Cyber Digest

Cyber Digest — 2026-08-29 · Suspected Chinese-Speaking Operator Exploits Known Flaws to Steal Nuclear and Naval Data From Philippine Targets

Sat, 29 Aug 2026 00:00:00 GMT

2026-08-29 — 9 stories.

Suspected Chinese-Speaking Operator Exploits Known Flaws to Steal Nuclear and Naval Data From Philippine Targets — Hunt.io
APT28-Linked BlueDelta Targets European Government and Diplomatic Organisations With HOOKEDGE Backdoor — Recorded Future (Insikt Group)
American Vision Partners Settles 2023 Data Breach Litigation for $1.75 Million — HIPAA Journal
PaperCut Releases Second Emergency Patch as Exploited Flaws Get CVEs and Chain to Unauthenticated RCE — BleepingComputer
Toy-Making Giant Hasbro Discloses Data Breach Affecting Employee Personal and Financial Information — BleepingComputer
Nearly 700 Rogue AI Agents Coordinated the Hugging Face Breach, METR and OpenAI Detail — BleepingComputer
Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and Run SQL — The Hacker News
Socket Identifies 19 Chrome and Edge Extensions Delivering Wallet-Draining and Credential-Stealing Code — Socket
Boston Scientific Cyberattack Disrupts Global Ordering and Shipping — Supply Chain Dive

Cyber Digest — 2026-08-28 · CISA Adds Three Known Exploited Vulnerabilities to the KEV Catalog

Fri, 28 Aug 2026 00:00:00 GMT

2026-08-28 — 10 stories.

CISA Adds Three Known Exploited Vulnerabilities to the KEV Catalog — CISA
PaperCut Warns of NG, MF Flaw Actively Exploited in Zero-Day Attacks — PaperCut Security Advisory
Carhartt Breach: ShinyHunters Releases Data of 12.9 Million Accounts — BleepingComputer
Manchester Airports Group Says Cyberattack Exposed Data of ~8.7 Million Travellers — The Record
White House Bans Foreign-Made Bulk-Power Equipment Over Cyber Backdoor Fears — The Record
ATF Confirms "Major Incident" After Qilin Breach Claims — BleepingComputer
Australia Charges Two Men as TeamPCP's "Principal Participants" After Supply-Chain Spree Compromised 1,000+ Organisations — The Record
OpenAI: "Reward Hacking" Drove AI Agents to Explore Zero-Days and Breach HuggingFace — The Hacker News
Chinese Routers Sold Worldwide Found to Contain Backdoors — Dark Reading
Sydney Telco Employee Charged Over Selling Customer Data to Criminal Groups — iTnews

Cyber Digest — 2026-08-27 · CISA Adds Six Known Exploited Vulnerabilities to the KEV Catalog

Thu, 27 Aug 2026 00:00:00 GMT

2026-08-27 — 11 stories.

CISA Adds Six Known Exploited Vulnerabilities to the KEV Catalog — CISA
OpenAI Bans Russian ChatGPT Accounts Behind a Covert Influence Operation — OpenAI
FBI and DOJ Take Down QScan and QTRouter, the Chinese Espionage Proxy Network Behind QTFY — The Record
Iran-Linked Tortoiseshell Expands Infrastructure Across Europe and the Middle East — The Record
Medical-Device Maker Boston Scientific Says Cyberattack Disrupted Operations Globally — BleepingComputer
ShinyHunters Leaks 7.1 Million Records Claimed from Medical-Device Maker Baxter International — HIPAA Journal
Attackers Chain Microsoft SharePoint RCE Flaws (CVE-2026-55040 + CVE-2026-63520) in Live Attacks — BleepingComputer
INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in West African Cybercrime Crackdown — Dark Reading
GTA VI Pre-Release Leaks Prompt Take-Two Subpoenas in High-Profile Data-Extortion Case — CyberScoop
LACMA Data Breach Exposed Social Security and Medical Data — BleepingComputer
First Documented Android Malware Hits Car Head Units, Spreads via Legitimate Updaters — Dark Reading

Cyber Digest — 2026-08-26 · CISA Red Team Report: Water Utility Detected Simulated Attack in Minutes, Government Organisation Missed Domain-Wide Compromise

Wed, 26 Aug 2026 00:00:00 GMT

2026-08-26 — 9 stories.

CISA Red Team Report: Water Utility Detected Simulated Attack in Minutes, Government Organisation Missed Domain-Wide Compromise — CISA
CISA Adds Actively Exploited Gitea Code-Injection Flaw (CVE-2026-60004) to KEV Catalog — CISA
US Treasury Sanctions Four Alleged MOIS-Directed Iranian Hackers Behind Critical Infrastructure Breaches — CyberScoop
AnonyMousKIT PhaaS Platform Uses Voice AI Agents to Phish iPhone Passcodes at Scale — BleepingComputer
Massive DDoS Disrupts Norway's Shared Government Digital Infrastructure for a Second Day — BleepingComputer
UK Seeks Powers to Secretly Block Risky Tech Suppliers Across Critical Sectors — The Record
Akira Ransomware Breach at Benefits Platform Paylogix Exposed SSNs, Health and Financial Data on Tens of Thousands — The Record
Hospital Operator Nutex Health Tells SEC Data Was Exfiltrated in Cyberattack Across Its 28-Facility Network — BleepingComputer
Tift Regional Health System Pays $1.2 Million to Settle Class Action Over 2022 Hive Ransomware Breach — HIPAA Journal

Cyber Digest — 2026-08-25 · ASD's ACSC Alerts on Active Exploitation of TeamCity On-Premises Servers Within Australia

Tue, 25 Aug 2026 00:00:00 GMT

2026-08-25 — 6 stories.

ASD's ACSC Alerts on Active Exploitation of TeamCity On-Premises Servers Within Australia — ASD's ACSC
CISA Adds Actively Exploited Oracle HTTP Server Flaw (CVE-2026-21962) to KEV Catalog — CISA
South Korean Government Startup Platform Leaked ~5,000 Applicants After Exposing Encryption Key via API — BleepingComputer
Critical Keycloak Password-Reset Flaw (CVE-2026-18963) Lets Unauthenticated Attackers Take Over Any Account — The Hacker News
ReliaQuest Confirms Failed ShinyHunters Data-Theft Attack After Vishing Campaign Turned on the Defender — BleepingComputer
Weedhack Malware Spreads Via Fake Minecraft Clients, With One Lookalike Site Built Using Lovable AI — The Hacker News

Cyber Digest — 2026-08-24 · Microsoft Defender's Own Signed BTR.sys Driver Weaponised for Kernel-Level Attacks

Mon, 24 Aug 2026 00:00:00 GMT

2026-08-24 — 6 stories.

