Security · Top stories
Researchers Demonstrate WiFi Networks Can Identify Individuals with Near-Perfect Accuracy
Researchers at Karlsruher Institut für Technologie (KIT) have demonstrated that ordinary WiFi networks can identify individuals with nearly 100% accuracy using unencrypted signals, even without cameras or connected devices on the person. This development reveals a significant privacy risk, as widespread WiFi infrastructure could become a tool for surveillance by various entities.
Coin-sized device can hack Boeing 737 Flight Management Computer via accessible port
Researchers developed a coin-sized device that can connect to an easily accessible diagnostic port on a Boeing 737, allowing it to override signals between the Multipurpose Control Display Unit (MCDU) and the Flight Management Computer (FMC). This device can intercept, alter, and spoof critical flight data, including takeoff weights and air temperature readings, and can be controlled remotely via in-flight Wi-Fi. The vulnerability highlights a potential security flaw in commercial aircraft avionics systems that could be exploited by individuals with physical access to the aircraft.
Microsoft releases 419 security fixes, including 3 zero-days, amid AI-driven bug surge
Microsoft released patches for 419 security vulnerabilities, including three zero-days, marking one of its largest monthly counts. This surge in discovered flaws is attributed to the increasing use of AI in vulnerability discovery, leading to a significant increase in the number of issues security teams must address.
AI Meeting App tl;dv Exposes Over 181,000 Meeting Recordings and Live Calls
The AI meeting recording platform tl;dv has a critical vulnerability in its Firestore database, allowing any authenticated user to access over 181,000 past meeting recordings and join approximately 1,000 live calls without invitation. This exposure of sensitive meeting content, including sales calls, job interviews, and internal strategy sessions, poses a significant privacy and security risk to its over 2 million users.
CISA Warns of Active Exploitation of Critical Progress Kemp LoadMaster Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that a critical command injection vulnerability (CVE-2026-8037) in Progress Kemp LoadMaster is being actively exploited by attackers. This flaw allows unauthenticated attackers to execute arbitrary commands on affected LoadMaster appliances, which are widely used by tech companies and government entities for traffic distribution and application performance.
Critical Flaws Found in Belgian eID Software Affecting 2 Million Users
Security researcher James Arnott discovered critical vulnerabilities in Connective digital identity software, used by over two million people in Belgium for digital identity authentication and electronic signatures. These flaws allowed malicious websites to read eID details, trick users into revealing PINs, forge electronic signatures, and execute remote code, impacting the trust model of Belgium's digital ecosystem.
UK children report surge in explicit deepfakes, exceeding previous year's totals
The UK's Report Remove service has seen a significant increase in reports from children regarding explicit deepfake images of themselves, with 420 reports in the first six months of this year, surpassing the total for the previous year. This rise highlights the growing concern over the misuse of readily available AI tools for creating child sexual abuse material (CSAM) and the challenges in preventing such online manipulation.
Linux Kernel Open vSwitch Flaw Allows Local Root Privilege Escalation
A memory corruption vulnerability, CVE-2026-64531 (OVSwrap), in the Linux kernel's Open vSwitch datapath allows local users to gain root privileges on default-configured distributions. This flaw affects systems where the OVS kernel datapath is available and unprivileged user namespaces are enabled, with a public exploit already existing.
AI Weaponizes Dangling DNS Takeovers, Expanding Attack Surface and Automation
Security firm Silent Push demonstrated how AI can significantly scale 'dangling DNS takeover' attacks, a method where attackers exploit forgotten DNS records pointing to deleted cloud resources. This research, dubbed 'DangleGeddon', shows AI's capability to automate discovery, script generation, and exploitation, making these attacks a more potent threat for nation-state actors focused on disruption.
Critical FFmpeg Vulnerability "PixelSmash" Allows Remote Code Execution via Crafted Video Files
JFrog Security Research disclosed "PixelSmash," a critical vulnerability (CVE-2026-8461) in the FFmpeg media framework that allows remote code execution (RCE) and denial of service (DoS) attacks. This flaw, present for sixteen years, enables attackers to execute arbitrary code or crash applications by delivering a specially crafted media file, impacting a wide range of desktop, server-side, and embedded systems that use FFmpeg.
Research reveals 69% of enterprises expose AI agents through shared API keys
VentureBeat's research indicates that 69% of enterprises utilize shared API keys across multiple AI agents, increasing security risks. This finding has contributed to significant acquisitions in the security sector, with over $22 billion invested to counteract these vulnerabilities.
