Cybersecurity, cryptography, zero-trust architecture, and the battles securing our digital lives.
106 articles
CISA, the FBI and HHS said on August 18 that the Medusa ransomware-as-a-service operation has breached more than 500 critical-infrastructure organizations since June 2021. A day later, the agency ordered federal agencies to patch two actively exploited flaws in TrueConf Server within two weeks.
A China-nexus APT compromised 361 organizations across 47 countries within five days of a VMware vCenter patch release, while CISA added four critical vulnerabilities to its KEV catalog on August 18 and set an August 21 patch deadline for Federal Civilian Executive Branch agencies. The combined campaigns collapse the historical patch grace period to days rather than weeks.
CVE-2026-69836, an unauthenticated deserialization flaw in Microsoft's cloud identity service, carries a CVSS 10.0 score. Microsoft says the bug is already mitigated and no customer action is required, but is not disclosing who exploited it or how widely.
Microsoft on August 12 released its August 2026 Patch Tuesday, fixing 421 vulnerabilities — 11 rated critical — including a Windows Ancillary Function Driver zero-day actively exploited by Lazarus-linked actors. CISA's August 18 CVE Brief added another zero-day to the actively exploited list, with 42 additional critical issues and 95 high-priority updates.
CISA, the FBI, and HHS on August 18 published a joint #StopRansomware advisory on Medusa, a ransomware-as-a-service operation that has accelerated attacks on healthcare and critical infrastructure operators. The advisory adds HHS as a co-sealer for the first time this year and lists technical indicators, known affiliates, and recommended mitigations.
Microsoft's August 2026 Patch Tuesday addressed 421 vulnerabilities including CVE-2026-68820, a Windows Ancillary Function Driver for WinSock zero-day confirmed exploited by Lazarus-linked actors for SYSTEM-privilege escalation. Adobe separately shipped an urgent fix for CVE-2026-71362 in Adobe Commerce and Magento Open Source under active retail-skimming pressure.
A stealthy new variant of the Shai-Hulud worm dubbed ChainDrop has infected 444 npm packages downloaded about two billion times a month, spreading through tarballs and editor hooks rather than source commits, The Register reported August 15.
Threat actor FulcrumSec's February AWS breach of LexisNexis has now been confirmed to expose 364,000 profiles, while supply-chain giant Wesco confirmed a security incident on August 13 after the ExfilSquad group claimed theft of 2.6 million customer records.
A 153GB archive stolen during the LiteLLM supply chain attack exposes credentials linked to 2,488 corporate domains including AWS, Samsung, Cisco and Salesforce, according to new Hudson Rock research published August 13.
CVE-2026-68820 in Windows' AFD.sys driver — the only bug Microsoft confirmed under active attack in Tuesday's Patch Tuesday release — has a federal fix deadline of August 25, with Lazarus using it to deploy the FudModule v3.1 rootkit.
Microsoft's August 11 update addressed 398 CVEs — three of them zero-days, one actively exploited — plus a wormable DNS flaw enabling remote code execution, across Windows, Exchange, SharePoint, GitHub Copilot and more.
A joint advisory details how the Conti-derived ransomware group breached hospitals, governments and banks by exploiting unpatched Fortinet products, demanding ransoms that mostly exceeded $10 million — and reveals its Linux encryptor can be broken without paying.
The distribution giant says it found no ransomware in the breach of its cloud CRM environment, after the extortion group published data allegedly covering customer and employee PII following an expired ransom deadline, per BleepingComputer.
OpenAI on August 10 expanded Daybreak, its cyber defense service, into Blue and Red tiers and unveiled GPT-5.6-Cyber, a purpose-trained model available only to trusted partners such as Accenture, IBM, CrowdStrike and Cloudflare, TechCrunch reported.
Microsoft says the ransomware group weaponized an authentication bypass in N-able's N-central within hours of disclosure, deploying new C++ ransomware StormEncryptor and dumping credentials with Mimikatz.
Metabase disclosed August 7 that an unauthenticated SQL injection flaw rated CVSS 10.0 was exploited in zero-day attacks on its cloud platform, with laptop maker Framework and form builder Tally confirming customer data theft.
Levi Strauss told the SEC that hackers used social engineering on three employees to steal corporate data from company-issued computers, though the jeans maker said consumer data was not impacted and business operations were not interrupted.
Hackers have targeted water and wastewater utilities in at least seven states, locking operators out of monitoring systems in attacks the FBI and CISA have linked to Iranian actors, SecurityWeek and the Philadelphia Inquirer reported this week.
The ShinyHunters extortion crew published data stolen in a vishing attack on Exact Sciences, the cancer diagnostics business Abbott acquired this year, exposing 10.9 million unique email addresses, The Register reported.
Citadel, Two Sigma and Point72 were targeted in a wave of AI voice-cloning attacks that Bloomberg called 'vishing.' The industry's Fusion Center has been activated to coordinate a response.
At least a dozen attackers have drained bitcoin from Coldcard 'cold' wallets by exploiting predictable seed-phrase generation, blockchain security firms say. The heist highlights that offline hardware is only as safe as the code that creates its keys.