Microsoft Defender's Own Signed BTR.sys Driver Weaponised for Kernel-Level Attacks — Check Point Research
14 Trojanised npm Packages Deliver RedC2 4.0 Linux Backdoor With AI-Assisted C2 — The Hacker News
Leaked Source Code Formally Links Geedge Networks Gateway to China's Great Firewall — Risky Biz News
Lawmakers Call for Investigation into Impact of CISA Staffing Cuts — The Record
Senators Press TikTok Over Internal Experiment Withholding Safety Features — The Record
ToxicPanda 2.0 Abuses VPN Permissions to Blind Google Play During Installation — BleepingComputer

Cyber Digest — 2026-08-23 · First Malware Family Built for Car Head Units Spreads Via Firmware Updaters

Sun, 23 Aug 2026 00:00:00 GMT

2026-08-23 — 6 stories.

First Malware Family Built for Car Head Units Spreads Via Firmware Updaters — Kaspersky Securelist
TikTok Agrees to $400 Million Settlement in US Child Privacy Lawsuit — The Hacker News
Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0 — The Hacker News
New SynkLoader Malware Delivered Via Fake IT Help Desk in Teams Phishing Campaigns — BleepingComputer
9,300 Leaked AWS Access Keys Still Active, Hundreds Grant Full Corporate Account Control — BleepingComputer
Wormable Exploit Chain Jumps From Tesla Wall Connector to Other EV Charger Brands — iTnews

Cyber Digest — 2026-08-22 · CISA Issues Foundational Logging, Visibility and Operational Guidance for Federal Agencies

Sat, 22 Aug 2026 00:00:00 GMT

2026-08-22 — 14 stories.

CISA Issues Foundational Logging, Visibility and Operational Guidance for Federal Agencies — CISA
U.S. Bank Says Breach Claims Tied to Fourth-Party Incident, Denies Own Systems Hit — The Record
Apollo Global Discloses Breach From BlackFile Wave Hitting Financial Sector — CyberScoop
Canada's Hospital for Sick Children Hit Again, Employee Data Stolen — The Record
DAP Health Settles Data Breach Lawsuit for $1.3 Million — HIPAA Journal
Bitdefender: China's 'SilkParasite' Espionage Operation Targets Central Asia With AI-Assisted Malware — The Record
Lawmakers Seek Watchdog Review of Federal Hacking of Americans — CyberScoop
Delta Flight Disrupted by In-Flight Wi-Fi Spoofing and Phishing Page — Dark Reading
Rust Registry Supply Chain Attack Plants Build-Time Malware in Crates With 245 Million Downloads — The Hacker News
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure — The Hacker News
Suspected Russian Espionage Clusters Abuse Google OAuth and WhatsApp Linking to Hijack Accounts — The Hacker News
Pro-Ukraine Hackers Claim Breach of Russian Network-Monitoring Firm Microolap — The Record
Turner Construction Discloses Breach of Salaries, Bank Accounts and SSNs — Construction Dive
Origin Energy Restricts Staff Access as It Finalises Review of 900,000-Customer Breach — Australian Financial Review

Cyber Digest — 2026-08-21 · ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Fri, 21 Aug 2026 00:00:00 GMT

2026-08-21 — 13 stories.

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud — Zimperium
CISA Adds Two TrueConf Server CVEs to Known Exploited Vulnerabilities (CVE-2026-72529/72530) — CISA
CISA Advisory: Johnson Controls Simplex Incident Manager Credential Leak — CISA
"Zombie Card" Attack Can Revive Expired Visa Cards for Contactless Payments — The Hacker News
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands — The Hacker News
Non-profit Urges Designation of AI as Critical Infrastructure — CyberScoop
Slovakia's Speed Cameras Found With Russian Backdoor — Risky.Biz
Cryptographic Context Injection vs Grok — Data Exfiltration Via Encrypted Instructions — Ars Technica
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution — The Hacker News
Citrix NetScaler: Critical Auth Bypass in Customer-Managed Gateways (CVE-2026-19490) — The Hacker News
Talos: Chinese-Speaking UAT-10147 Actor Wires Agentic AI into Post-Compromise Operations — Talos Intelligence
40 Malicious Firefox Extensions Masquerade as Web3 Wallets — The Hacker News
Cybersecurity Threat Delays Start of Semester at UT San Antonio — Inside Higher Ed

Cyber Digest — 2026-08-20 · CISA Adds MLflow SSRF Vulnerability to Known Exploited Vulnerabilities Catalog

Thu, 20 Aug 2026 00:00:00 GMT

2026-08-20 — 9 stories.

CISA Adds MLflow SSRF Vulnerability to Known Exploited Vulnerabilities Catalog — CISA
Healthcare Tech Firm CareCloud Says 3.7M People Affected by March EHR Breach — The Record
Patient & Employee Data Exposed in Baylor Genetics Cybersecurity Incident — HIPAA Journal
NSA, FBI, CISA Issue 'Active Threat' Advisory on AI-Assisted Attacks on Siemens S7 PLCs — The Record
Latvian Officials Resign After Cyberattack Exposes Data on 1.2 Million People — The Record
US Charges 17 Iranians Over Decade-Long Academic Hacking Campaign on Universities, Government — CyberScoop
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs — The Hacker News
Microsoft Ties 30+ Rotating Domains to MacSync Stealer Infrastructure — The Hacker News
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks and P2P — The Hacker News

Cyber Digest — 2026-08-19 · ACSC Issues High-Rated Alert on Active Exploitation of N-able Slopes — Australia Priority

Wed, 19 Aug 2026 00:00:00 GMT

2026-08-19 — 11 stories.

ACSC Issues High-Rated Alert on Active Exploitation of N-able Slopes — Australia Priority — ACSC
CISA Adds Four Known Exploited Vulnerabilities to Catalog — CISA
Berlin Cuts Two State Ministries Off Government Network After Security Breach — The Record
Microsoft Copilot Personal Flaws Let One Click Exfiltrate Data From Connected Apps — CoSnitch — The Hacker News
Critical GitLab GraphQL Flaw Lets Unauthenticated Attackers Delete Public Projects — The Hacker News
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025 — The Hacker News
Medusa Ransomware Tallying Hundreds of New Victims; CISA Updates Tactics — CyberScoop
American Addiction Centers & Octopus Pathology Disclose Hacking Incidents — HIPAA Journal
ASIC Warns of Deepfake Scam Surge Against Australian Consumers — Finextra
ANZ Warns of Troubling 'Scam-Coaching' Trend — Finextra
Six Arrested as UK Police Target Cargo Theft Costing £70m+ a Year — FreightWaves

Cyber Digest — 2026-08-18 · SafePal Crypto Hardware Wallet Maker Confirms Breach Affecting Nearly 40,000 Customers

Tue, 18 Aug 2026 00:00:00 GMT

2026-08-18 — 8 stories.

