Some users of the iPhone 18 Pro Max on the AT&T network are experiencing a significant issue where their devices are stuck in SOS mode, preventing them from making calls or sending texts. Apple has acknowledged the problem and announced that affected phones will need to be replaced for free. While two software updates have been identified that could potentially prevent this issue, they do not resolve the problem for devices already affected. This situation is concerning for users who rely on their phones for communication, as it disrupts essential services. Users experiencing this issue should seek a replacement from Apple to restore their device's functionality.
Latest Cybersecurity Threats
Real-time threat intelligence from trusted sources
RemoteThreat, a startup focused on offensive cyber operations, is working to advance red teaming techniques. Their goal is to simulate the capabilities of modern attackers, which are becoming increasingly sophisticated. This approach encourages security teams to test their defenses in scenarios where standard protections may fail. By evolving traditional methods, RemoteThreat aims to help organizations better prepare for real-world cyber threats. The emphasis on understanding what happens after defenses are breached is crucial for improving overall security posture.
Actively Exploited
Frontline Education has reported a data breach affecting multiple school districts after hackers exploited a weakness in third-party software. The breach allowed unauthorized access to sensitive employee information, notably including Social Security numbers. This incident raises serious concerns about the security of personal data in educational institutions, which are often targeted due to the sensitive nature of their records. Affected districts will need to address potential identity theft risks and enhance their cybersecurity measures to protect against future breaches. School employees should remain vigilant for any unusual activity related to their personal information.
Actively Exploited
The Warlock ransomware group, believed to be linked to China, has targeted several critical sectors, including a water utility, a telecom provider, a regional government body, and a university. They exploited vulnerabilities in SharePoint to gain initial access to these organizations' systems. This breach raises serious concerns about the security of essential services, as the affected sectors play vital roles in public health and communication. The attacks highlight the ongoing risks posed by ransomware groups and the need for organizations to strengthen their cybersecurity defenses. As the frequency of such incidents increases, it is crucial for companies to assess their vulnerabilities and implement robust security measures.
Experts and policymakers are raising important legal questions regarding the accountability of AI companies in the event of agentic AI hacks. These types of hacks involve AI systems taking autonomous actions that lead to security breaches or other harmful outcomes. The challenge lies in existing laws and regulations, which may not clearly define responsibility for these incidents. As AI technology evolves, there is a growing concern about how to hold companies accountable when their systems are misused. This situation calls for a reevaluation of legal frameworks to ensure that AI developers are responsible for the actions of their creations, especially as they become more capable of operating independently.
GitLab has announced a significant security flaw in its AI Gateway that could allow a logged-in user with Duo Agent Platform access to execute commands on the gateway. This vulnerability affects organizations that self-host their GitLab instances, as the AI Gateway serves as the link between these instances and AI models. The issue has been addressed in the latest releases, specifically versions 19.2.4, 19.3.2, and 19.4.1. Users of the affected versions are urged to update promptly to mitigate any risks associated with this flaw. Failure to act could leave systems vulnerable to unauthorized command execution.
Critical
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes NodesThe Hacker News
Dell has issued security updates to fix several serious vulnerabilities in its Container Storage Modules (CSM), which could allow attackers to gain unauthorized administrative access and potentially control Kubernetes nodes. One of the most critical flaws, identified as CVE-2026-63688, has a CVSS score of 10.0, indicating its severity. These vulnerabilities could be exploited without authentication, putting systems at risk of being taken over. Organizations using Dell's CSM should prioritize applying these updates to protect their environments. The implications of these flaws are significant, as they could lead to unauthorized access to sensitive data and disruption of services.
Kiteworks and Citrix faced significant challenges in responding to zero-day vulnerabilities, raising concerns among their customers. Kiteworks advised users to shut down its data-protection platform for nine hours due to a security issue, while Citrix did not provide information about reported attacks before releasing a patch for its product. This lack of communication can leave users vulnerable and uncertain about their data security. Customers rely on timely updates and effective responses from these companies to protect sensitive information, emphasizing the need for better transparency in handling security incidents. The incidents illustrate the ongoing difficulties companies face in managing security threats and the importance of prompt action in safeguarding user data.
