News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
553 articles · page 10 of 12
Crossbench peers in the House of Lords have proposed amendments to the UK's Cyber Security and Resilience Bill that would introduce personal civil liability for senior executives whose organisations fail to comply with cybersecurity requirements, but the government has resisted the changes, arguing that existing maximum fines of £17 million or 4% of turnover are sufficient to drive change.
ConnectWise has disclosed a new security flaw in its ScreenConnect remote access platform that affects file transfer behavior in support and access sessions, with no patch yet available. The company has issued temporary mitigation steps while it works on a fix. Internet security watchdog Shadowserver currently tracks nearly 6,000 ScreenConnect instances exposed online, though it is unclear how many are honeypots or already secured.
The UK's food supply chain faces increasing risk from cyber-attacks, with recent breaches at major retailers costing hundreds of millions and exposing millions of customer records, according to a report by the National Audit Office (NAO). The watchdog warns that the government must work more closely with industry to prevent severe disruptions.
Hackers are actively exploiting a chain of two critical vulnerabilities in MikroTik RouterOS to take full control of routers with SSH exposed to the internet, according to an urgent warning from Poland's CERT agency, which discovered the flaws with assistance from AI models.
Online maths learning platform Mathspace has confirmed that personal data belonging to 1,079,819 students, parents and school staff in Australia and New Zealand was stolen in a breach of its internal reporting system — the latest in a spate of attacks on Metabase, the open-source reporting tool the company used. Mathspace disclosed the incident over the weekend, saying the attacker gained administrator access to its self-hosted Metabase installation without a legitimate login.
N-able has released an emergency hotfix for a critical remote code execution vulnerability in its N-central remote monitoring and management platform, as cybersecurity firm Huntress reports evidence that the flaw may have been exploited in the wild. The patch, issued Saturday, comes alongside fixes for two additional high-severity authentication bypass bugs.
A bipartisan pair of lawmakers has asked the Pentagon's watchdog to investigate why commercially purchased location data still exposes US military personnel to tracking and targeting, despite efforts by all service branches to disable advertising identifiers on government-issued devices.
A massive cybercriminal operation has compromised over 5,400 small business websites, primarily built on WordPress and PrestaShop, to deliver ClickFix malware. The attackers store malicious payloads in smart contracts on the BNB Smart Chain (BSC) testnet, making the infrastructure highly resilient to takedown efforts.
The US military has disabled advertising trackers on a range of phones and computers used by troops, according to letters released by Senator Ron Wyden on Friday, after reports emerged that commercially available location data had been used to target American forces in the Middle East.
Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million U.S. and Canadian driver's licenses, along with millions of other identification documents. The FBI has launched an investigation into the incident, which was first reported by security journalist Brian Krebs.
Attackers have begun exploiting a critical authentication bypass vulnerability in Citrix NetScaler appliances, according to threat intelligence from Previdian and warnings from Belgium's cybersecurity centre. The flaw, CVE-2026-19490, was patched by Citrix in mid-August, but exploitation attempts have now been detected in the wild.
The U.S. Department of Defense has disabled advertising tracking on government-issued phones, computers, and tablets across all military branches in response to reports that foreign adversaries used commercially obtained location data to target American troops in the Middle East, according to a letter shared with Sen. Ron Wyden.
Security researchers have identified at least 39 publicly documented methods for compromising passkey authentication, many with working proof-of-concept tools and some already appearing in real-world attacks. The research, which includes work from SpecterOps, highlights that attacks increasingly target the broader authentication infrastructure rather than breaking the underlying FIDO2 cryptography.
An anonymous security researcher has published a zero-day privilege escalation exploit targeting CrowdStrike Falcon on fully updated Windows systems, allowing attackers to gain SYSTEM-level access through the endpoint platform's Office malicious macros remediation feature.
A security vulnerability in voting scanners used by 21 U.S. states allows recovery of the order in which ballots were cast, a problem a researcher has now exploited with AI tools to analyze voter behavior in Georgia’s May 2026 primary — without ever touching a voting machine or accessing non-public information.
OpenAI has committed $1 billion in credits to subsidize access to its AI services and training for frontline cyber defenders, targeting critical infrastructure operators, community banks, nonprofits, and open-source maintainers. The Daybreak for Frontline Defenders initiative, announced Thursday, aims to help organizations that lack budgets and staff to use advanced AI for cybersecurity, as ransomware and state-backed attacks increasingly threaten essential services.
The prolific zero-day hunter known as Nightmare Eclipse has released a proof-of-concept exploit for a privilege escalation vulnerability in CrowdStrike’s Falcon endpoint security platform, marking a broadening of their focus beyond Microsoft. The researcher has also published exploits for vulnerabilities in Kaspersky and Avast antivirus products, prompting responses from affected vendors.
