The threat landscape is intensifying with high-severity vulnerabilities in major platforms like Cisco, Microsoft, and GitLab being actively exploited. AI-generated exploits are targeting critical infrastructure from Siemens, while supply chain attacks on Rust pose a significant risk. Cloudflare's use of AI for engineering control highlights the growing role of AI in both offense and defense. Meanwhile, OpenAI gains ground in the enterprise AI market, and data privacy concerns arise with suspected Russian hacking campaigns leveraging Google OAuth and WhatsApp.
Cisco patched nine vulnerabilities in its Crosswork and Secure Workload Software, five of which received a CVSS score of 10.0, indicating critical severity. The vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning across various device configurations.
Microsoft identified a remote code execution vulnerability, CVE-2026-69836 (CVSS score 10.0), in its Entra ID service. Exploitation of this flaw has been observed in the wild, impacting Microsoft's cloud-based identity and access management service previously known as Azure Active Directory.
The U.S. government identified an active threat against critical infrastructure organizations utilizing AI-generated exploit scripts targeting Siemens S7 PLCs. These scripts, disguised as legitimate monitoring tools, are used for reconnaissance and capability development.
Private equity firm Apollo confirmed a data breach impacting an undisclosed number of individuals. The breach involved a hacking technique used by threat actors to target financial institutions, as identified by Google researchers.
Cloudflare is implementing an AI-powered system to enforce its engineering standards across the software development lifecycle. This system analyzes code and configurations, identifying deviations from established standards and automatically taking corrective actions, impacting over 100 engineers.
GitLab's CVE-2026-19478, a 9.4 CVSS score code injection vulnerability, is being actively exploited by attackers. This allows unauthenticated actors to modify or delete publicly accessible GitLab projects and rewrite their data under specific conditions.
OpenAI is attracting more business users than Anthropic, according to new data. This shift in preference could impact the revenue streams of both AI labs as businesses become less committed to a single provider.
A compromised maintainer account on crates.io published malicious versions of three Rust crates (arrayref, internment, and append-only-vec) with a typosquatted dependency that downloaded and executed malware during compilation. These affected releases have been downloaded over 245 million times.
GitHub experienced an outage on August 17th affecting a number of users globally. The company is implementing changes to its infrastructure and monitoring systems to prevent future outages.
Gogs 10.0 has a remote code execution vulnerability that allows attackers to execute arbitrary code on affected servers. Researchers also disclosed an n8n workflow-to-RCE technique, and a $10 million reward is offered for exploiting the GLM-5.3 AI model.
Three Russian cyber espionage groups—UNC6293, UNC7005, and UNC5976—used Google OAuth and WhatsApp linking to hijack accounts of individuals in academia, aerospace/defense, government, and think tanks across Europe and the U.S. This technique allowed them to gain unauthorized access to sensitive information from targeted organizations.
Senator Ron Wyden requested a review from the U.S. federal watchdog regarding the FBI, DEA, ICE's HSI, and the Secret Service's use of hacking tools and spyware against American citizens. The review will assess the number of instances where these agencies employ such techniques and their impact on individual privacy and civil liberties.
Wazuh is integrating artificial intelligence (AI) into its Security Operations Center (SOC) platform. This will enable analysts to process 10 times more security events per hour using machine learning algorithms, improving threat detection and response times.
Micro1, an AI data startup, has achieved a $500 million gross run rate fueled by increased demand for AI training data. This surge in demand stems from the widespread adoption of AI technologies requiring substantial datasets for effective training.
A hacker impersonating a representative from CoinDesk sent malicious Google Docs files to over 10 security researchers. The documents were designed to deliver malware, potentially compromising the researchers' systems and data.
A study found that 33% of web pages published since ChatGPT's launch exhibit characteristics indicative of AI authorship. This suggests a significant increase in the use of AI models like ChatGPT for content creation and editing on the internet.
Adversa AI discovered a cryptographic context injection attack that exploits xAI's Grok chatbot. This technique allows attackers to steal a user's name, location, subscription tier, and conversation prompts by tricking the chatbot into summarizing a malicious web page.
Dan Finneran presented a technique using eBPF to control AI API traffic in Kubernetes environments. This method leverages kernel-level socket hooks to implement prompt filtering, model swapping, token limits, and syscall restrictions, securing AI agents without altering application code or restarting containers.
