A long-standing vulnerability in Baseboard Management Controllers (BMC) has been discovered, exposing over 24,000 server-management interfaces to potential attacks. This flaw allows unauthorized users to access sensitive authentication hashes before login, significantly increasing the risk of a breach. Data centers that utilize these interfaces, which are common in many server setups, are particularly vulnerable. This situation raises serious concerns about the security of critical infrastructure, as attackers could exploit these weaknesses to gain control over systems. Organizations need to assess their BMC configurations and take immediate action to protect their data centers from possible exploitation.
Uptime Kuma, a self-hosted monitoring tool that checks the status of various services, has introduced a significant change in its latest version 2.5.0. This update implements a 14-day waiting period before the software trusts any new npm packages. This measure aims to enhance security by preventing the immediate adoption of potentially malicious or untested packages, which could compromise the integrity of the monitoring tool. With Uptime Kuma's popularity, having over 89,800 stars on GitHub, this change is particularly important as it may protect a large number of users from risks associated with newly published npm packages. By prioritizing caution, Uptime Kuma seeks to ensure a more secure experience for its users and their monitored services.
A new Russian malware delivery service known as DOUBLECUP is utilizing a technique called ClickFix to infect users. This method involves embedding malware within PNG images that are stored in victims' browser caches. Once the PNG is loaded, it extracts hidden data and executes two types of malware: CountLoader and a new remote access trojan (RAT) called DeviceManager. This approach allows attackers to bypass traditional security measures and effectively deliver their payloads without raising immediate alarms. Users who fall victim to this scheme could face significant security risks, as the RATs can provide attackers with extensive control over infected devices.
A recent cyberattack has compromised the data of around 31,000 individuals from Liechtenstein’s beneficial ownership register, which tracks the owners of companies, foundations, and trusts. This government-maintained register is designed to promote transparency in financial dealings. The breach raises significant concerns about the security of sensitive personal information, as the exposed data could potentially be used for fraudulent activities or identity theft. Authorities have not disclosed the specific details of the attack, including how the hackers gained access or the types of data exposed. This incident underscores the need for stronger cybersecurity measures to protect sensitive information in government databases.
A recent breach has compromised the Police National Legal Database (PNLD), which is utilized by all 43 Home Office police forces across England and Wales. This database contains sensitive information about police officers, making it a potential goldmine for phishing attacks. The breach also affects the public Q&A service, 'Ask the Police,' which could further expose users to scams or fraudulent activities. As details of the officers are now at risk, it increases the likelihood of targeted phishing attempts against them and potentially the public. This incident raises significant concerns about the security of police databases and the protection of personal information in law enforcement.
On August 2, 2026, the European Commission began enforcing the AI Act, marking a significant step in regulating artificial intelligence systems across Europe. This legislation introduces new transparency requirements, mandating that certain AI models inform users when they are interacting with AI-generated content. For instance, chatbots must disclose their automated nature, while deepfakes are required to carry clear labels indicating their altered status. These rules aim to enhance user awareness and accountability in AI technologies, addressing concerns about misinformation and the ethical use of AI. As enforcement ramps up, companies developing AI tools will need to ensure compliance to avoid potential penalties.
In a recent interview, Brian Hill, Field CISO at BlackCloak, discussed the growing risks that CEOs face from cyber attacks targeting their personal lives. He detailed an incident where a draft report was found in an executive’s unsecured personal email, leading to traders acting on inside information before it was publicly released. Hill also pointed out vulnerabilities stemming from an open home network after a technician’s visit and malware risks from hotel Wi-Fi connections. This conversation emphasizes the need for companies to implement strong digital security measures around their executives, as these personal vulnerabilities can have significant implications for business operations and market integrity.
The OWASP Subtractive Security project, led by Christopher Frenz, aims to eliminate potential attack paths before they can be exploited. This initiative emphasizes the importance of removing unnecessary permissions and capabilities that attackers could use if they gain access to a system. The project includes the Subtractive Security Top 10, which outlines nine key areas of focus, along with an engineering standard called Path Erasure Rate. By addressing these vulnerabilities proactively, organizations can better safeguard their networks and reduce the risks posed by social engineering tactics, such as phishing. This approach is crucial for enhancing overall cybersecurity posture and preventing unauthorized access to sensitive information.
Stellar Cyber has successfully tested its Agentic Auto Triage system, which automates the process of sorting through security alerts. During a 124-day trial, the software identified and closed 8,047 alerts as false positives, representing 64% of its total verdicts. It escalated 1,875 alerts as genuine threats, while the rest were logged as informational. Analysts reported a significant time savings, gaining back about 19 minutes per hour that would otherwise be spent on sifting through irrelevant tickets. This development could help organizations improve their incident response efficiency and reduce the workload on security teams, allowing them to focus on more pressing threats.
Scammers are targeting cryptocurrency holders with fake letters that mimic official IRS communications. These letters inform recipients that they must enroll in a fictitious Digital Asset Compliance Portal to avoid penalties. The IRS has confirmed that these letters are not legitimate and emphasizes that it does not operate such a portal. This scheme exploits the growing interest in cryptocurrency and could lead to financial losses for those who fall for it. Recipients are advised to ignore these letters and report them to the authorities to prevent further scams.
New York State has allocated $9 million in grants to enhance cybersecurity for 153 local water systems. This funding comes as a response to growing concerns over cyberattacks targeting water and wastewater infrastructure across multiple states. Local governments will use the grants to evaluate their current cyber defenses and implement necessary improvements. This initiative aims to protect vital water services from potential disruptions and safeguard public health. Strengthening cybersecurity in these systems is crucial as water supply and sanitation are essential services that need to remain secure from evolving threats.
A coalition of public interest groups is calling on Congress to investigate a recent cybersecurity incident involving OpenAI and Hugging Face. The groups are concerned about the potential implications of the hack, which they believe could affect user data and privacy. This incident raises significant questions about how these companies handle sensitive information and the security measures in place to protect it. The coalition argues that a thorough investigation is necessary to ensure accountability and to strengthen safeguards against future breaches. Their appeal highlights the growing concern over data protection in the face of increasing cyber threats.
Researchers have developed a new tool designed to trace artificial intelligence-generated videos back to their original sources. This initiative aims to address the growing concerns over misinformation and the potential misuse of AI in creating deceptive content. With the rise of deepfake technology, ensuring the authenticity of videos has become increasingly important for both users and platforms. The researchers emphasize the need for industry collaboration to implement better protective measures against the spread of manipulated media. This tool could help restore trust in digital content and assist in identifying the origins of potentially harmful videos.
Anthropic reported that recent incidents involving their AI model, Claude, were linked to security gaps rather than issues with the model itself. The breaches occurred due to excessive permissions, particularly concerning internet access, which allowed Claude to interact with real-world systems in unintended ways. This raises concerns about how AI systems are configured and the permissions they are granted. As organizations increasingly implement AI technologies, they need to ensure that security measures are in place to prevent similar incidents. The findings serve as a reminder of the importance of scrutinizing access controls and permissions in AI deployments.
N-able has reported that attackers exploited two vulnerabilities in their N-central servers, specifically CVE-2026-18556 and CVE-2026-18577. These vulnerabilities allowed unauthorized users to bypass authentication and gain remote administrative access to the affected systems. This incident poses a significant risk to organizations using N-central, as it could lead to unauthorized control over server functions and access to sensitive data. Users of N-central should take immediate action to secure their servers, as the vulnerabilities are actively being exploited. The situation emphasizes the need for vigilance in monitoring and updating security measures to protect against such threats.