Most organizations have incident response plans, security tools, and technical teams in place. The technique requires code execution in the victim’s signed-in session. “We have implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation. Monitors evaluate the model’s Chain of Thought and trigger a security re… OpenAI has announced that it’s pausing some “internal activities” involving its upcoming artificial intelligence (AI) model Astra after an internal evaluation found it had made significant advancements in agentic coding and cybersecurity.

NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents. The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. In this report experts explain how AI cybersecurity agents can help them secure their businesses A newly identified threat actor is running a large-scale, long-running cyber campaign targeting Salesforce Experience Cloud sites and ServiceNow Service Portals globally.

Entra ID researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently use the victim’s Windows Hello for Business key to authenticate to Microsoft Entra ID. But security teams still have to review vulnerabilities, manage dependencies, prioritize fixes, and control risk at human speed. Microsoft says a new Defender capability isolated a compromised device and stopped a ransomware attack in 128 seconds. Carlos Morales, SVP & General Manager of Arbor Cloud, NETSCOUT says how proactive defences for uninterrupted availability is now a business risk imperative…

If teams can suddenly create many times more code, security can also end up with many more components, dependencies, findings, and fixes to manage. In our latest webinar with Chainguard experts, “ The True Cost of Building at Machine Speed ,” you can now watch how security teams can keep AI-driven development fast without letting risk scale with it. GPT-5.6-Cyber, a more cyber-permissive version of GPT-5.6 Sol, builds upon GPT‑5.5‑Cyber , which OpenAI released in June 2026. The artificial intelligence (AI) company said it’s making GPT 5.6 Cyber available through Daybreak Red, a new tier that provides access to its purpose-trained cybersecurity models to other firms for authorized vulnerability research, exploit validation, and security testing. “Built on GPT‑5.6 Sol, it is trained to improve capabilities on several specialized cybersecurity tasks (e.g., finding zero-day vulnerabilities and developing exploit chains) and to reduce refusals for certain higher-risk, dual-use cyber tasks,” OpenAI said .

AI “Mind Viruses” Can Spread Between Agents Through Persistent Prompt Files

In this video interview, Standard Chartered’s group CISO shares insights on transitioning from technical roles to strategic leadership, the importance of business-savvy security executives, and how AI is reshaping both defensive capabilities and adversarial tactics in banking. As part of Dark Reading’s 20th anniversary celebration, we trace the industry’s evolution through a technology lens. As part of Dark Reading’s 20th anniversary special coverage, we profile the CISOs, founders, researchers, criminals, and policymakers who rewrote the enterprise risk playbook. The botnet adds exploitation modules, credential theft, and reverse SOCKS relays to turn compromised devices into persistent attacker infrastructure. Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.

Gunra Ransomware Builds a New Attack Network Through RaaS

• The program could allow vetted private US companies to access targeted systems without the owner’s authorization and, in more disruptive operations, damage or destroy systems or infrastructure.
• Microsoft’s August 2026 Patch Tuesday fixes roughly 400 flaws, including three Zero-days, with one actively exploited and two publicly disclosed.
• In this report experts explain how AI cybersecurity agents can help them secure their businesses
• This week’s roundup examines corporate cyberattacks, AI security risks, Microsoft zero-days, logistics disruption and threats targeting personal accounts.
• This prolific information-stealing malware quietly strips compromised systems of saved browser passwords, payment card details, and cryptocurrency wallets in a single execution.
• The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web.

This technological shift enables threat actors… OpenAI has warned that advancing artificial intelligence models are increasingly capable of automating critical phases of real-world cyberattacks.

From Bobmojis to Bobbleheads: How the Democratic Party Built a Security-First Culture

Chester – known as Chet – opens up about putting out the fire of cybercrime with AI and agents that hand today’s defenders a frontier AI advantage… Huntress documents how a ransomware affiliate sabotaged its own attack with an anti-EDR effort GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents. North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling, according to new research into an… Protect your business against the most common cyber threats with Cyber Essentials. It is worrying if you are victim of an online scam or cyber attack.

GitHub on Wednesday officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension. Google’s Mandiant attributes it to the group it tracks as UNC6240, and dates the activity between May 27 and June 9. “Salesforce took this action because our security teams recently detected unusual activity involving the app that may have resulted in unauthorized access to a subset of customer data via the app’s connection to Salesforce,” it noted . Krishnan does not name the victim, but the chat points to Union County, Ohio. It also worked with Salesforce to roll out new detection and governance tooling aimed at addressing the activity authentication logs miss.

In research published July 13 , Microsoft mapped the campaigns, which ran from mid-2025 into mid-2026, to three distinct techniques. The charge was Section 3ZA of the Computer Misuse Act 1990, the Act’s most serious, and they admitted https://power-at-work.com/cybersecurity-risks-and-solutions-for-connected-construction-equipment/ it on the basis that they were reckless as to whether they caused or created a significant risk of serious damage to human welfare. Armenia has held a Russian tourist named Aleksandr Ermakov in a detention center since June 28, on a U.S. extradition request for a REvil ransomware suspect named Aleksandr Ermakov. The company said it detected and responded to the incident targeting its production infrastructure earlier last week.

