alleging it shared users' personal information, including HIV status, with third parties before 2020. This settlement addresses claims of privacy breaches and misuse of sensitive data, highlighting the ongoing legal and ethical challenges faced by tech companies regarding user data protection.
Attackers Exploit MikroTik Routers via Internet-Exposed SSH for Unauthorized Access
Attackers are exploiting MikroTik routers with internet-exposed SSH services to gain full administrative control without authentication, according to CERT Polska. MikroTik has released security updates for RouterOS to address these vulnerabilities, and users are advised to install them immediately.
China-Linked Fire Ant Group Compromises Cisco Routers to Steal Credentials and Blind Logs
The China-nexus cyber espionage group Fire Ant has expanded its operations to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts. This allows the group to capture network traffic, steal credentials, and disable security logging, providing a vantage point into high-value networks, including critical infrastructure.
Venezuelan National Sentenced to 8 Years for ATM Jackpotting Scheme
A Venezuelan national received an 8-year federal prison sentence for his involvement in an ATM jackpotting scheme that resulted in over $3.5 million in losses. This sentence is reportedly the longest federal term for an individual's role in ATM jackpotting, highlighting ongoing efforts to combat this type of financial crime.
Large DDoS Attack Disrupts Norwegian Government Services for Over a Day
A large-scale distributed denial-of-service (DDoS) attack targeted the infrastructure of Norway's Digitalisation Agency (Digdir), disrupting multiple public services for over 24 hours. This incident highlights the vulnerability of critical government digital infrastructure to cyberattacks and the potential for widespread disruption to citizen services.
Ring Introduces New TAKE Encryption as Default for All Cameras
Ring, an Amazon-owned company, has implemented a new encryption method called TAKE (Throw Away the Key Encryption) that will become the default for all Ring cameras starting in September. This change limits Ring's ability to provide video footage to law enforcement while still supporting smart features like AI-powered alerts and video search.
Global Cybercrime Crackdown Arrests 58, Identifies 263 Suspects in Operation Jackal IV
Law enforcement agencies from 22 countries arrested 58 individuals and identified 263 suspects linked to cybercrime networks, primarily targeting West African groups like Black Axe, during "Operation Jackal IV." This operation disrupted financial fraud schemes, including romance and investment scams, and highlighted the use of Crime-as-a-Service by these syndicates.
Hackers Exploit miniOrange SAML SSO WordPress Plugin Vulnerabilities
Hackers are actively exploiting two critical authentication bypass vulnerabilities, CVE-2026-61979 and CVE-2026-15981, in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. These flaws allow attackers to forge SAML responses and gain administrative access, impacting sites that did not update due to incomplete vendor advisories.
Head Mare Exploits TrueConf Server Flaws to Distribute Backdoored Client Installers
The hacktivist group Head Mare exploited vulnerabilities in unpatched TrueConf video conferencing servers to replace legitimate client installers with malicious versions containing PhantomCore and PhantomGraph backdoors. These attacks, discovered by Kaspersky in July, targeted Russian organizations across various sectors, allowing attackers to gain persistent remote access and exfiltrate data.
Senators Question TikTok Over Experiment Disabling Safety Features for 15 Million Users
Senators Marsha Blackburn (R-TN) and Richard Blumenthal (D-CT) have demanded answers from TikTok regarding an experiment that disabled an algorithmic safety feature for 15 million U.S. users, including minors. This safeguard, designed to prevent exposure to harmful content, was reportedly withheld to assess its impact on user engagement, raising concerns about user protection.
Over 14,500 Dahua Devices Compromised via Credential Attacks, Auth Bypasses, and P2P
Cybersecurity researchers at Hunt.io uncovered "Operation CameraSwarm," which compromised over 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws (CVE-2021-33044 and CVE-2021-33045), and a P2P relay technique. This compromise highlights the ongoing risk posed by unpatched vulnerabilities and weak credentials in IoT devices, particularly in critical infrastructure or surveillance contexts.
New Interrupt Injection Attack Bypasses Spectre v2 Defenses on Intel and AMD CPUs
Researchers have discovered a new attack, named Interrupt Injection or TONTOU, that bypasses existing Spectre v2 mitigations on Intel and AMD CPUs. This vulnerability allows an unprivileged local attacker to leak kernel memory, such as Linux password hashes, by exploiting a timing window during branch predictor neutralization. AMD has released a kernel patch for Linux, while Intel states no mitigation is necessary.
US Charges 17 Iranian Hackers, Offers $10 Million Rewards for Five Individuals
The US has charged 17 members of Iran's Mabna Institute for hacking into hundreds of organizations globally, including universities, companies, and government agencies. This action highlights ongoing cyber espionage efforts attributed to state-sponsored groups and the US government's response to intellectual property theft.
Shell investigates potential data theft after Clop ransomware gang claims 89GB stolen
Shell is investigating a potential security incident after the Clop ransomware gang claimed to have stolen 89GB of data, including engineering drawings and project plans. This incident is linked to the exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM instances, a vulnerability that CISA has confirmed is actively exploited.