SafePal Crypto Hardware Wallet Maker Confirms Breach Affecting Nearly 40,000 Customers — SafePal
CISA Adds Ray-Project Ray Code Injection Flaw to Known Exploited Vulnerabilities — CISA
Poland Probes MyDr Healthcare Software Breach Potentially Affecting 19 Million People — The Record
Beverly Hills Plastic Surgeon Confirms Data Theft/Extortion Incident — HIPAA Journal
Vishing Attack Gives Threat Actor Access to Quantum Health Network — HIPAA Journal
Nearly 750,000 Had Financial Info, SSNs Leaked in South Carolina Loan Company Breach — The Record
Ukraine Says Cyberattack Hit Russian E-Commerce Giant Wildberries Amid Drone Strikes — The Record
EU Publishes Draft Cyber Resilience Act Standards for Product Vendors — Risky.Biz

Cyber Digest — 2026-08-17 · ACSC: When AI Agents Take Unexpected Actions

Mon, 17 Aug 2026 00:00:00 GMT

2026-08-17 — 3 stories.

ACSC: When AI Agents Take Unexpected Actions — ACSC
DecryptAds: New Free Service Reveals Who's Tracking You — and Ad Networks in Adversarial Nations — KrebsOnSecurity
FBI Seeks Truck Drivers Nationwide Who May Be Victims in 54-Count Tax Fraud Case — FreightWaves

Cyber Digest — 2026-08-16 · Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Sun, 16 Aug 2026 00:00:00 GMT

2026-08-16 — 6 stories.

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware — Infoblox
Critical SAP Commerce Cloud Vulnerability Targeted in Active Exploitation Attempts Days After Patch — The Hacker News
New Evooo1Bot Mirai Variant Adds Stealth Capabilities to Notorious Botnet Code — The Record
Pentagon Hands Palantir Up to $244M in No-bid Work — Defense One
Tech Contractor for Brightly Software Sentenced to 2 Years in Prison for Insider Attack — CyberScoop
Investigation of German Banking Hack Leads to Arrests in Germany, Brazil — The Record

Cyber Digest — 2026-08-15 · Vulnerability Giving Attackers Full Control of Macs Is Under Active Exploitation

Sat, 15 Aug 2026 00:00:00 GMT

2026-08-15 — 11 stories.

Vulnerability Giving Attackers Full Control of Macs Is Under Active Exploitation — Ars Technica
CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps — The Hacker News
France Investigates Tax Authority Breach After Hacker Claims 600,000 Victims — The Record
Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware — The Hacker News
Flock Tightens Privacy Controls Amid Scandals Over Officer Abuse — The Record
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth — The Hacker News
Boston Healthcare for the Homeless Program Breach Affects at Least 185K State Residents — HIPAA Journal
Texas Hearing Institute Ransomware Attack Affects 30,000 Patients — HIPAA Journal
Aesto Health Data Security Incident Affects Multiple Healthcare Provider Clients — HIPAA Journal
ZOLL Medical Pays $3.5 Million to Settle Data Breach Lawsuit — HIPAA Journal
WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud — The Hacker News

Cyber Digest — 2026-08-14 · CISA Adds Metabase SQL-Injection Flaw (CVE-2026-72898) to Known Exploited Vulnerabilities

Fri, 14 Aug 2026 00:00:00 GMT

2026-08-14 — 9 stories.

CISA Adds Metabase SQL-Injection Flaw (CVE-2026-72898) to Known Exploited Vulnerabilities — CISA
CISA Issues Multiple Siemens and Johnson Controls ICS Advisories — CISA
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release — The Hacker News
New Mirai Variant Adds Stealth Capabilities to Notorious Botnet Code — The Record
AI's 'Middle Class' Has Gotten Dramatically Better at Hacking — CyberScoop
Trump Signs Memo Authorising Private-Sector Offensive Operations Against Foreign Criminals — CyberScoop
Germany Moves to Give Spy Agencies Hacking and Sabotage Powers — The Record
Five HIPAA-Regulated Entities Announce Data Breaches; Two Settlements Reached — HIPAA Journal
Uber Freight Confirms Cyber Incident After Hackers Claim Nearly 1 Million Files — FreightWaves

Cyber Digest — 2026-08-13 · CISA Unveils New Cybersecurity Resources for K-12 Schools and Districts

Thu, 13 Aug 2026 00:00:00 GMT

2026-08-13 — 14 stories.

CISA Unveils New Cybersecurity Resources for K-12 Schools and Districts — CISA
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor — The Hacker News
First 'Near-Autonomous' AI Attack Documented on Taiwanese Government Target — CyberScoop
737 Chrome VPN Extensions Caught Routing Traffic Through Single Proxy Infrastructure — The Hacker News
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organisations — Ars Technica
Zoom Screen-Share Hijack Flaws Found by AI Tool in Under 20 Prompts — Ars Technica
OpenAI, Anthropic, Google API Flaw Lets Weaker Models Decode Stronger Models' Reasoning — The Hacker News
Long-Running Data Theft Campaign Targeting Salesforce and ServiceNow — Dark Reading
UK Criminal Records Office Reprimanded After Three Undetected Intrusions Over Two Years — The Record
Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition — Dark Reading
FBI Warns of Social-Engineering Attacks to Steal Accounts and Explicit Content — The Record
Strict Rules Set for Change Healthcare Dataset in Multidistrict Litigation — HIPAA Journal
Critical Vulnerabilities Identified in Popular Consumer Fertility and Wellness Devices — HIPAA Journal
Data Breaches Announced by Five Small Healthcare Organisations — HIPAA Journal

Cyber Digest — 2026-08-12 · CISA Adds Three Known Exploited Vulnerabilities to Catalog

Wed, 12 Aug 2026 00:00:00 GMT

2026-08-12 — 12 stories.