McDonald’s, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records

The ransomware group known as DeadLock has been observed using decentralized infrastructure to facilitate victim communications and https://www.inrecognition.org/what-impact-does-cybersecurity-have-on-business-trust/ data leak operations in a bid to improve operational resilience. Users running self-hosted versions are advised to apply security patches released b… Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. “GitLab.com and GitLab Dedicated are already running the patched version. GitLab.com and GitLab Dedicated customers do not need to take action,” the company said. A cryptocurrency fraud operation has been found using AI coding tools to turn huge phone lists into a sharper victim-targeting system.

No evidence of data breach after Chinese-made component found in Navy drones, MoD says

A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel , the ransomware-as-a-service operation he stood up in 2021. The tech giant said it observed the ransomware being deployed by multiple threat actors, including an affiliate for Lynx and INC ransomware. Grafana Labs, on May 19, 2026, said an investigation into its recent breach found no evidence of customer production systems or operations being compromised. In an ironic twist, open-source artificial intelligence (AI) platform Hugging Face revealed that it was the victim of a hack perpetrated by an autonomous AI agent system. Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. JFrog says it has since developed and released fixes for cloud and self-hosted customers.

• Apple on Thursday sent a fresh batch of notifications to customers whom it suspects may have been targeted by mercenary spyware attacks.
• A Powerful, All-in-One Solution for Cyber-Resilient Backup and Recovery In an era where ransomware, cloud complexity, and regulatory pressures are reshaping data protection priorities, NAKIVO Backup & Replication v11 provides…
• In this video interview, Standard Chartered’s group CISO shares insights on transitioning from technical roles to strategic leadership, the importance of business-savvy security executives, and how AI is reshaping both defensive capabilities and adversarial tactics in banking.
• Reddit is increasing its use of moderation tools and getting rid of Automod, and many moderators aren’t happy at all.
• OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker .

Metabase Cloud instances have already been updated to the latest version. Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. Hackers deploy AI agents to breach Taiwanese government systems. Data-theft campaign targets misconfigured Salesforce and ServiceNow instances.

SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers. “All of the malicious RubyGems packages appear to be typosquats of popular Ruby dependencies, but rather than the clever SEO-fueled typosquats we’ve seen from other threat actors (e.g., events-channel imitating the popular Node.js events module), they’re all clumsy typos.” The 16 gems have been published… OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker . The implant is equipped to harvest Windows credentials using pixel-perfect fake lock screens, offer a reverse SOCKS5 pivot into victim networks, execute arbitrary commands, and establish persistence on the host. There is no evidence that the technique has spread successfully in the wild, and the same paper reports that a review of archived posts from Moltbook, the social network for AI agents, found no successful agent-to-agent propagation despite several attempts.

The research highlights how compromised routers and IoT devices can be turned into distributed reconnaissance infrastructure that evades traditional IP-based defenses and supports follow-on exploitation. The botnet uses these devices to conduct targeted scanning and fingerprinting, helping threat actors rapidly identify vulnerable infrastructure—sometimes within hours of a new vulnerability disclosure—and appears to have a particular focus on U.S. military-related networks. This abuse has caused people to believe that fake images and videos are genuine and dismiss real content as misinformation.

More alerts are making your team slower, and an outcome-based SOC fixes that July 20, 2026 Google’s $10,000 refund test shows why AI agents need zero trust August 18, 2026 Microsoft’s August 2026 Patch Tuesday fixes roughly 400 flaws, including three Zero-days, with one actively exploited and two publicly disclosed. NIST seeks input on modernizing the National Vulnerability Database as AI reshapes vulnerability management, risk assessment and remediation. As enterprises race to bolt AI onto every business process, security leaders are being forced to answer a harder question… The program could allow vetted private US companies to access targeted systems without the owner’s authorization and, in more disruptive operations, damage or destroy systems or infrastructure.

Sogang University data breach exposes information of 180,000 people

• Both versions were released last month.
• The work, released as a preprint on August 10, 2026, tests the technique in a simulated six-agent coding collaboration and in a chain of paired agents modeled on OpenClaw , the open-source autonomous assistant formerly known as Clawdbot and Moltbot .
• Given the urgency, analysts and consultants want to hear more about what to do when agents go rogue, as well as how to better control all agent actions.
• The botnet adds exploitation modules, credential theft, and reverse SOCKS relays to turn compromised devices into persistent attacker infrastructure.
• NIST seeks input on modernizing the National Vulnerability Database as AI reshapes vulnerability management, risk assessment and remediation.

Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. In a statement shared with TechCrunch, the iPhone maker said it alerted an unspecified number of users targeted in 110 countries and that it has notified customers in over 150 countries to date. Apple on Thursday sent a fresh batch of notifications to customers whom it suspects may have been targeted by mercenary spyware attacks. The ransomware payload ultimately failed to deploy due to insufficient virtual memory. Trump expands private-sector role in U.S. offensive cyber operations, raising governance concerns.

