Hackers are increasingly buying expired domains to take advantage of their existing traffic and credibility to misdirect users toward scams and malware. According to Infoblox, a firm that specializes in DNS threat intelligence, these domains—known as dropcatch domains—can be quickly registered after they expire. In the first half of 2026 alone, cybercriminals purchased over 50,400 of these domains, allowing them to exploit unsuspecting users. This practice poses significant risks as it can lead to increased phishing attacks and the spread of malicious software. Users and businesses need to be aware of these tactics to protect themselves from falling victim to these scams.
A data breach involving RingCentral has potentially affected 1.6 million users. Hackers have publicly shared the stolen data, which includes personal information such as names, addresses, email addresses, and phone numbers. This incident raises serious concerns about user privacy and data security, as exposed personal details can lead to identity theft and phishing attacks. Companies like RingCentral must enhance their security measures to protect user data from such breaches. Users are advised to monitor their accounts for any unusual activity and consider changing their passwords to safeguard their information.
A recent data breach at ShipMonk has affected around 14,000 customers of Trezor, a cryptocurrency hardware wallet company. Hackers accessed sensitive shipping information, including names, addresses, email addresses, and phone numbers. This breach raises concerns about the potential for phishing attacks or further exploitation of the stolen data. Customers should be vigilant about suspicious communications, as the leaked information could be used to impersonate them. The incident highlights ongoing risks associated with third-party logistics providers and the importance of safeguarding customer data.
Trezor, a manufacturer of hardware wallets, has reported a data breach that has impacted nearly 14,000 customers. The breach occurred after ShipMonk, the company's shipping and logistics provider, was hacked. As a result, sensitive customer information, including names and email addresses, may have been exposed. Trezor has stated that no funds or private keys were compromised, but the incident raises concerns about the security of third-party services used by companies. Customers are advised to be vigilant regarding potential phishing attempts that may arise from this breach.
Johnson Controls Inc. has identified serious vulnerabilities in its Airwall software, specifically affecting versions 4.0.4 and earlier. These flaws could let attackers decrypt sensitive data, bypass authentication, and access unauthorized files on the system. One vulnerability involves a hardcoded cryptographic key that is the same across all installations, making it easier for attackers to exploit. Another allows for arbitrary file read through inadequate validation of user input, potentially exposing sensitive configuration files or credentials. Companies using affected versions are urged to upgrade to version 4.1.0 or later and implement security best practices to mitigate risks.
A serious vulnerability has been identified in Johnson Controls' Metasys building automation system, affecting versions 12, 13, 14, and 15. This flaw allows a low-privilege user to inject malicious code into the Metasys user interface via a specially crafted URL. This can enable session hijacking, where attackers could gain unauthorized access to the system as other users, including administrators. Organizations using these affected versions should take immediate action to apply the latest patches or upgrade to version 16.0, which is not impacted by this vulnerability. Without prompt remediation, the risk of exploitation could pose significant security threats to critical infrastructure sectors worldwide, including manufacturing and transportation.
A serious vulnerability has been found in the Flow Neuroscience FL-100 devices, which could allow attackers within Bluetooth range to manipulate brain stimulation settings. This issue arises from a hard-coded credential that is shared across all affected units, enabling unauthorized access to bypass authentication. The vulnerability impacts both the Flow Neuroscience FL-100 and Halo Neuroscience FL-100, versions released before July 2026. Users are urged to install the latest firmware updates via the Flow app to mitigate this risk. Given the nature of these devices, which are used in healthcare, the implications for patient safety are significant, making immediate action essential to prevent potential exploitation.
A vulnerability has been identified in AVEVA Enterprise SCADA that could allow attackers to manipulate serialized data, potentially leading to code execution during deserialization. This issue affects multiple versions of the software, including Enterprise SCADA 2025 and earlier versions back to 2022. Users are advised to switch from 'Binary Formatter' to 'Json' serialization and to change the 'AcceptBinaryFormattedData' setting to 'false'. Additionally, AVEVA recommends auditing device permissions and ensuring that only trusted users have operator rights. While there are no reports of active exploitation of this vulnerability, organizations are urged to take defensive measures to protect their systems. For detailed remediation steps, users should refer to the relevant knowledge base articles provided by AVEVA.
