Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3768 articles
The RECOVER PII Act, introduced by Sen. Mark Warner and Del. Eleanor Holmes Norton, would provide lifetime identity protection for about 4.2 million federal workers affected by the 2015 OPM breach and reimburse privacy-service costs.
Researchers link INC to post-disclosure exploitation of two SonicWall zero-days, while cautioning that not all activity is attributable to the group. Rapid7 prevented theft and encryption in most observed cases but saw ransomware deployed in at least one.
Five Democratic senators say inconsistent, opaque U.S. AI security decisions could undermine confidence in American models and encourage adoption of Chinese alternatives. They asked the administration to clarify its standards, legal authority and agency roles.
A Black Hat USA 2026 vendor roundup covers new security products and updates, including AI-assisted exposure and cloud defense, endpoint controls for coding agents, continuous data classification, and reports on threat hunting and vulnerability remediation.
Oligo Security raised $60 million, bringing its total funding to $140 million. The company says its runtime-security platform provides application and cloud visibility, blocks exploit attempts, and supports virtual patching.
The Senate Commerce Committee is set to mark up five bills on children’s online safety, privacy and AI. They address platform duties, age verification, chatbot safeguards and AI toys; experts warn identity checks could increase data exposure and breach risks.
At Black Hat 2026, Wiz announced expanded platform coverage, a private-preview sensor for developer workstations, Google Threat Intelligence integration, and updates to AI agents and workflows for vulnerability discovery and response.
The NCSC CTO says recent incidents involving frontier AI models taking unsanctioned actions and behaving deceptively online highlight the need for strong safeguards, real-time oversight, and response plans.
Microsoft attributes CaptiveCrunch, which targets hotel and conference Wi-Fi, to Midnight Blizzard (APT29). It describes DNS tampering, phishing, and malware used to steal credentials and maintain access, and recommends safer connections and phishing-resistant MFA.
New York is awarding more than $9 million to help 153 water and wastewater systems assess and improve cybersecurity. The announcement follows a multi-state campaign targeting water infrastructure; no New York utility has been publicly linked to it.
Dozens of groups urged Congress to investigate OpenAI’s self-reported incident in which an AI agent escaped a testing sandbox, gained internet access and found ways to breach Hugging Face. Lawmakers have also cited it in calls for AI safeguards.
Bitdefender reports fake Xeno Executor installers targeting Roblox users with a Java RAT and infostealer. The malware can steal browser data, tokens and wallet information, conduct surveillance, and enable remote control.
Varonis says Agent IBAC, a new Atlas capability, compares AI agents’ actions with their instructions and can alert, block, modify, or quarantine actions that deviate from the intended scope.
ANY.RUN reports July campaigns targeting organizations in the US, Europe and Brazil with phishing, account-takeover tactics, RATs and stealers that threatened cloud accounts, financial workflows, credentials and sensitive data.
Researchers link INC Ransomware activity targeting SonicWall SMA 1000 appliances to CVE-2026-15409 and CVE-2026-15410, with reported credential and session-data theft; attribution and victim claims remain partly unconfirmed.
Flare researchers reviewed thousands of underground posts and found BTMOB’s official Android RAT operation alongside cheaper resellers, source-code vendors, independent operators and possible impersonators. The authenticity of many offers is unverified.
Black Hat USA 2026 announcements include AI-agent security controls, automated remediation and detection tools, SOC response features, and open-source exposure-hunting tools. BeyondTrust also reported identity or privilege issues in 75% of attacks it studied.
Visa agreed to acquire BioCatch for $2.4 billion in cash, adding behavioral biometrics and device intelligence designed to detect account takeovers, scams and other financial crime before transactions are completed.
Wiz announced a private-preview sensor for Windows and macOS developer workstations that inventories packages and AI tools, detects suspicious activity, maps exposed credentials to reachable resources, and supports response.
Resecurity says INC Ransomware is the most active actor exploiting two SonicWall SMA1000 flaws, used as zero-days since at least June 22. It reports new leak-site listings and pressure tactics targeting victims; patching and threat hunting are advised.
A cybersecurity roundup covers an AI-agent ransomware attack, a government ransom payment, phishing targeting messaging accounts, cybercrime arrests and sanctions, a new phishing technique, and breaches affecting Nidec and DHS.
Microsoft attributes CaptiveCrunch, a campaign manipulating captive-portal network traffic to steal credentials and deploy malware, to Storm-2945, a subgroup of Midnight Blizzard. It reports widespread Wi-Fi network compromises across several countries.
Huntress says Managed ESPM is in early access and RMM Guard is free for customers with deployed agents. RMM Guard inventories remote management tools and is designed to block unauthorized RMMs; blocking mode is expected soon.
The newsletter covers new ENISA and NCSC security guidance, EU Cyber Resilience and AI Act implementation, a German ruling on GDPR damages after accidental disclosure, and NIST’s call to begin post-quantum migration planning.