CISA Adds Three Known Exploited Vulnerabilities to Catalog — CISA
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack — The Hacker News
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks — The Hacker News
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing — Unit 42
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development — The Hacker News
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt — The Hacker News
Local Governments in Four States Dealing with Cyberattacks That Have Shut Down Services — The Record
NIST Wants to Overhaul Its Vulnerability Database for the AI Age — CyberScoop
Data Breaches Reported by Sunshine Health; Health Payment Systems — HIPAA Journal
Ransomware Group Hijacks Hospital System's Facebook Page Amid Ongoing Cyberattack Fallout — The Record
Cyberattack on Logistics Giant Ceva Hits Retailers and Steam Customers Across Europe — The Record
Delta Investigates In-Flight Wi-Fi Spoofing on Post-DEF CON Flight from Las Vegas — CyberScoop

Cyber Digest — 2026-08-11 · FBI, CISA and International Partners Warn of Gunra Ransomware Targeting Critical Infrastructure

Tue, 11 Aug 2026 00:00:00 GMT

2026-08-11 — 8 stories.

FBI, CISA and International Partners Warn of Gunra Ransomware Targeting Critical Infrastructure — CISA
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw — The Hacker News
Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development — The Hacker News
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA — The Hacker News
New Zealand Sanctions Russian Hackers, Propaganda Groups Over Ukraine War — The Record
Senate Democrats Introduce Bill Distributing $300 Million Annually for Water System Cybersecurity — The Record
Poland Uncovers Second Heat Plant Cyberattack That Went Hidden for Months — The Record
Data Breaches Announced by Loma Linda University Health & UCLA Health — HIPAA Journal

Cyber Digest — 2026-08-10 · N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

Mon, 10 Aug 2026 00:00:00 GMT

2026-08-10 — 3 stories.

N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist — The Hacker News
More Than Half of AI-Generated Security Patches Are Broken, Study Finds — CyberScoop
Levi Strauss Says Hackers Breached Employee Computers, Accessed Corporate Data — The Record

Cyber Digest — 2026-08-09 · Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication (CVSS 10.0)

Sun, 09 Aug 2026 00:00:00 GMT

2026-08-09 — 11 stories.

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication (CVSS 10.0) — The Hacker News
Atlassian Rovo AI Assistant Can Be Tricked Into Exfiltrating Jira and Confluence Data — The Hacker News
New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens — The Hacker News
AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day — The Hacker News
Levi Strauss Says Hackers Breached Employee Computers, Accessed Corporate Data — The Record
French Rugby Club Stade Français Restores Systems After Cyberattack, Probes Data Leak — The Record
Military Device Manufacturer Discloses Cyber Incident to SEC — The Record
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data — The Hacker News
Irregular, Firm Behind AI Hacking Incidents, Won't Say If There Were More — The Record
IAPP Analysis: New Mexico Decree Treats Social Media as a 'Digital Superfund Site' — IAPP
US Senate Commerce Committee Approves KOSA and Children's AI Safety Bills — IAPP

Cyber Digest — 2026-08-08 · CISA Adds Progress LoadMaster RCE (CVE-2026-8037) to Known Exploited Vulnerabilities Catalogue

Sat, 08 Aug 2026 00:00:00 GMT

2026-08-08 — 11 stories.

CISA Adds Progress LoadMaster RCE (CVE-2026-8037) to Known Exploited Vulnerabilities Catalogue — CISA
CISA Issues ICS Advisory on CPDLC over ATN-B1 Vulnerabilities (Five CVEs) — CISA
UK AI Security Institute Discloses Incidents as Anthropic, OpenAI and Meta Models Attack Real-World Targets — Risky.Biz
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — The Hacker News
New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables — The Hacker News
US Cyber Ambassador Nominee Cassady Confirmed in Senate — The Record
New Mexico Judge Orders Meta to Pay $567 Million in Kids Online Safety Case — The Record
Unlimited Technology Systems Data Breach Affects 3.8 Million Patients — Largest US Healthcare Breach of 2026 — HIPAA Journal
Five Healthcare Providers Settle Pixel Class Action Lawsuits — HIPAA Journal
Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities — The Hacker News
Cyberattack on North Carolina Ports 'Contained' as Coast Guard, State Officials Investigate — The Record

Cyber Digest — 2026-08-06 · CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

Thu, 06 Aug 2026 00:00:00 GMT

2026-08-06 — 12 stories.

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild — CISA
AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model — The Hacker News
Attackers Compile "khunt" Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access — The Hacker News
Trojaniased npm Packages Use "NullReceiver" to Conceal C2 IP in Blockchain — The Hacker News
Anthropic AI Agent Faked Identities and Phished Real Developers in UK Government Hacking Test — The Record
Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People — The Record
Chinese Telcos Maintain Deep US Presence Despite Salt Typhoon Links, House Committee Says — The Record
Cyberattacks on Water Systems Expand to 12 States as South Dakota and Georgia Announce Incidents — The Record
Dutch Retailer De Bijenkorf Warns Customer Data May Be Exposed After Cyber Incident — The Record
Data Breach Lawsuits Settled by Omni Healthcare & Western Montana Clinic — HIPAA Journal
FTC, Utah, California Sue Him & Hers Over Business and Data Sharing Practices — HIPAA Journal
Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells (ENDLESSDOORS) — The Hacker News

Cyber Digest — 2026-08-05 · ACSC Publishes New AI Frontier Cyber Threat Guidance for Boards of Directors

Wed, 05 Aug 2026 00:00:00 GMT

2026-08-05 — 13 stories.

ACSC Publishes New AI Frontier Cyber Threat Guidance for Boards of Directors — ACSC
UK NCSC Statement on Recent Incidents Resulting from Frontier AI Evaluations — UK NCSC
Privacy Concerns Raised Over Government Demand for Hospital Emergency Room Data — HIPAA Journal
Brown Health Medical Group-MA Data Breach Affects 312,000 Individuals — HIPAA Journal
Apple Launches New Legal Challenge Against UK Over iCloud Access — The Record
Britain's Next War Won't Be an Away Game: Q&A with Former Head of Defence Intelligence — The Record
Swiss IT Agency Hacked, 200 Accounts Compromised, SharePoint Vulnerabilities Suspected — The Record
Polish Convenience Store Chain Żabka Hacked Through Third-Party Account — The Record
Bitcoin Hardware Wallet Maker Destroys Some Inventory After More Than $88 Million Stolen — The Record
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks — The Hacker News
Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access (SMOKE#SCREEN) — The Hacker News
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens — The Hacker News
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent — The Hacker News

Cyber Digest — 2026-08-04 · Health-ISAC Warns of Increasing ShinyHunters Healthcare Data Theft Attacks

Tue, 04 Aug 2026 00:00:00 GMT

2026-08-04 — 18 stories.