On August 10, 2026, cybersecurity officials from the US and South Korea issued a joint alert regarding a notable rise in Gunra ransomware attacks. This ransomware is targeting various sectors, including healthcare and critical infrastructure, posing a significant risk to organizations that may not be adequately prepared. The advisory emphasizes the need for improved cybersecurity measures to defend against these evolving threats. Companies are encouraged to enhance their security protocols, perform regular backups, and educate employees about phishing tactics that often facilitate these attacks. The rise in Gunra ransomware underscores the ongoing challenges organizations face in safeguarding their data and systems from malicious actors.
Hackers linked to the Russian group Sandworm have been targeting IT professionals and system administrators by sending fake job offers that include a malicious version of the WireGuard VPN client. This tactic has been in play since at least May, allowing attackers to compromise systems under the guise of a legitimate hiring process. Once installed, the trojanized VPN client can give hackers access to sensitive network information and potentially lead to larger security breaches. This incident is particularly concerning as it exploits the trust between job seekers and employers, highlighting the need for heightened vigilance among IT professionals regarding unsolicited job offers and software downloads. Organizations should ensure their employees remain cautious and verify the authenticity of any job-related communications or software.
A significant vulnerability has been identified in the Pulsetto Vagus Nerve Stimulator, affecting all versions of the device. This flaw allows attackers to exploit hidden commands via Bluetooth Low Energy (BLE) without any authentication or encryption. If successfully exploited, attackers could disable safety mechanisms or alter stimulation settings, posing serious risks to patients who rely on this medical device. Pulsetto has not collaborated with CISA to address the issue, leaving users vulnerable. It's crucial for users to contact Pulsetto directly for assistance and take defensive measures to protect their devices from potential exploitation.
As artificial intelligence advances, it is increasingly being used to enhance phishing attacks, credential theft, and social engineering tactics, making traditional security measures like passwords and multi-factor authentication less effective. Organizations are responding by adopting device trust as part of their Zero Trust security strategies. This means they are placing more emphasis on verifying the devices accessing their systems, rather than relying solely on user credentials. This shift is crucial as it addresses the growing sophistication of cyber attacks and the need for more reliable security measures. Companies that fail to adapt may find themselves vulnerable to breaches that exploit these outdated trust signals.
North Korea's Kimsuky hacking group has taken a significant step in its cyber operations by developing an offline AI system to enhance its phishing attacks and automate the creation of malware. Researchers from the South Korean security firm Genians discovered that the group is now running AI tools on its own servers, allowing them to connect various document-search capabilities to their existing files. This development indicates a shift from relying on public AI tools to creating a more tailored and potentially more effective toolkit for their cyber espionage activities. The implications of this move could lead to more sophisticated attacks on targeted organizations, particularly those in South Korea and beyond, as Kimsuky seeks to improve its efficiency and effectiveness in cyber operations.
Recent research has shown vulnerabilities in passkey systems designed to enhance online security by replacing traditional passwords and resisting phishing attacks. Three separate studies demonstrated methods for bypassing these protections without breaking the underlying cryptography. For instance, attackers were able to exploit signed authentication data exposed by Windows, leverage a cloud-synced passkey system compromised by existing malware on a victim's device, and other techniques. This is concerning for users and organizations relying on passkeys for secure authentication, as it suggests that even advanced security measures can be undermined. As these attacks become more sophisticated, it raises questions about the reliability of passkeys and the need for ongoing vigilance in security practices.
Levi Strauss recently fell victim to a cyberattack that involved social engineering tactics. Attackers gained access to the computers of three employees, allowing them to steal sensitive corporate data. This breach raises concerns about the effectiveness of employee training in recognizing phishing attempts and other social engineering schemes. The stolen data could potentially harm the company's reputation and lead to legal ramifications. Organizations must remain vigilant and strengthen their cybersecurity measures to prevent similar incidents in the future.