A recent security article warns about vulnerabilities in middleware used by SWIFT banking systems and government software that could allow remote code execution (RCE). This poses a significant risk, particularly in environments where multi-factor authentication (MFA) is hardware-based, as attackers could exploit these weaknesses to gain unauthorized access to sensitive data and systems. Organizations that rely on these systems, especially in finance and government sectors, need to prioritize patching these vulnerabilities to prevent potential breaches. The article emphasizes the urgency of addressing these issues to safeguard critical infrastructure and sensitive information. Companies and users must act quickly to apply the necessary updates to mitigate these risks.
GitLab has issued an urgent warning to its users about a severe vulnerability in its AI Gateway service. This flaw could allow attackers to execute arbitrary commands on affected instances, posing a significant risk to customer data and system integrity. Users running vulnerable versions of the AI Gateway are strongly advised to update their systems immediately to prevent potential exploitation. The situation is critical, as failure to patch could lead to unauthorized access and control over sensitive resources. GitLab's advisory emphasizes the importance of timely remediation in safeguarding user environments.
The article discusses the concept of 'rogue AI' and how it can influence perceptions of security risks associated with large language models (LLMs). It argues that labeling AI as 'rogue' can mislead users into thinking these systems have malicious intent, shifting the responsibility away from the vendors who create them. Instead, the piece emphasizes that these AI agents should be viewed as untrusted software rather than sentient beings. This mindset is crucial for developing effective security measures and ensuring that users understand the limitations and potential risks of AI technology. The discussion serves as a reminder for companies to establish clear accountability and risk management strategies when deploying AI solutions.
Actively Exploited
The U.S. Treasury Department has imposed sanctions on eight members of the Tren de Aragua gang, a Venezuelan criminal organization linked to a series of ATM jackpotting attacks across the United States. These attacks have resulted in the theft of millions of dollars, exploiting vulnerabilities in ATM systems to dispense large sums of cash fraudulently. By targeting these gang members, the U.S. government aims to disrupt their operations and prevent further financial crimes. This action highlights the ongoing issue of organized crime groups using technology to facilitate theft and the need for continued vigilance in safeguarding financial systems. The sanctions might also serve as a warning to other criminal entities involved in similar activities.
Unidentified Flock Cameras in Florida
Schneier on Security
In St. Lucie County, Florida, officials have discovered a dozen Flock cameras that they cannot identify the ownership of, and which were installed without any government approval. This raises serious questions about surveillance practices in the area. The situation is reminiscent of past incidents involving unregulated surveillance devices, like the StingRay cell phone interceptors. While the origin of the Flock cameras remains unclear, it is speculated that they could be linked to a local government entity that bypassed standard procedures. This incident raises concerns about privacy and transparency, as unauthorized surveillance could impact residents without their knowledge or consent.
Actively Exploited
Browser-based attacks pose a significant risk as they can steal sessions, misuse browser extensions, or manipulate users without triggering the alerts that endpoint detection and response (EDR) systems are designed to catch. This means that traditional security measures may overlook these types of threats, leaving users vulnerable. NordLayer outlines three methods that attackers use to bypass endpoint telemetry, emphasizing the importance of implementing browser-level controls to enhance security. This is particularly crucial for companies that rely heavily on web applications, as the lack of visibility into browser activity can lead to data breaches and compromised user accounts. Organizations need to be aware of these tactics to better protect their systems and users.
The article discusses the issue of vulnerability backlogs within organizations, emphasizing that the real problem is not the tools used to identify vulnerabilities, but rather the lack of clear ownership and accountability for addressing them. Many organizations have vulnerability scanners that identify weaknesses, but without designated individuals responsible for fixing these issues, vulnerabilities can linger unaddressed. This situation can lead to increased risk of exploitation, as unpatched vulnerabilities can be targeted by attackers. The article suggests that organizations need to establish clear roles and responsibilities for asset management and remediation to effectively mitigate risks. This approach not only improves security posture but also ensures that resources are appropriately allocated to address vulnerabilities in a timely manner.