The Combating Organized Retail Crime Act has won a big House vote and could be on the fast track in the Senate — and supporters say it could help fight cybercrime. The post Retail theft bill spurs ‘very large and very dangerous’ surveillance fears appeared first on CyberScoop.
Pakistan-linked threat actor Transparent Tribe has updated its cyber arsenal to target Afghan organizations under Taliban control, exploiting their relatively weaker security postures. The group has achieved limited success against more mature security defenses deployed by Indian government agencies, indicating that operational maturity remains a critical differentiator in resisting state-sponsored intrusions.
Resilience, not prevention, is key, analysts at the credit-rating agency said in a pair of new reports.
OpenAI has enhanced ChatGPT's safety features specifically for teenage users to address risky conversations and prevent misuse for academic dishonesty. However, the effectiveness of the platform's most robust parental oversight tools requires parents to maintain linked accounts, which may create implementation barriers for some families seeking to monitor their teens' usage.
Adversa AI has disclosed a cryptographic context injection attack that could enable adversaries to extract sensitive user data from xAI's Grok chatbot, including names, locations, subscription information, and conversation prompts, by tricking users into summarizing seemingly ordinary web pages. The attack leverages the chatbot's interaction with web content to redirect data to attacker-controlled servers without the user's knowledge or consent.
Because apparently even ransomware gangs can't trust the people they do business with
A spree of cyberattacks targeting US water systems, reportedly attributed to Iran-linked threat groups, has prompted calls for enhanced regulatory oversight and greater funding for utility cybersecurity defenses. The campaign has generated momentum among policymakers to strengthen protections for critical infrastructure in the water sector.
A zero-day elevation-of-privilege vulnerability tracked as CVE-2026-69414 in the Microsoft Malware Protection Engine allows low-privilege local attackers to escalate to SYSTEM level, with a public proof-of-concept released on August 12, 2026. Microsoft assigned the CVE on August 14 with no patch currently available, and CISA's binding operational directive 26-04 mandates remediation within 14 days. Organizations running Microsoft Defender should prioritize detection and mitigation efforts while awaiting an official patch.
Unattributed threat actors are actively targeting internet-exposed Siemens S7 Series PLCs across critical infrastructure using AI-generated exploitation scripts to conduct reconnaissance and pre-position for disruptive attacks. The advisory from NSA, CISA, FBI, DOE, and EPA identifies five S7 product lines at risk and emphasizes that no single patch exists; mitigation requires removing PLCs from internet exposure, implementing network segmentation, and hardening access controls. The use of AI to rapidly develop and iterate exploit code represents a significant shift in ICS attack capabilities, lowering the technical barriers for attackers targeting industrial control systems.
A critical vulnerability in the isolated-vm sandbox library allows attackers to escape the isolated JavaScript environment and achieve remote code execution on the host system. The flaw, tracked as GHSA-864f-rcv7-6rh4, affects all versions through 7.0.0 of the popular open-source project. Security researchers have disclosed the escape technique, highlighting a significant risk for applications relying on isolated-vm for code isolation.
Citrix has patched a critical authentication bypass vulnerability in NetScaler ADC and NetScaler Gateway that could allow attackers to circumvent security controls on affected deployments. The flaw impacts customer-managed instances across multiple configurations, including FIPS and NDcPP builds, as well as SecurAccess. Organizations running these products should prioritize applying the available updates to prevent potential unauthorized access.
The designation would unlock a range of federal services, tools and resources for an industry that policymakers view as increasingly tied to national and economic security. The post The push to designate AI as the next critical infrastructure sector appeared first on CyberScoop.
The Grandoreiro banking Trojan has resurfaced following law enforcement action against its operators, now equipped with enhanced anti-detection and anti-analysis capabilities. The malware is actively targeting Mexico in its latest campaign, suggesting the threat actors have adapted their infrastructure and are resuming operations despite prior disruption efforts.
Twitch has enabled content creators to opt out of having their streams and videos used for Amazon's AI model training, following a two-year delay since the platform initially confirmed it was already conducting such training. This move provides creators with control over their intellectual property but raises questions about why the opt-out mechanism was not offered from the start of the AI training program.
A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of command injection that can lead to remote code execution. "A remote code execution vulnerability exists in Zimbra
Building on the last diary on Using MS Graph and Powershell, let&#;x26;#;39;s look at "Risky" logins.
Check Point Research demonstrates how Microsoft Defender's remediation driver can be weaponized as a kernel-level primitive to execute arbitrary file and registry operations with Ring 0 privileges, bypassing the need for traditional exploits or memory corruption vulnerabilities. This technique leverages a signed, trusted security component to grant attackers powerful kernel capabilities without requiring vulnerability exploitation, presenting a novel attack surface within Windows Defender itself.
A spoonful of encryption helps the malware go down
Traditional vulnerability management was built for a smaller, slower problem than most teams face today. This post breaks down CTEM, why it exists, how its five stages work, and what it actually takes to move from a reactive pile of findings to a continuous, prioritized risk reduction program.
Microsoft Graph is an increasingly adopted API that enables querying and modifying information across M365, Entra users, and managed machines, presenting opportunities for both legitimate administration and reconnaissance activities. Security teams should be aware that PowerShell-based approaches using Microsoft Graph can identify organizational vulnerabilities such as stale accounts and unused licenses that may pose security risks if left unmanaged.