North Korean Kimsuky Group Compromises South Korean Software Vendors and Customers
The North Korean Kimsuky group (APT43) compromised South Korean collaborative-work software vendors and subsequently breached their customers in a campaign spanning 2025 and early 2026. The attacks involved remote code execution, social engineering, and malware deployment to steal customer server information and employee credentials, highlighting persistent state-sponsored supply chain threats.
Windmill Security Flaw Exploited to Access Sensitive Server Files
A high-severity security vulnerability (CVE-2026-29059) in Windmill allows unauthenticated attackers to read arbitrary server files. The flaw, related to path traversal in the 'get_log_file' endpoint, has been actively exploited, exposing sensitive information across 170 vulnerable systems worldwide.
Oracle Patches 1,449 Vulnerabilities in July 2026 Security Update
Oracle released its July 2026 Critical Patch Update, addressing 1,449 vulnerabilities across 334 products, many identified using AI. With around 600 patches allowing remote exploitation, organizations are urged to update immediately to mitigate the risk of attacks.
Flaw in Azure DevOps MCP Allows AI Review Hijacking via Hidden Comments
A vulnerability in Azure DevOps MCP allows hidden comments in pull requests to manipulate AI coding agents, granting unauthorized access to source code and secrets. This flaw exposes a critical gap in Microsoft's prompt-injection safeguards, risking information leakage during code review processes.
Federal Reserve alerts on Anthropic's Mythos AI but lacks access for months
The Federal Reserve expressed concerns about Anthropic's Mythos AI model, which can identify cybersecurity vulnerabilities in financial institutions. Despite the alarm, the Fed reportedly lacked access to Mythos for over three months, leaving it exposed while other banks patched their issues.
Trump Executive Order Mandates Mapping of Defense Supply Chains for Cybersecurity
President Trump signed an executive order requiring the mapping and securing of critical defense supply chains, emphasizing software and technology used in national security. This initiative aims to enhance visibility and security against cyber and economic threats across all tiers of suppliers, impacting both prime and subcontractors.
AWS Kiro Flaw Allowed Remote Code Execution via Malicious Web Pages
A vulnerability in AWS's Kiro IDE enabled attackers to execute code on a developer's machine by altering its configuration file. This flaw, discovered by Intezer and Kodem Security, bypassed the required user approval for risky actions and has since been patched, though no CVE has been assigned.
France's ANSSI to Certify Only Quantum-Resistant Products from 2027
France's national cybersecurity agency, ANSSI, will cease certifying security products without quantum-resistant encryption starting in 2027. This policy is intended to enhance cybersecurity against quantum threats and promotes the development of a quantum-safe technology market.
CISA Issues Guidance on Zero Trust for Critical Infrastructure Security
CISA has released new guidance emphasizing the implementation of Zero Trust principles in critical infrastructure security. This guidance aims to mitigate threats from state-sponsored actors exploiting identity vulnerabilities, especially in operational technology environments.
US military apps found with Chinese and Russian code raise data security concerns
A study found that over 12% of mobile apps aimed at US military personnel contain code from Chinese and Russian companies, increasing risks of data harvesting by adversary nations. This poses potential risks to service members' safety and operational security, particularly as previous investigations highlighted vulnerabilities in location tracking of troops.
AI Speeds Up Exploit Development Post-Patching, Threatening Cybersecurity
Anthropic's AI, Claude Mythos, can reverse-engineer patches into exploits in under an hour, disrupting traditional timelines for vulnerability exploitation. This significant shift means defenders have far less time to secure systems before attackers can exploit known vulnerabilities, raising serious concerns about the effectiveness of current patching strategies.
Researchers Present Bit2Watt Attack Threatening Power Grids via Cloud GPUs
Three researchers from Zhejiang University revealed the Bit2Watt attack, enabling cloud tenants to destabilize power grids using GPU workloads without requiring exploits. This method poses a significant risk as it leverages legitimate compute functions to create controlled power oscillations that can threaten infrastructure stability.
Violent Online Network '764' Linked to Youth Criminality Across Multiple Countries
A 14-year-old boy in Sweden was linked to an online network called 764, which promotes youth violence and extortion through games like Roblox and Minecraft. This network, founded by a Texas teen, is tied to a growing trend of victims becoming perpetrators under online influence, highlighting systemic issues across global digital communities.
U.S. Executive Order Mandates Post-Quantum Encryption by 2030
President Trump signed Executive Order 14412, requiring federal agencies to transition to post-quantum encryption by December 31, 2030, and authentication by December 31, 2031. This move addresses the imminent threat quantum computing poses to traditional cryptographic systems, stimulating the broader tech industry's shift towards post-quantum technologies.