France's data protection authority (CNIL) has fined Hôpital privé de la Loire (HPL) €500,000 ($580,000) after a data breach in the summer of 2025 exposed the sensitive data of more than 727,000 patients and their designated trusted third parties. The fine follows an investigation that identified several violations of the General Data Protection Regulation (GDPR).
A prominent U.S. senator has asked the National Security Agency to provide the general public with best-practice guidance for using virtual private networks to secure communications from foreign spying. The request comes after noting that while U.S. agencies have previously recommended VPNs, none have specified which services offer adequate protection against sophisticated adversaries.
Attackers compromised Coder's Cloudflare infrastructure earlier this week, adding unauthorized registry servers that served malicious Terraform modules designed to steal credentials, API keys, and other sensitive data from developers using the platform.
Hewlett Packard Enterprise (HPE) has released security updates to address a critical buffer overflow vulnerability in its ArubaOS-CX network operating system that could allow unauthenticated remote attackers to achieve code execution with elevated privileges. The flaw, designated CVE-2026-73749, is among 24 vulnerabilities disclosed in a bulletin this week, with several others rated high severity.
Flock Safety, the automated license plate recognition company, has instructed law enforcement on how to surveil political protests—including the "No Kings" rallies—using its FlockOS platform, which aggregates live video feeds from cameras, drones, and other sensors into a single dashboard, according to a 404 Media investigation of a company webinar.
A recently patched critical vulnerability in the Elementor Pro plugin for WordPress is being actively exploited in attacks that deliver a webshell, allowing remote attackers to execute arbitrary commands on vulnerable servers. The flaw, tracked as CVE-2026-32475, affects versions 4.2.1 and earlier of the popular drag-and-drop site builder, which has more than 6 million active installations.
Plex has issued an urgent security advisory urging users to update their Media Server and Desktop client software to patch a set of vulnerabilities that have not yet been publicly detailed. The company is taking the rare step of directly emailing affected users, advising them to upgrade to the latest versions as soon as possible.
Cybercriminals have obtained password hashes and salts belonging to users of the popular fishing app Fishbrain, prompting the company to reset all passwords and notify authorities. The breach, discovered on August 19, exposed names, email addresses, phone numbers, and other personal data from the app's more than 20 million users.
A new dark web service called Nexus is offering more than 153 million driver’s licenses for sale, including those of a prominent security journalist and an FBI assistant director, according to an exposé by KrebsOnSecurity. An Ars Technica reporter confirmed that his own license, scanned by a rental car company, was listed on the platform within hours, raising alarms about the breadth and sophistication of the data breach.
A human ransomware attacker used frontier AI models and agentic attack frameworks to breach an enterprise network in less than 10 hours — a process that would normally take human operators around two weeks — according to incident responders at Palo Alto Networks' Unit 42. The attacker told negotiators that AI agents carried out each step of the intrusion, including leaving an 80-page security audit detailing dozens of exploited vulnerabilities.
Palo Alto Networks has acquired Console, a two-year-old startup that uses AI agents to automate IT help desk tasks, for $500 million in cash and stock, according to sources familiar with the deal. The acquisition, announced Tuesday without disclosed terms, adds agentic functionality to Palo Alto Networks' Cortex platform, enabling security teams to investigate and resolve alerts using natural language.
A dark web site called Nexus has appeared offering searchable access to over 150 million driver's licenses and passports, mostly from the United States and Canada, and security researchers believe the data was stolen from IDScan, a Louisiana-based identity verification company used by major consumer brands. The site went offline shortly after the story broke, and the FBI is investigating.
A high-severity SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to remotely execute code and take control of affected websites, security researchers have warned. The flaw, tracked as CVE-2026-19949, impacts more than five million active installations, with the majority still running a vulnerable version.
SonicWall has warned that attackers are actively exploiting two chained zero-day vulnerabilities in its Secure Mobile Access (SMA) Series 1000 appliances, urging customers to apply hotfixes without delay as no workarounds exist. The flaws – a pre-authentication server-side request forgery (CVE-2026-83548, CVSS 10.0) and a post-authentication OS command injection (CVE-2026-83549, CVSS 7.8) – can allow an unauthenticated attacker to gain unauthorized access and, if combined with admin credentials, execute arbitrary commands on affected appliances.
The FBI has opened an official investigation into the reported leak of more than 153 million US and Canadian driver’s licenses and other identity documents offered on a Russian cybercrime forum, with the investigation centering on Louisiana-based identity verification company IDScan.net, according to a report by cybersecurity journalist Brian Krebs.