Shadow hVNC Gives Attackers Remote Desktop Control Without Moving the Victim’s Mouse

President Trump’s bold vision to secure and accelerate American artificial intelligence (AI) innovation is being actioned through the creation of “GOLD EAGLE,” a clearinghouse that enables unprecedented cybersecurity vulnerability coordination. The report also found that cyberattacks are already a recurring business risk. Both versions were released last month. Google on Thursday announced that it fixed a whopping 1,072 security bugs in Chrome versions 149 and 150, surpassing the total number of flaws the company fixed across the prior 23 milestones combined. Windows ticketing keeps private-key operations available while the user is interactively signed in, allowing code running as the user to ask Windows to sign authentication data.

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

The work, released as a preprint on August 10, 2026, tests the technique in a simulated six-agent coding collaboration and in a chain of paired agents modeled on OpenClaw , the open-source autonomous assistant formerly known as Clawdbot and Moltbot . Security researchers at Anthropic and Switzerland’s EPFL have demonstrated that self-propagating payloads can spread from one artificial intelligence (AI) agent to the next through the editable system prompt files that autonomous agent harnesses use to carry state between sessions. Global malware activity climbed sharply over the past week,… A fast-moving campaign is turning a VMware vCenter flaw into a route to full control of virtual infrastructure. Shadow hVNC is a remote access tool built to operate where victims cannot see it. C2Looper is a newly identified backdoor that gives attackers a quiet way to control a compromised Windows computer.

• “Salesforce took this action because our security teams recently detected unusual activity involving the app that may have resulted in unauthorized access to a subset of customer data via the app’s connection to Salesforce,” it noted .
• Mandy Lamb, Head of Value-Added Services at Visa Europe, contends that Visa’s new platform will help financial institutions identify cyber risks earlier…
• Hackers deploy AI agents to breach Taiwanese government systems.
• This abuse has caused people to believe that fake images and videos are genuine and dismiss real content as misinformation.
• Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day.

• If teams can suddenly create many times more code, security can also end up with many more components, dependencies, findings, and fixes to manage.
• CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145 , which is a subgroup within Sandworm (aka APT44, Seashell Blizzard, and UAC-0002), a sophisticated hacking group affiliated with the GRU.
• Shadow hVNC is a remote access tool built to operate where victims cannot see it.
• “Some of GitHub’s internal repositories contain information from customers, for example, excerpts of support interactions. If any impact is discov…
• The company said it detected and responded to the incident targeting its production infrastructure earlier last week.
• Google’s Mandiant attributes it to the group it tracks as UNC6240, and dates the activity between May 27 and June 9.

“Specifically, on job search websites, after reviewing a candidate’s resume, the attackers contact a potential victim – typically a system administrator or IT specialist – on behalf of an IT company https://lifestyll.net/what-are-exciting-hobbies-for-tech-enthusiasts/ (such as ATLAS Business Group),” CERT-UA said . The campaign is assessed to be ongoing since May 2026. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145 , which is a subgroup within Sandworm (aka APT44, Seashell Blizzard, and UAC-0002), a sophisticated hacking group affiliated with the GRU. This week has plenty of them, covering cloud services, AI tools, malware, data breaches, scams, and new attack methods.

The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web. The Justice Department has never named the company, in Wednesday’s announcement or in the October 2024 indictment, identifying the victim only as a U.S. software-as-a-service (SaaS) pr… The intrusions reached at least 165 organizations and exposed records belonging to at least 100 million people.

Shell Investigates Data Breach After Cl0p Ransomware Claims Theft of 89GB Corporate Data

They also discuss OpenAI’s Trusted Access for Cyber program and what it takes to give security practitioners access to powerful AI capabilities while managing the risks of misuse. Breaking cybersecurity news, news analysis, commentary, and other content from around the world. Attackers continue to target critical infrastructure and government-linked organizations in the country, mirroring the increased activity across Latin America. The trust framework underlying Belgium’s electronic ID system was fully compromised by severe vulnerabilities in a key browser extension, showcasing bigger problems with extensions in general.

Targets of the campaign include manufacturing, automotive, aerospace, and retail sectors. Several Artifactory https://e-beginner.net/category/cybersecurity-fundamentals/ CVE records were published on July 27 with affected-version ranges and fixed-version thresholds, but neither JFrog nor OpenAI has said whether any of those records correspond to the vulnerabilities used during the evaluati… OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent that escaped its sealed evaluation environment and broke into Hugging Face’s production environment also hacked multiple third-party accounts and services as part of the attack. Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge.

Fact Sheet: President Donald J. Trump Promotes Advanced Artificial Intelligence Innovation and Security

Adform is telling people to clear their browser cache because the altered file may remain cached after the fix, and to check any wallet address before sending funds. Attackers modified a JavaScript file served by advertising technology company Adform , turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. “We are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques,” the company said. N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management (RMM) product. A configuration that allowed arbitrary devices on that APN to communicate with one another let the attacker pivot from a compromised wind-farm network to a controller at the CHP plant. While the intruders were still active inside the network, and customers lost neither heat nor electricity.