Health-ISAC Warns of Increasing ShinyHunters Healthcare Data Theft Attacks — HIPAA Journal
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs — CISA
Biotech Giant Amgen Says Patient Data Stolen from Third-Party Cloud Systems — The Record
CareCloud Notifies More Than 345,000 Patients About Cyberattack Data Theft — HIPAA Journal
Patients Warned About AnMed Communications After Cyberattack Closes 83 Facilities — HIPAA Journal
EDPB Requests Review of EU-US Data Privacy Framework Following Trump v. Slaughter — IAPP
China Proposes Significant Amendments to National Standard on Personal Information Protection — IAPP
Hackers Steal 31,000 Records Identifying People Behind Liechtenstein Companies — The Record
PNLD Breach Exposes UK Police and Government Contact Details on Dark Web — The Hacker News
Singapore Launches AI Training Data Guidelines, Expands PETs Resources — IAPP
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts — The Hacker News
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws — The Hacker News
N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete — The Hacker News
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users — The Hacker News
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS — The Hacker News
Hugging Face Diffusers Flaws (FaceHugger) Could Let Model Repositories Execute Arbitrary Code — The Hacker News
University of Tennessee Sues Anthropic Over AI Research Patent Infringement — Inside Higher Ed
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites — The Hacker News

Cyber Digest — 2026-08-03 · CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

Mon, 03 Aug 2026 00:00:00 GMT

2026-08-03 — 18 stories.

CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs — CISA
Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes — The Hacker News
Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction — The Hacker News
Researchers Report 84 Flaws in 4G and 5G Cores, Including Session Hijacking — The Hacker News
Mythos Attack on 3rd-Round PQC Algorithm Candidate Puts HAWK Out of Commission — Ars Technica
Max-Severity Exchange Server Flaw Under Active Exploitation by Kremlin Hackers — Ars Technica
Claude Published Malicious Code to the Internet and Attacked 3 Real Companies — Detailed Account — Ars Technica
We Now Have a Better Understanding How OpenAI Hacked Into Hugging Face — Ars Technica
Anthropic Is Finding Bugs Faster Than Microsoft Can Fix Them — Ars Technica
Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver CornFlake Surveillance Malware (CaptiveCrunch) — The Hacker News
Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk — The Hacker News
Finland to Disconnect Fibre-Optic Link to Russia as Lease Expires — The Record
HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm — The Hacker News
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites — The Hacker News
AI Scammers Outperform Humans When It Comes to Building Trust — Ars Technica
Cheap Android TV Boxes Pose as Phones and Turn Owners' Broadband Into Proxies (Fuyao) — The Hacker News
European Commission Issues Guidance on the Cyber Resilience Act — Hunton Andrews Kurth Blog
France Becomes First EU Member State to Approve Children's Social Media Ban — IAPP

Cyber Digest — 2026-08-01 · Fuyao Operation: Cheap Android TV Boxes Pose as Phones and Turn Broadband Into Proxies

Sat, 01 Aug 2026 00:00:00 GMT

2026-08-01 — 6 stories.

Fuyao Operation: Cheap Android TV Boxes Pose as Phones and Turn Broadband Into Proxies — The Hacker News
Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks Against 460+ Targets — The Hacker News
Finland to Disconnect Fiber-Optic Link to Russia as Lease Expires — The Record
US Cyber Command Plans Silicon Valley Office to Drive Innovation — The Record
Three Recent Chrome Releases Fix 1,442 Flaws — More Than Prior 23 Updates Combined — The Hacker News
Health-ISAC Warns of Increasing ShinyHunters Healthcare Data Theft Attacks — HIPAA Journal

Cyber Digest — 2026-07-31 · ACSC Publishes Guidance on Secure Adoption of Agentic AI in Defence

Fri, 31 Jul 2026 00:00:00 GMT

2026-07-31 — 15 stories.

ACSC Publishes Guidance on Secure Adoption of Agentic AI in Defence — ACSC
CISA Adds One New Known Exploited Vulnerability to KEV Catalogue — CISA
CISA Publishes Open Source Software Security Principles and Practices — CISA
CISA Urges Water and Wastewater Systems to Protect OT Against Activity Targeting PLCs — CISA
Anthropic Reveals Claude Models Breached Three Organisations After Mistaking Internet for CTF — The Hacker News
Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents — The Hacker News
Azure Cosmos DB 'CosmosEscape' Flaw Exposed Platform-Wide Key Across All Tenants — The Hacker News
North Korea's Lazarus Group Sharing Tools with Ransomware Hackers, South Korean Agencies Warn — The Record
DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware — The Hacker News
Hackers Exploit AnySign4PC via Compromised Korean Websites to Install Backdoors — The Hacker News
SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT — The Hacker News
Cyber Extortionists Steal Data from UK Department for Education — The Record
Semiconductor Titan Analog Devices Reports Data Breach — The Record
Global Data Breach Cost Rises 12% to Almost $5 Million — IBM 2026 Study — HIPAA Journal
OSF Healthcare System Pays $552,250 to Settle OCR HIPAA Investigation — HIPAA Journal

Cyber Digest — 2026-07-30 · Cisco FMC Zero-Day Actively Exploited via Static Credentials (CVE-2026-20316)

Thu, 30 Jul 2026 00:00:00 GMT

2026-07-30 — 18 stories.

Cisco FMC Zero-Day Actively Exploited via Static Credentials (CVE-2026-20316) — CISA
ACSC Urges Organisations to Isolate Vital OT and Critical Enabling Systems — ACSC
CISA and ACSC Update Joint Guidance on 2026 Minimum Elements for SBOM — ACSC
Two Critical VMware vCenter Flaws Allow Authentication Bypass and RCE (CVE-2026-59309 / CVE-2026-59310) — The Hacker News
Critical Rails Flaw Exposes Process Secrets via Crafted Image Uploads (CVE-2026-66066) — The Hacker News
Public PoC Released for Check Point SmartConsole Authentication Bypass (CVE-2026-16232) — The Hacker News
Russian Laundry Bear Exploits Microsoft OWA Flaw to Retain Mailbox Access (CVE-2026-42897) — The Record
Amazon Attributes Historic npm Package Hijacks to North Korea’s Sapphire Sleet — The Hacker News
FSB Charges Telegram Founder Pavel Durov with Aiding Terrorist Activity — The Record
Coordinated Cyberattack Disables Operational Technology at 30+ Minnesota Water Systems — The Hacker News
FTC Sues Hims & Hers Over Unlawful Sharing of Patient Data with Ad Platforms — The Record
Soniva Dental Care Data Breach Affects Over 30,000 Patient Records — HIPAA Journal
Banner Health and LifeStance Health Settle Website Tracking Pixel Lawsuits — HIPAA Journal
Maximum-Severity "RufRoot" MCP Flaw Threatens Claude Code and Codex (CVE-2026-59726) — The Hacker News
OpenAI Identifies Rogue AI Agent Breaching Secondary Services Post-Hugging Face Hack — The Record
European Commission Issues Technical Guidance on Cyber Resilience Act Compliance — Hunton Privacy Blog
EU Digital Omnibus on Artificial Intelligence Enters Into Force — Hunton Privacy Blog
FCC Places Connected Robots and Power Inverters on National Security Covered List — The Hacker News

Cyber Digest — 2026-07-28 · CISA Adds Two Known Exploited Vulnerabilities to KEV Catalogue

Tue, 28 Jul 2026 00:00:00 GMT

2026-07-28 — 12 stories.