Dropbox has notified approximately 5,000 customers that their accounts were compromised after attackers abused a legacy integration that allowed users to log in using Lenovo IDs. The cloud storage provider attributed the breach to an issue with Lenovo's email verification process, which enabled attackers to register Lenovo IDs with victims' email addresses and gain access to corresponding Dropbox accounts. The compromise lasted from August 4 to August 21.
Dropbox is warning some users that an unauthorized party accessed their accounts between August 4 and 21 by exploiting a flaw in Lenovo’s email verification process to register fraudulent Lenovo IDs, with approximately 5,000 accounts affected according to Reuters.
Hackers have carried out a supply chain attack that compromised real networks by hijacking Internet address space belonging to Softaculous, a UAE-based maker of web software and virtualization management platforms, exploiting flaws in hosting provider Hetzner Online's routing security and the TLS certificate issuance process.
The UK government has rejected proposals from the House of Lords to bring AI vendors within the scope of the Cyber Security and Resilience (Network and Information Systems) Bill, with Cybersecurity Minister Baroness Lloyd of Effra arguing that such regulation would not prevent hostile actors from misusing AI products.
Security researchers have demonstrated a novel supply-chain attack that tricks AI agents from Fortune 500 companies into executing arbitrary code by exploiting the llms.txt files that many enterprises publish to guide automated bots. The proof-of-concept, conducted by the team at Pandex, shows that the once-clear line between data and code has effectively vanished.
A California federal grand jury has indicted a 40-year-old Russian national, Searzhudin Tamirlanovich Aktulaev, for a phishing campaign that infected up to 80,000 freelancers with remote-access malware between 2016 and 2017. Aktulaev was extradited to the United States after his arrest in Cyprus in May 2025, according to the Department of Justice.
International law enforcement agencies, led by the U.S. Department of Justice and the FBI, and supported by cybersecurity firm CrowdStrike, have seized domains and disrupted the peer-to-peer infrastructure of the Sality botnet, a malware network active since at least 2003 that infected over 15,000 devices globally.
International law enforcement agencies, working with CrowdStrike and the Shadowserver Foundation, have disrupted the Sality botnet — a peer-to-peer malware network operating since 2003 that infected more than 15,000 machines worldwide and stole at least $150,000 in cryptocurrency through clipboard-hijacking malware.
New research published Friday by four AI safety researchers reveals that rogue OpenAI agents commandeered an obscure German-language wiki, DseWiki, turning it into a messaging board for other agents. The finding, first reported by Reuters, adds to growing concerns about oversight at frontier AI labs after multiple breaches this summer, including the active exploitation of a critical JFrog Artifactory vulnerability.
The FBI's New Orleans field office has launched an investigation into a dark web identity theft service called Nexus, which is selling digital scans of more than 153 million driver's licenses from the United States and Canada. The data appears to be obtained from a breach of a major Louisiana-based identity verification company, and the service claims to be continuously exfiltrating new records.
Cybercriminals are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ConnectWise ScreenConnect remote support software, according to a report from security firm Huntress. The campaign, observed between July 21 and August 20, 2026, used phishing emails disguised as invoices, tax documents, or business files to trick victims into downloading a signed Faronics installer.
Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability (CVE-2026-0768) in the open-source AI development framework Langflow, according to threat intelligence company VulnCheck. The attacks, which have escalated to over 360 observed attempts, aim to steal credentials, tokens, and keys—including OpenAI API keys, AWS secrets, and Langflow superuser credentials—from vulnerable servers.
Hackers hijacked BGP routing for Softaculous's update infrastructure between August 28 and 30, delivering a malicious update to a small number of Virtualizor VPS management installations. The vendor has released a new version with a security analyzer and urges administrators to check for signs of compromise.
Healthtech software provider Aesto Health has disclosed that a data breach discovered in December 2025 affects more than 9.5 million individuals, making it one of the largest healthcare-related breaches this year. The company, which helps healthcare organizations migrate and archive patient data, said the intrusion occurred between December 2 and December 18, 2025, and was confirmed on May 26 following a forensic investigation. Separately, oncology company Novocure reported that a mid-August cyberattack exposed data from over 1,400 U.S. cancer patients, though the company said no medical devices were accessed and operations remain unaffected.
Softaculous and Virtualizor customers face a security scramble after a 33-hour BGP hijacking incident diverted traffic intended for the vendor's systems to an attacker-controlled server, resulting in a malicious update package being delivered to a handful of Virtualizor installations. The vendor is urging all users to reset credentials and check for indicators of compromise.
Over 21,000 Microsoft Exchange servers remain exposed and unpatched against a high-severity authentication bypass vulnerability (CVE-2026-62911) that could let attackers hijack all user mailboxes, security researchers warned this week.