Meta's AI support assistant exploited for 20,000 account takeovers
Attackers hijacked over 20,000 Instagram accounts using Meta's AI assistant without exploits or password guessing. The assistant confirmed operations based on an interaction, highlighting vulnerabilities of AI agents in authorization processes.
Oshkosh Cancels Flock Safety Contract After False Statements by Company
The Oshkosh City Council revoked its contract with Flock Safety after the company falsely claimed its ALPR system did not create heat maps of vehicle movements. This incident highlights a broader pattern of misleading statements from Flock regarding its technology and privacy practices, raising significant concerns over its credibility in the law enforcement technology sector.
Ostium platform suffers $23.7M theft in off-chain attack
Ostium trading platform experienced a $23.75 million theft due to price manipulation via compromised off-chain infrastructure. The incident has halted trading operations as the platform works on security measures and assessing impacts for liquidity providers.
Four AI coding agents affected by sandbox escape vulnerabilities
Security researchers have demonstrated sandbox escape vulnerabilities in Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity. These vulnerabilities exploit file interactions that allow the sandboxed agents to trigger commands outside their protected environment, highlighting significant security shortcomings in AI coding tools.
Taiwan indicts ex-TSMC manager over alleged leakage of chip secrets to China
Taiwanese prosecutors indicted a former TSMC deputy manager for allegedly stealing 21 confidential chip technology documents to share with a Chinese firm. This case, the first under Taiwan's National Security Act related to core semiconductor technologies, highlights continuing concerns about industrial espionage amid heightened geopolitical tensions.
Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic Computers
A Russian-speaking hacker named 'bandcampro' leveraged Google's open-source Gemini CLI to control a botnet consisting of eight PCs at a dental clinic. This incident highlights the evolving use of AI in cybercrime, enabling sophisticated operations that can rapidly adapt and proliferate.
SleeperGem Malicious RubyGems Target Dev Machines in Supply Chain Attack
A new cyber attack, codenamed SleeperGem, has been identified, affecting the Ruby ecosystem through three malicious RubyGems. This attack poses a significant risk to developers by potentially compromising their machines and extending to other packages.
F5 Releases Patches for Critical NGINX Vulnerability Allowing Remote Code Execution
F5 has released security patches for a critical vulnerability in NGINX (CVE-2026-42533) that allows remote attackers to trigger a heap buffer overflow, potentially leading to remote code execution and denial of service. This vulnerability affects numerous NGINX versions and some configurations, which could expose many installations unless updated.
Texas Police Acquire FalcoNet Surveillance System for $4.5 Million
Texas State Police purchased four FalcoNet-equipped Chevrolet Tahoes for $4.5 million to enhance surveillance capabilities. This technology, capable of intercepting mobile phone communications, raises significant concerns over privacy and data collection on civilians.
Hackers Target Russian Government Agencies via ViPNet Software Abuse
A threat actor is exploiting ViPNet's update mechanism to deploy malware against Russian organizations, including government agencies. The campaign, named HelloNet, impacts multiple sectors and reflects ongoing vulnerabilities in widely used security products.
Fraudsters Target X Accounts with Fake Login Alerts
Fraudulent emails impersonating X notify users of suspicious logins from unfamiliar devices. Clicking links in these emails can lead to credential theft, putting users' accounts at risk for scams.
Analysts Raise Concerns Over Cybersecurity Risks of Over-the-Air Tech in Automobiles
The growing use of over-the-air (OTA) technology in vehicles poses cybersecurity risks, with analysts urging intervention. This technology, while efficient for vehicle updates, may expose automotive systems to potential foreign cyber threats and national security issues.
TP-Link Kasa cameras leaked GPS for six years; vulnerabilities now patched
TP-Link's Kasa Spot EC71 cameras exposed home GPS data via unauthenticated UDP for six years. A patch in firmware version 2.4.1 remedied significant security vulnerabilities that compromised user data.
Seven Malicious Vite npm Packages Employ Blockchain C2 for RAT Delivery
Seven malicious npm packages targeting the Vite ecosystem have been uncovered, linked to a software supply chain attack dubbed ViteVenom. The packages employ a complex blockchain-based command-and-control system, enhancing their stealth and effectiveness in delivering a remote access trojan.
NadMesh Botnet Targets Exposed AI Services for Cloud Credentials
NadMesh, a Go botnet, was discovered targeting exposed AI services in cloud environments, claiming over 3,800 AWS keys. The botnet systematically scans platforms like ComfyUI and n8n to extract cloud credentials and Kubernetes tokens, posing significant security risks to cloud deployments and AI tools.