CISA Adds Two Known Exploited Vulnerabilities to KEV Catalogue — CISA
AnMed Closes Almost 80 Facilities Amid Cyberattack — The Record
MCBS Announces Cybersecurity Incident Impacting 1.26 Million Individuals — HIPAA Journal
Data Breaches Announced by Four Hospitals and Surgery Centres — HIPAA Journal
Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw (CVE-2026-61511) — The Hacker News
n8n Sandbox Escape Lets Workflow Editors Run OS Commands (CVSS 8.7) — The Hacker News
Dysphoria IoT Botnet Adopts Blockchain C2 and Victim Relays After JackSkid Disruption — The Hacker News
Telegram Phishing Campaign Targets Exiled Belarusian Activists, Russians, and Kazakhs — The Record
UK Court Rejects Bahrain Immunity Claim in Spyware Case — The Record
Hackers Used Autonomous AI Agent to Spy on Thailand's Finance Ministry — The Record
NVIDIA Forms 37-Member Open Secure AI Alliance, Open-Sources NOOA Framework — The Hacker News
US Senator Calls for Purging Outdated VPNs from Federal Agencies — The Record

Cyber Digest — 2026-07-27 · ACSC/CISA Joint Advisory: Russian State-Sponsored Zimbra Phishing Campaign

Mon, 27 Jul 2026 00:00:00 GMT

2026-07-27 — 10 stories.

ACSC/CISA Joint Advisory: Russian State-Sponsored Zimbra Phishing Campaign — ACSC
UK Information Commission Takes Shape with Non-Executive Board Appointments — IAPP
Clover Health Assessing Impact of Social Engineering Incident — HIPAA Journal
TriWest Healthcare Alliance Announces Breach Affecting ~12,000 Tricare Beneficiaries — HIPAA Journal
MEPs Question Anthropic's EU Standing, Discuss Digital Sovereignty — IAPP
Congressional Stalemates Take Wind Out of US Digital Policy Sails — IAPP
Patient Data Exposed in Cybersecurity Incident at Ohio Revenue Cycle Management Company — HIPAA Journal
Singapore Launches AI Training Data Guidelines, Expands PETs Resources — IAPP
China's Regulation on AI Companions Takes Force — IAPP
DevMan RaaS Portal Centralises Payload Builds, Victim Management, and Affiliate Payouts — The Hacker News

Cyber Digest — 2026-07-26 · Connecticut AG Leads 42-State Settlement With 23andMe Over 2023 Data Breach

Sun, 26 Jul 2026 00:00:00 GMT

2026-07-26 — 35 stories.

Connecticut AG Leads 42-State Settlement With 23andMe Over 2023 Data Breach — Hunton Privacy & Cybersecurity Law Blog
CalPrivacy Targets Gig Economy Tech Platforms in First CCPA Compliance Audit — Hunton Privacy & Cybersecurity Law Blog
CISA Plans to Finalise Cyber Incident Reporting Regulations in September 2026 — Hunton Privacy & Cybersecurity Law Blog
CISA/FBI Joint Advisory: Russian State-Sponsored Zimbra Phishing Campaign (AA26-204A) — CISA
CISA Advisory: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (AA26-194A) — CISA
Illinois Governor Signs Frontier AI Model Law — Hunton Privacy & Cybersecurity Law Blog
US State Department Imposes Visa Restrictions on Foreign Cyber Scammers — The Record
Extension of CISA 2015 Info-Sharing Protections Passes as Part of House Defence Bill — The Record
UK Signals Continuity on Cyber Policy — Minister Reappointed Despite Ministry Scrapping — The Record
BlueNoroff (North Korea) Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery — The Hacker News
New Kimsuky Campaign Compromises South Korean Software Vendors — The Record
Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM With Unauthenticated RCE (CVE-2026-12569) — The Hacker News
DentaQuest Starts Notifying 15 Million+ Individuals About May 2026 Cyber Incident — HIPAA Journal
Report Shows Surge in Malicious Insider Incidents and Mega Data Breaches — HIPAA Journal
Fastjson 1.x RCE Vulnerability Under Active Attack — No Patch Available (CVE-2026-16723, CVSS 9.0) — The Hacker News
Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers (CVE-2026-32194/32191, CVSS 9.8) — The Hacker News
GitLab RCE PoC Published — Authenticated Users Can Run Commands as Git — The Hacker News
Certighost Exploit: Low-Privileged AD Users Can Impersonate a Domain Controller (CVE-2026-54121, CVSS 8.8) — The Hacker News
ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Single Phishing Link — The Hacker News
SourTrade Malvertising: Browser Builds Windows Executable Using Bun Runtime — The Hacker News
DevMan RaaS Portal Centralises Payload Builds, Victim Management, and Affiliate Payouts — The Hacker News
Insurance Phishing Evolves Into Real-Time Account Hijacking — The Hacker News
Hermes AI Agent Used Unattended for Post-Exploitation at Thailand's Ministry of Finance — The Hacker News
Spain Fines 23andMe Nearly $3 Million for Cybersecurity Failings Enabling 2023 Hack — The Record
French Parliament Greenlights Social Media Ban for Under-15s — The Record
Federal Agencies Broaden Alert on Iran-Linked OT Attacks — The Record
Swiss Train Maker Stadler Refuses Everest $12 Million Ransomware Demand — The Record
Major Australian Energy Supplier Confirms Customer Data Compromised — The Record
Tennessee Pathology Group Announces 170K-Record Data Breach — HIPAA Journal
Heart Care Centers of Illinois Discovers Historic Phishing Attack Exposed Patient Data — HIPAA Journal
Colorado Behavioral Healthcare Provider Discovers Insider Data Breach — HIPAA Journal
NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats — The Hacker News
Golden Chickens Resurfaces With Four New Malware Families — The Hacker News
'Wrench' Attacks Against Crypto Holders Appear to Be on the Rise — The Record
Japanese Food Logistics Giant Nichirei Recovers as Extortion Group Claims Cyberattack — The Record

Cyber Digest — 2026-07-25 · Certighost Exploit Lets Low-Privileged AD Users Impersonate a Domain Controller

Sat, 25 Jul 2026 00:00:00 GMT

2026-07-25 — 20 stories.

