Cybersecurity News Today: breaches, vulnerabilities and threat intel from 40+ sources

pwnsy
ENCN
BLEEPINGCOMPUTER
Nearly 700 rogue AI agents coordinated in the Hugging Face attack3h
PaperCut warns of NG, MF flaw exploited in zero-day attacks8h
Manchester Airports Group says hackers stole travelers' data9h
DARK READING
Chinese Routers Sold Worldwide Contain Backdoors5h
Agentic AI Risks, CVE Program Concerns Permeate Black Hat USA 20267h
Russian Hackers Phish EU Officials Over Messaging Apps14h
CYBERSCOOP
Unit 42 warns AI has shifted balance of power from defenders to attackers6h
100-plus companies call for ‘global surge’ in AI-powered cyber defense6h
Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities8h
TLDR INFOSEC
Critical Ubiquti Vulnerabilities 🛜, Security Needs a New Control Plane 🤖, Debunking Carhartt Breach Claims 👕1d
Critical Keycloak ATO 🔑, AI Bug Bounty Hunter 🐞, Global Telecom Exploitation 📞2d
Does Plan Mode Help Code Security 📝, OWASP Agent Skills Top 10 🔟, Bypassing macOS SIP 🍎3d
THE HACKER NEWS
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations1d
CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing1d
New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode1d
THE RECORD
White House bans foreign-made equipment for power generation over cyber backdoor concerns5h
Finland appeals court revives case against Eagle S Officers over cable breaks9h
Chinese and Russian spies stepping up cyberattacks, German companies report10h
SECURITYWEEK
Trump Order Aims to Block Foreign Backdoors in US Power Grid Gear11h
Australia Arrests 2 Alleged TeamPCP Hackers12h
OpenAI Agents Coordinated via Makeshift Message Board Ahead of Hugging Face Hack13h
HELP NET SECURITY
Two alleged TeamPCP hackers arrested over global supply chain attacks11h
Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)1d
RightCrowd Pass unifies mobile, physical, and biometric credentials1d
INFOSECURITY
Manchester Airports Group Hit by Cyber Incident12h
Chinese Hacker Group QTFY Uses Custom-Built Platforms to Target US Infrastructure, FBI Warns13h
CISA Warns of Six Exploited Flaws in Microsoft, Linux, Red Hat and Citrix Products14h
GRAHAM CLULEY
US Navy tells sailors and their families: scrub your social media, enemies are watching15h
Smashing Security podcast #482: This hacker leaked GTA 6 – and launched their own cryptocurrency1d
Malicious Firefox add-ons caught stealing cryptowallet seed phrases and browser credentials3d
SOPHOS
A call for collective action on cyber defense1d
The State of Ransomware in Education 20261d
Sophos Ranked #1 Overall in Endpoint, XDR, MDR, and Firewall in the G2 Fall 2026 Reports3d
INDICATOR
AI-generated Costco employees got over 100 million views on Facebook and Instagram1d
OSINT Tool Radar: 14 new and 72 updated2d
The Indicator guide to vibecoding for OSINT3d
KREBS ON SECURITY
Who’s Tracking You? Use This New Service to Find Out13d
Microsoft Plugs Nearly 400 Security Holes16d
Canadian Man Pleads Guilty in Snowflake Extortions21d
SOCIAL
R/PRIVACY
Bank to Bank transfers3h💬 11▲ 17
West Yorkshire Police to deploy facial recognition at Leeds Festival for first time4h💬 5▲ 29
Is looking for privacy make you more of a target.5h💬 14▲ 32
R/CYBERSECURITY
Are you worried that everyone is getting into cybersecurity that it will be like computer science?3h💬 181▲ 90
Best Varonis alternatives for an on-prem environment?4h💬 30▲ 11
how does an IAM department actually work inside a company?7h💬 22▲ 39
R/HACKING
I pwned OpenClaw with just email and a new injection escalation technique: prompt laundering3h💬 4▲ 39
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia12h💬 1▲ 13
I Turned a $400 Enterprise AP Into a Fully Emulated Root Shell — Here's the Whole Story, Bugs and All12h💬 0▲ 5
R/NETSEC
UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range4h💬 1▲ 9
A fake resume invoked China’s defence tech elite, then installed VShell9h💬 3▲ 9
LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation10h💬 0▲ 10
R/ASKNETSEC
Best runtime security platform for AI agents that actually deploys without proxies or SDK changes?11h💬 2▲ 5
Best risk based vulnerability management solution? tired of guessing.12h💬 3▲ 10
What's your guardrail for an AI coding assistant reading files outside the repo18h💬 9▲ 20
R/REVERSEENGINEERING
HexWalk 2.2.0 Hex analyzer new release, added multi-encoding support: ASCII, UTF8, UTF16, Latin1... works both on Windows, Linux and MacOs, give it a try!17h💬 0▲ 18
drakoarmy/datadome-rs: High-end Rust DataDome deobfuscator & solver with VM disassembly — all 3 challenge types (tags, interstitial, slider).1d💬 2▲ 5
