Topic
Threats, privacy, and enterprise security.
A security researcher, Chaotic Eclipse, has released a proof-of-concept for a new zero-day vulnerability in Microsoft Defender, named ShieldCrash, which bypasses the ShieldBreak patch (CVE-2026-69414).
Adobe has released security patches for a critical vulnerability in Adobe Commerce and Magento Open Source, tracked as CVE-2026-75650, which has been actively exploited since September 4, 2026.
Cybersecurity researchers revealed a significant SEO poisoning campaign named BengalSEO, which has been active since 2015 in Rajasthan, India. This campaign facilitates malware deployment and tech support scams, as disclosed by the DFIR Report in March 2026.
Grindr will pay £26 million to settle a U.K. lawsuit over allegations of sharing users' personal information, including HIV status, with third parties. The lawsuit claimed violations of U.K. privacy laws for commercial purposes.
A vulnerability in FreeIPA allows unauthenticated clients to create their own Kerberos identities, potentially granting them administrator access, according to Red Hat. This flaw requires an additional vulnerability in the underlying 389 Directory Server software.
Microsoft has released updates to address 974 security vulnerabilities, marking its largest patch batch ever. This month’s updates include critical flaws that could allow attackers to gain control of Windows systems. Experts emphasize the challenges organizations face in testing and deploying these
A report by Gamers Nexus reveals that LG smart TVs continuously log and upload user data, even when offline or in standby mode, raising privacy concerns.
Researchers at Calif have developed a worm that can take over WeChat accounts through incoming calls without the recipient needing to answer. The vulnerability was reported to Tencent in July.
A financially motivated hacking group has utilized an autonomous, multi-agent attack framework to conduct a large-scale credential harvesting campaign, compromising thousands of credentials in under six hours, according to Google Threat Intelligence Group.
A report by Check Point Research reveals a vulnerability in ChatGPT that allows an attacker to extract data from a user's Gmail account through a planted prompt, while ChatGPT continues to respond normally to the user.
The Liquid Network hack resulted in nearly 4,000 bitcoin being stolen, with 3,400 returned the following day. Approximately 598.5 bitcoin remains unreturned, and the network is currently paused.
A new threat actor named Slim Spider has been linked to cyber attacks on Brazilian financial institutions since March 2026, showcasing significant knowledge of the country's financial systems, according to CrowdStrike.
CISA has added a critical security flaw in N-able N-central to its KEV catalog, mandating fixes by September 11, 2026. The vulnerability, CVE-2026-86218, has a maximum CVSS score of 10.0.
Microsoft has addressed a record 974 vulnerabilities in its software, including two actively exploited zero-day flaws. The updates include 723 flaws in Windows, 111 in Office, 62 in SQL, and 22 in Developer Tools, with over 110 rated as critical severity.
A hacker executed one of the largest cryptocurrency thefts, stealing $340 million, but later returned most of the funds.
Hackers are reportedly stealing Claude tokens from users, as one subscriber noticed unusual token consumption. Anthropic has issued a warning to its users regarding this issue.
Researchers have uncovered JSCeal, a sophisticated malware that can harvest credentials and intercept traffic, utilizing advanced obfuscation techniques to protect its payloads.
N-able has issued its fourth hotfix in five weeks for the N-central RMM platform, addressing an unauthenticated RCE flaw. The company notes that the flaw has been exploited in the wild, although this is unconfirmed.
Cybersecurity researchers have revealed a worm-like activity exploiting ConnectWise ScreenConnect to spread a malicious VBScript payload to newly connected hosts. Huntress identified three unrelated incidents using various initial access methods, including a tech-support scam and phishing.
A proof-of-concept exploit by TantoSec demonstrates how a padding oracle vulnerability in Telerik UI can lead to unauthenticated remote code execution. Progress has patched this vulnerability in July, and there are currently no confirmed cases of exploitation in the wild.
A recent analysis by Intruder reveals that cloud security risks vary significantly across AWS, Azure, and Google Cloud, with each provider exhibiting unique misconfiguration issues. The findings are part of the 2026 Cloud Security Index, which analyzed data from 3,000 organizations.
This week's cybersecurity recap highlights a workaround for blocking email images using QR codes, a credential-stealing code from a trusted software source, and issues with a secure network management protocol.