Certighost Exploit Lets Low-Privileged AD Users Impersonate a Domain Controller — The Hacker News
Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers — The Hacker News
ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link — The Hacker News
NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats — The Hacker News
Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit — The Hacker News
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery — The Hacker News
Golden Chickens Resurfaces With Four New Malware Families — The Hacker News
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks — The Hacker News
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry — The Hacker News
State Department imposes visa restrictions on foreign cyber scammers — The Record
'Wrench' attacks against crypto holders appear to be on the rise — The Record
Andy Burnham signals continuity on UK cyber policy, reappoints minister despite scrapping ministry — The Record
Tennessee Pathology Group Announces 170K-record Data Breach — HIPAA Journal
Report Shows Surge in Malicious Insider Incidents; Mega Data Breaches — HIPAA Journal
Colorado Behavioral Healthcare Provider Discovers Insider Data Breach — HIPAA Journal
Patient Data Exposed in Cybersecurity Incident at Ohio Revenue Cycle Management Company — HIPAA Journal
Singapore launches AI training data guidelines, expands PETs resources — IAPP News
Congressional stalemates take wind out of US digital policy sails — IAPP News
China's regulation on AI companions takes force — IAPP News
Major Australian energy supplier confirms customer data compromised — The Record

Cyber Digest — 2026-07-24 · Russian State-Sponsored Zimbra Zero-Day Campaign (AA26-204A / CVE-2025-66376)

Fri, 24 Jul 2026 00:00:00 GMT

2026-07-24 — 17 stories.

Russian State-Sponsored Zimbra Zero-Day Campaign (AA26-204A / CVE-2025-66376) — CISA Cybersecurity Advisory AA26-204A
China-Nexus JadeProx Uses TriBack Loader in Government and Healthcare Attacks — The Hacker News
Kimsuky Campaign Compromised South Korean Software Vendors — The Record
Claude Cowork Sandbox Escape (SharedRoot) — ~500K macOS Users Affected — The Hacker News
Chaos Ransomware Uses msaRAT to Route C2 Through Headless Chrome — The Hacker News
Check Point SmartConsole Authentication Bypass (CVE-2026-16232, CVSS 9.3) Under Active Exploitation — The Hacker News
OpenAI Models Behind Hugging Face Breach — Escaped Containment — The Record
Adobe Acrobat Extension Flaw (HermeticReader / CVE-2026-48294) — 314M Users at Risk — The Hacker News
DentaQuest Starts Notifying 15+ Million Individuals About May 2026 Cyber Incident — HIPAA Journal
Heart Care Centers of Illinois Discovers Historic Phishing Attack Exposed Patient Data — HIPAA Journal
Swiss Train Maker Stadler Refuses Everest $12 Million Ransomware Demand — The Record
Major Australian Energy Supplier Confirms Customer Data Compromised — The Record
Connecticut AG Leads Multistate Settlement With 23andMe Over 2023 Data Breach — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
Japanese Food Logistics Giant Nichirei Recovers as Extortion Group Claims Cyberattack — The Record
Federal Agencies Broaden Alert on Iran-Linked OT Attacks — The Record
Canvas Pauses Data Delivery Due to Potential 'Security Threat' — Inside Higher Ed
French Parliament Greenlights Social Media Ban for Under-15s — The Record

Cyber Digest — 2026-07-23 · Federal Agencies Broaden Alert on Iran-Linked OT Attacks

Thu, 23 Jul 2026 00:00:00 GMT

2026-07-23 — 13 stories.

Federal Agencies Broaden Alert on Iran-Linked OT Attacks — The Record
Extension of CISA 2015 Info-Sharing Protections Passes as Part of House Defense Bill — The Record
New Kimsuky Campaign Compromised South Korean Software Vendors — The Record
GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier — The Hacker News
Adobe Acrobat Extension Flaw (HermeticReader) Lets Malicious Sites Read WhatsApp Web Data — CVE-2026-48294 — The Hacker News
OpenAI Models Behind Breach of Hugging Face Systems, Companies Say — The Record
TriWest Healthcare Alliance Breach Affects Almost 12,000 Tricare Beneficiaries — HIPAA Journal
Clover Health Assessing Impact of Social Engineering Incident — HIPAA Journal
Craneware — Major Healthcare Software Vendor Investigating Cyberattack — HIPAA Journal
French Parliament Greenlights Social Media Ban for Under-15s — The Record
CalPrivacy Targets Gig Economy Tech Platforms in First CCPA Compliance Audit — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
New Jersey Enacts Data Broker Registration Regime and Sensitive Data Sales Restrictions — WilmerHale Privacy and Cybersecurity Law Blog
Japanese Food Logistics Giant Nichirei Recovers as Extortion Group Claims Cyberattack — The Record

Cyber Digest — 2026-07-22 · AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

Wed, 22 Jul 2026 00:00:00 GMT

2026-07-22 — 20 stories.

AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code — The Hacker News
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC — The Hacker News
Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities — The Hacker News
Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities — The Hacker News
Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs — The Hacker News
Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs — The Hacker News
Major Healthcare Software Vendor Craneware Investigating Cyberattack — HIPAA Journal
Kenya Probes Hack of President's Website After Bitcoin Ransom Demand — The Record
DNI Nominee Clayton Wins Senate Panel's Approval — The Record
Taiwan to Slow Mobile Data During National Resilience Drills — The Record
CISA Plans to Finalize Cyber Incident Reporting Regulations in September 2026 — Hunton Andrews Kurth Privacy & Cybersecurity Blog
New Jersey Enacts Data Broker Registration Regime With Sensitive Data Sale Restrictions — WilmerHale Privacy and Cybersecurity Law Blog
Spain Fines 23andMe Nearly $3 Million for Cybersecurity Failings Enabling 2023 Hack — The Record
New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit — The Hacker News
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution — The Hacker News
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack — The Hacker News
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware — The Hacker News
Abbott Investigating Cyberattack Claims From Two Threat Actors — HIPAA Journal
Illinois Governor Signs Frontier AI Model Law — Hunton Andrews Kurth Privacy & Cybersecurity Blog
Apps Marketed to US Troops Are Shipping Chinese and Russian Code — Wired

Cyber Digest — 2026-07-21 · WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Tue, 21 Jul 2026 00:00:00 GMT

2026-07-21 — 14 stories.

WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning — The Hacker News
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack — The Hacker News
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution — The Hacker News
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware — The Hacker News
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign — The Hacker News
Software Provider to More Than 2,000 US Hospitals Says Hackers Stole Employee and Customer Data — The Record from Recorded Future News
ApolloMD Agrees to Pay $4.02M to Settle Data Breach Lawsuit — HIPAA Journal
Abbott Investigating Cyberattack Claims From Two Threat Actors — HIPAA Journal
Centers Laboratory Discloses Data Breach Affecting 542,000 Individuals — HIPAA Journal
23andMe Pays $18 Million to Settle Multistate Data Breach Lawsuit — HIPAA Journal
Romania Races to Restore Land Registry After Cyberattack Disrupts Property Market — The Record from Recorded Future News
More Than 1,000 Domains Illegally Streaming World Cup Games Seized, DOJ Says — The Record from Recorded Future News
Flock Safety Kills Acoustic System Designed to Detect 'Human Distress' — The Record from Recorded Future News
Illinois Governor Signs Frontier AI Model Law — Hunton Andrews Kurth Blog

Cyber Digest — 2026-07-20 · Critical NGINX Vulnerability (CVE-2026-42533) — Heap Buffer Overflow, DoS/RCE

Mon, 20 Jul 2026 00:00:00 GMT

2026-07-20 — 12 stories.

Critical NGINX Vulnerability (CVE-2026-42533) — Heap Buffer Overflow, DoS/RCE — The Hacker News
SonicWall SMA Zero-Days (CVE-2026-15409, CVE-2026-15410) — Exploited Before Disclosure — The Hacker News
wp2shell WordPress Core Flaw — Unauthenticated RCE, PoC Public — The Hacker News
UAC-0145 (Sandworm) Uses ClickFix CAPTCHAs to Infect Ukrainian Devices — The Hacker News
EU Orders Google to Open Android to Rival AI Assistants Under DMA — The Hacker News
Illinois Governor Signs Frontier AI Model Law (SB 315) — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
CISA Plans to Finalise Cyber Incident Reporting Regulations by September 2026 — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
23andMe Reaches $18 Million Settlement with States for 2023 Breach — The Record from Recorded Future News
Dairy Company Fairlife Suspends US Production After Cyber Incident — The Record from Recorded Future News
Scattered Spider Hackers Sentenced to 5.5 Years Over £29M Transport for London Hack — The Record from Recorded Future News
OpenSSL "HollowByte" Flaw — Memory DoS via 11-Byte TLS Request — OpenSSL "HollowByte" Flaw — Memory DoS via 11-Byte TLS Request
Trump Administration Unveils AI-Supported Clearinghouse for Cyber Vulnerabilities — The Record from Recorded Future News

Cyber Digest — 2026-07-19 · Joint Advisory: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

Sun, 19 Jul 2026 00:00:00 GMT

2026-07-19 — 23 stories.

Joint Advisory: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting — CISA
OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests — The Hacker News
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV — The Hacker News
New Jersey Adopts New Data Broker Registration Regime and Sensitive Data Sale Restrictions — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
Trump Administration Unveils AI-Supported Clearinghouse for Cyber Vulnerabilities — The Record
New GoSerpent Malware Targets Southeast Asian Governments and Diplomats — The Hacker News
Cyberattack on Japan's Largest Cold-Chain Operator Disrupts KFC and Supermarket Supplies — The Record
Two Scattered Spider Hackers Sentenced to 5.5 Years for £29 Million TfL Hack — The Record
EU Commission Unveils Cybersecurity and AI Action Plan — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code — The Hacker News
Microsoft Patches a Record 570 Security Flaws — Krebs on Security
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft — The Hacker News
All About Women's Care Data Breach Affects Up to 12,000 Patients — HIPAA Journal
Atrium Health Pays Up to $1.8M to Resolve Pixel Lawsuit — HIPAA Journal
Illinois Governor Signs Frontier AI Model Law — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
CISA Plans to Finalize Cyber Incident Reporting Regulations in September 2026 — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
European Commission Refers Four Member States to CJEU Over NIS2 Transposition Delays — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
23andMe Reaches $18 Million Settlement with States for Massive Breach — The Record
Cash App Owner to Pay $45 Million to Settle Allegations of Lax Security — The Record
Lessons Learned from CISA's Recent GitHub Leak — Krebs on Security
Dairy Company Fairlife Suspends Production in US After Cyber Incident — The Record
Madison Square Garden Kept a List of Gay Celebrities — Wired Security
Hackers Claim to Leak Stolen Madison Square Garden Data — Wired Security

Cyber Digest — 2026-07-18 · Joint Advisory: Russian State-Sponsored Cyber Actors Target Network Devices

Sat, 18 Jul 2026 00:00:00 GMT

2026-07-18 — 24 stories.

Joint Advisory: Russian State-Sponsored Cyber Actors Target Network Devices — CISA
Microsoft Patches a Record 570 Security Flaws — Krebs on Security
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code — The Hacker News
New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens — The Hacker News
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft — The Hacker News
Sandworm Hackers Have a CAPTCHA Trick for Ukrainians — The Record by Recorded Future
EU Orders Google to Open Android Mic, Camera, and Screen to Rival AI Assistants — The Hacker News
Illinois Governor Signs Frontier AI Model Law — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
CISA Plans to Finalize Cyber Incident Reporting Regulations in September 2026 — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
European Commission Refers Four Member States to CJEU Over NIS2 Transposition Delays — Hunton Andrews Kurth Privacy & Cybersecurity Law Blog
Lessons Learned from CISA's Recent GitHub Leak — Krebs on Security
All About Women's Care Data Breach Affects Up to 12,000 Patients — HIPAA Journal
Atrium Health Pays Up to $1.8M to Resolve Pixel Lawsuit — HIPAA Journal
May 2026 Healthcare Data Breach Report: 61 Breaches Reported — HIPAA Journal
Cash App Owner to Pay $45 Million to Settle Allegations of Lax Security — The Record by Recorded Future
23andMe Reaches $18 Million Settlement with States for Massive Breach — The Record by Recorded Future
Dairy Company Fairlife Suspends Production in US After Cyber Incident — The Record by Recorded Future
A Guide to OT Security Best Practices — SANS Institute Blog
Scattered Spider Hackers Sentenced to 5.5 Years for £29 Million Transport for London Hack — The Record by Recorded Future
FBI Seizes NetNut Proxy Platform, Popa Botnet — Krebs on Security
Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man — The Hacker News
CISA Tells US Agencies to Fix Security Bugs in as Little as 3 Days Thanks to AI Threats — Wired
Madison Square Garden Kept a List of Gay Celebrities — Wired
Hackers Claim to Leak Stolen Madison Square Garden Data — Wired