binviz – a binary visualiser with calibrated thresholds instead of magic numbers1d💬 6▲ 8
R/INFOSECNEWS
Police Arrest Two Alleged TeamPCP Members Linked to Shai-Hulud Attacks5h💬 0▲ 6
Account Takeover Flaw Hits TranslatePress Plugin Used on 400K WordPress Sites14h💬 0▲ 5
FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure1d💬 1▲ 20
R/MALWARE
I open-sourced a categorized catalog of 2,800+ malware families (Mapped to NIST/CISA & MITRE)2d💬 2▲ 15
E4del and PINHOLE two new RATs abusing FTP banners, Pinterest, and SurveyMonkey for C26d💬 1▲ 11
HACKER NEWS
💬Three UK airports hit by cyber-attack with data of 8.7M customers accessed2h💬 1▲ 7
💬Show HN: Beating GPT5.5-xhigh for Coding agent security with SLMs and IRM2h💬 3▲ 6
💬Carhartt data breach exposes information of 12.9 million accounts10h💬 1▲ 6
💬Government admits water system cyberattacks were worse than first reported11h💬 2▲ 9
💬AC2 Protocol: The missing security layer for AI agents11h💬 14▲ 16
ENTERPRISE
FEDERAL NEWS CYBER
Army overhauls software acquisition to speed delivery3h
Getting help to disaster survivors takes more than good weather forecasts5h
Commercial aviation depends on a growing network of connected systems. GAO found gaps in cybersecurity.1d
THE REGISTER SECURITY
CRPx0 hacking service for dummies claims victim count more than quintupled3h
AI girlfriend review site's secrets were exposed to the world for three weeks6h
Omarchy distro gains serious backing8h
ZDNET SECURITY
Lawsuit says Oura sleep tracking has 'a coin flip's chance of being correct'4h
Galaxy Z Fold 8 camera trouble? 4 settings I recommend changing now6h
This excellent HP laptop is nearly 50% off at Best Buy - and comes with a cheap TV8h
TECHCRUNCH SECURITY
ATF declares ‘major incident’ as ransomware gang claims hack7h
Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others10h
Here’s all the times AI has gone rogue and hacked other companies11h
CYBERSECURITY DIVE
Hundreds of agents went rogue in lead up to Hugging Face breach9h
Federal authorities disrupt China-backed hacking operation targeting US critical infrastructure12h
Boston Scientific says cyberattack disrupted order processing, shipping1d
NEXTGOV CYBER
ATF investigating ‘major’ cyber incident after ransomware group claim11h
White House to soon launch water provider cyber protection program1d
FBI disables China-linked hacking tools used against US agencies1d
CSO ONLINE
AI can be made to read an email much differently than you do13h
Critical infrastructure’s long, undefended tail exposed by UK energy attack16h
NemoClaw’s AI can be poisoned through a browser tab1d
ARS TECHNICA SECURITY
Claude published malicious code to the Internet and attacked 3 real companies27d
Chrome may get faster updates with no restart required28d
Microsoft unveils AI security tools it says outperform competing platforms1mo
RESEARCH
MICROSOFT SECURITY
​​​​​​What’s new in Microsoft Security: August 20269h
When AI infrastructure becomes the target: Securing gateways and control points1d
The patch window is collapsing: Why security needs a new control plane2d
NCSC UK
Disruptive cyber activity highlights risk from internet-exposed systems and edge devices13h
NCSC statement in response to recent incidents resulting from frontier AI evaluations23d
UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations1mo
SANS ISC
A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)15h
ISC Stormcast For Thursday, August 27th, 2026 https://isc.sans.edu/podcastdetail/10070, (Thu, Aug 27th)23h
Who Has Admin Rights in your Entra ID Directory?, (Wed, Aug 26th)1d
SCHNEIER ON SECURITY
LLM-Based Social Engineering Scams15h
Spyware for Babies1d
Black Hat State of Security Vendors2d
ARXIV SECURITY
ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposure21h
Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation21h
Static Detection of Post-Quantum Cryptographic Algorithms in Stripped Binaries for Digital Forensic Examination and Migration Assurance21h
TROY HUNT
A Cautionary Tale About Data Breach Claims, Verification and Carhartt2d
Weekly Update 518: IoT Doorlock Nirvana with UniFi3d
Welcoming the Sri Lankan Government to Have I Been Pwned4d
NIST NEWS
NIST Researchers Supersize Quantum Technology to Help Detect Faint Photons3d
NIST National Construction Safety Team Advisory Committee Meeting Scheduled for Sept. 23 and 24, 202614d
NIST Researchers Correct Common Error Confounding Nanotech Measurements21d
VENDORS
MANDIANT$4.7T
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia7d
Staying Ahead of Adversarial AI Through Agentic Source Code Review9d
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments21d
CISCO TALOS$475B