City-Forum Campaign Targets Salesforce and ServiceNow Guest Users with Custom Tools
A campaign named 'City-Forum' is exploiting guest user access in Salesforce Experience Cloud (Aura and LWR implementations) and ServiceNow customer portals to steal data. The attacks use a custom multi-platform toolset and target telecommunications, banking, financial services, enterprise software vendors, and public-sector portals globally.
Apple Releases Emergency Fix for macOS Screen Sharing Vulnerability
Apple has issued an urgent software update for macOS to patch a critical vulnerability in the Screen Sharing feature. This flaw could allow an attacker to gain unauthorized access and control over a Mac without needing valid credentials, posing a significant security risk.
French Tax Authority Investigates Data Breach After Hacker Claims 600,000 Victims
France's Directorate General of Public Finances (DGFiP) confirmed a data breach in late June where an attacker accessed and extracted data on individuals and businesses. The incident became public after a hacker claimed responsibility, stating they obtained data on over 600,000 people, including personal and tax identification information.
New Mirai Variant "Evooo1Bot" Adds Stealth and Proxy Capabilities to Botnet Code
A new Mirai botnet variant, dubbed Evooo1Bot, has been actively exploiting vulnerabilities in internet-facing hardware for at least a month, according to FortiGuard Labs. This variant includes enhanced stealth features like SSH honeypot detection and a SOCKS proxy function, allowing attackers to conceal their origin and pivot into internal networks. The added capabilities make Evooo1Bot more sophisticated than previous Mirai-derived malware, posing a greater threat to network security.
Plaintiff Used Hidden AI Prompt Injections in Court Filings to Influence Case Outcome
Matthew Elliott, a self-represented litigant in a Connecticut court, embedded hidden prompt injections in two official court filings against the New York Bariatric Group. These instructions, formatted in tiny white text, were designed to manipulate any AI model reviewing the documents to favor his position and were discovered due to unusual white space, leading to a show cause order from the judge.
Apple develops 'Reference Image' feature in iOS 27 to authenticate iPhone photos
Apple is developing a "Reference Image" feature, referenced in iOS 27 beta 5, to authenticate photos taken with an iPhone camera. This system aims to verify that an image originated from specific iPhone hardware and has not been altered, addressing concerns about AI-generated and manipulated media.
Russian Sandworm Hackers Target Ukrainian IT Workers with Malicious VPNs via Fake Job Offers
Russian military intelligence hackers, identified as Sandworm (UAC-0145), are posing as recruiters on Ukrainian job sites to trick IT professionals into installing malicious software. Active since at least May, the campaign aims to compromise systems by having victims download a modified VPN application during a fake recruitment process, allowing for command execution and further payload delivery.
OpenAI Expands Daybreak Cybersecurity Initiative with New Tiers and GPT-5.6-Cyber Model
OpenAI has expanded its Daybreak cybersecurity initiative, introducing Daybreak Blue and Daybreak Red tiers to provide specialized access to its AI models for defensive security work. The expansion includes a new AI model, GPT-5.6-Cyber, designed for advanced security testing and vulnerability research, addressing evolving AI-driven cyber threats.
Atlassian Rovo AI Vulnerabilities Allowed Data Exfiltration; One Fixed, One Remains
Atlassian's Rovo AI assistant had vulnerabilities that allowed data exfiltration from Jira and Confluence. One method, dubbed RovoBlast by Varonis Threat Labs, involved a one-click malicious link and has been fixed. Another method, discovered by PromptArmor, used indirect prompt injection via uploaded files and remains unconfirmed as fixed by Atlassian.
Framework Customer Data Exposed in Metabase Zero-Day Breach
Framework, a modular computer manufacturer, notified all customers that their names, email addresses, phone numbers, physical addresses, and login IPs were exposed in a data breach. The incident stemmed from a zero-day vulnerability in Metabase, a business intelligence provider used by Framework, which allowed unauthorized access to customer databases.
Telegram Briefly Removed from App Store Over CSAM, CEO Blames Extortionist
Apple briefly removed the Telegram messaging app from its App Store after discovering content violating guidelines against child sexual abuse material (CSAM). The app was restored after Telegram removed the offending content and banned the user responsible. Telegram CEO Pavel Durov stated that an extortionist planted the CSAM in a public chat to trigger the app's removal.
Anthropic's Claude Mythos AI Identifies Weaknesses in HAWK and Round-Reduced AES
Anthropic's Claude Mythos Preview AI model discovered new attack methods against the HAWK digital signature scheme and a faster attack on seven-round AES-128. The HAWK scheme, a candidate for post-quantum standardization, was subsequently withdrawn from NIST consideration by its developer. These findings demonstrate AI's capability in cryptanalysis, though neither attack affects current production systems.
Open Secure AI Alliance Proposes SAFE Guidelines for AI Cybersecurity Incident Sharing
The Open Secure AI Alliance (OSAA), comprising over 120 organizations including NVIDIA, Cisco, CrowdStrike, Hugging Face, and Red Hat, has proposed Shared AI Findings Exchange (SAFE) guidelines. These guidelines, released for public comment by the Linux Foundation at the Black Hat conference, aim to standardize the confidential collection, analysis, and sharing of agentic AI cybersecurity incidents to reduce systemic risks across the industry.