“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend7h
JavaScript obfuscation: From party trick to phishing kit15h
Choose your fighter: Balancing competing requirements to select models for your AI SOC1d
UNIT 42$228B
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution2d
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain6d
Identity Abuse Through Trusted Communication Channels7d
CROWDSTRIKE$186B
CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms7d
Benchmaxxing: When the Benchmark Becomes the Target8d
Teaching AI to Reason Through Detection Triage10d
CLOUDFLARE$85B
How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache8h
The Cloudflare Blog – Brought to you by EmDash3d
Say it once: introducing Bot Preference Sync6d
DATADOG SECURITY LABS$85B
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it8d
Putting models to the secure coding test: Plan vs default mode9d
Worm compromises hundreds of popular npm packages24d
WIZ$32B
Inside 90 days of attacks on AI infrastructure8h
From Concept to Context Engine: How Wiz Built AI-Powered Data Discovery9h
Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps13h
ZSCALER$23B
It No Longer Takes an Expert to Attack a Factory8h
Zscaler WebMCP Security Controls: Bringing Zero Trust to the Agentic Web1d
Human + AI: How Our Product Managers Innovate with AI1d
CHECK POINT RESEARCH$14B
24th August – Threat Intelligence Report3d
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive7d
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect9d
SNYK$7.4B
Why Your AI Application Is Exposed Snyk1d
Remediation Agents, Demystified: Why Fixing Beats Finding9d
Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix Rates by over 14%9d
SENTINELONE$6.2B
The Path to the Autonomous SOC: The Early Returns of AI & What It Means for Cybersecurity2d
The Model Is the Malware | What Four Agentic Intrusions Tell Defenders14d
From Input to Impact: Secure AI Where It Runs23d
ELASTIC SECURITY$5.7B
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy3d
How a team of entity maintainers monitors, connects and scores entities in Elastic Security4d
13 million tool calls: auditing every AI coding agent action with Elastic Agent17d
QUALYS$3.85B
PCI DSS 4.0.1: Application Requirements You’re Being Assessed On in 20267h
Beyond Patching: What IT Teams Need to Know About Unpatchable Exposures1d
When an AI Agent Turned Attacker: What Qualys Sees Across Every Phase of the Hugging Face Kubernetes Intrusion1d
TENABLE$3.1B
How to build an exposure management program the business trusts: Lessons from Tenable’s CSO10h
Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter1d
Frequently asked questions about the active threat to Siemens S7 Series PLCs7d
RECORDED FUTURE$2.65B
BlueDelta Targets Defense and Diplomacy with HOOKEDGE1d
Recorded Future Launches AI Alert Filtering2d
Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense3d
EXPEL$1B
The AI CVE exploitation evidence story: Headlines are scarier than reality5h
Mapping AI detections to MITRE ATLAS: How Expel does it1d
New Ruxie AI power-up: Meet RTA, the AI agent bringing self-challenging logic to identity and cloud alert triage3d
HACKERONE$841M
CIRCIA Cyber Incident Reporting: HackerOne's Recommendations7d
How to Build a CTEM Program: A 90-Day Implementation Roadmap14d
CTEM Metrics That Matter: What CISOs Should Report to the Board22d
RAPID7$440M
Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs11h
Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)3d
CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway8d
REVERSINGLABS
Extend CrowdStrike Falcon with Permanent Intelligence8h
Infostealers highlight malware-as-a-service trend1d
Agentic AI scales semiautonomous server attacks2d
KASPERSKY SECURELIST
Threat landscape for industrial automation systems. Q2 202615h
Exploits and vulnerabilities in Q2 20261d
The invisible passenger in your car6d
OX SECURITY
ClickFix Phishing Pages Discovered in 24 npm Packages2d
PBOM vs SBOM: What’s the Difference, and Why Does It Matter in 2026?8d
Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directive9d
WELIVESECURITY
How QR-code phishing can slip past corporate security measures10d
Black Hat USA 2026: Will vulnerability discovery eventually decline in the AI era?14d
Black Hat USA 2026: What the Hugging Face hack tells us about human responsibility14d
BITDEFENDER
Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums24d
Fake shops target shoppers across Europe with fake Samsung deals, counterfeit goods and World Cup scams2mo
Inside APAC's malvertising ecosystem: How scams spread through social media ads2mo