Adform Ad Platform Compromised to Steal Cryptocurrency via Malicious JavaScript
Online advertising firm Adform experienced a supply-chain attack where its JavaScript tracking script, 'trackpoint-async.js' served from 's2.adform.net', was compromised. The malicious code replaced Bitcoin, Ethereum, or TRON wallet addresses copied to users' clipboards or entered into form fields with attacker-controlled addresses, potentially redirecting cryptocurrency payments. Adform detected the incident on July 27, 2026, removed the code, and notified clients.
UK Police and Education Data Breached by ExfilSquad, Ransom Demanded
The UK's Police National Legal Database (PNLD) and Department for Education (DfE) experienced separate data breaches, with the ExfilSquad extortion group claiming responsibility. The PNLD breach exposed contact information for over 100,000 police officers and criminal justice professionals, while the DfE incident involved over 600,000 lines of data from two portals. ExfilSquad is demanding a ransom for the data.
Amazon Attributes Multiple npm Package Hijacks to North Korea's Sapphire Sleet
Amazon Threat Intelligence has attributed the September 2025 hijacks of the npm packages debug and chalk, along with the March 2026 axios compromise and an earlier typo-crypto incident, to North Korea's Sapphire Sleet group. This attribution connects previously separate incidents of crypto theft and package compromise under a single threat actor, highlighting a consistent pattern of social engineering and supply chain attacks affecting widely used JavaScript libraries.
Ernst & Young Discloses Data Breach: Client Tax Information Compromised
Ernst & Young experienced a data breach via a third-party support system, compromising clients' personal and financial data. The breach, spanning March 28 to April 12, included sensitive tax information, with notifications sent to affected clients and state regulators. The incident underscores the vulnerabilities associated with third-party IT services.
Ransomware Payment Dilemma Intensifies Amid Sophisticated Threat Landscape
Ransomware attacks have surged, with nearly half of victims opting to pay attackers. Many jurisdictions, including the UK, are proposing bans on public sector ransom payments due to the inefficacy of negotiations and the risk of repeated attacks. Advanced AI tools and strategic targeting increase the threat level, complicating response strategies.
Fastjson 1.x RCE Vulnerability Actively Exploited, No Patch Available
Attackers are targeting a critical remote code execution (RCE) vulnerability in Alibaba's Fastjson 1.x library, affecting Spring Boot applications. The flaw, CVE-2026-16723, allows unauthenticated code execution and currently has no official patch from Alibaba for the 1.x branch. This impacts organizations using Fastjson 1.x in specific Spring Boot configurations, requiring immediate mitigation or migration to Fastjson2.
Apple Sued for $1.8M After Fake Crypto Wallet App Appears on App Store
Three individuals are suing Apple, alleging that a fraudulent Sparrow Wallet application downloaded from the App Store led to the theft of approximately $1.8 million in Bitcoin. The lawsuit, filed on July 24 in California, claims Apple failed to adequately review and monitor applications, despite promoting the App Store as a secure source for software.
Clop Ransomware Exploits PTC Windchill and FlexPLM Vulnerability for Data Theft
The Clop ransomware group is exploiting a critical vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM to exfiltrate data from targeted companies. This exploitation has led to extortion campaigns and prompted urgent warnings from cybersecurity agencies and authorities.
HollowGraph Malware Utilizes Microsoft 365 Calendars for C2 Communications
HollowGraph, a new malware, uses Microsoft 365 calendar events dated to 2050 for command-and-control and data exfiltration. This method disguises traffic as legitimate, targeting Israeli entities and linked to Iranian threat actors.
DOJ Seizes Over 1,000 Domains for Illegal World Cup Streaming
The U.S. Department of Justice seized and blocked over 1,000 domains during the World Cup for illegal streaming. This action aims to protect intellectual property and consumers from potential security threats associated with unauthorized streaming sites.
Critical ServiceNow Flaw Exploited Despite Patch Release
A critical remote code execution vulnerability (CVE-2026-6875) in ServiceNow's AI Platform is being actively exploited, allowing attackers to execute code remotely. Despite the July patches, attacks were observed shortly thereafter. This issue highlights the urgency for self-hosted customers to apply updates promptly to prevent system compromise.
OpenSSL HollowByte Flaw Exposes Servers to Memory Exhaustion with Minimal Payload
A vulnerability in OpenSSL, known as HollowByte, allows attackers to trigger a denial-of-service condition by sending an 11-byte payload. The flaw causes vulnerable servers to pre-allocate memory for incomplete TLS handshake messages. Fixed versions without official CVEs or advisories include OpenSSL 4.0.1 and others released on June 9. Upgrading is crucial to prevent potential server freezes.
Florida Man Arrested for Cryptocurrency Theft via Steam Game Malware
Zyaire Wilkins was arrested for allegedly using malware-laden games on Steam to steal $220,000 in cryptocurrency. The operation infected about 8,000 devices and targeted 80 crypto wallets from May 2024 to February 2026. This highlights security risks in digital distribution platforms like Steam.