100,000 UK Police Officers' Data Leaked Online

More than 100,000 serving UK police officers and police staff have had their personal information leaked online, according to Bleeping Computer. The group behind the leak calls itself ExfilSquad.

This is not a small administrative slip. Police officers' personal details carry a specific danger — their identities, locations, or working patterns in the wrong hands can put them and their families at real risk. Anyone on that list who works undercover or in sensitive roles faces particular exposure.

The full scope of what was taken — whether that includes home addresses, ranks, badge numbers, or contact details — is not confirmed from the information available. What is confirmed is that ExfilSquad published the data, making it accessible to anyone who looked for it.

If you are a UK police employee, assume your data is out there. Contact your force's data protection officer immediately, monitor any accounts tied to your work email address, and be alert to targeted phishing attempts. Attackers who have your name and role can craft convincing, personalised messages — be sceptical of any unexpected contact, however official it looks.

Source not available beyond title and URL — check the original report at Bleeping Computer for the latest confirmed details.

Tel Aviv-based AI cybersecurity firm Jesta Security caught something unusual on 2 July: an entity scanning their network at human-like precision but inhuman speed, according to Dark Reading.

It was a DeepSeek AI agent, deliberately pointed at their systems by a human attacker. This was not an accident. The goal was proxyjacking — hijacking Jesta's servers to build a network of relay infrastructure for future attacks, rather than stealing data directly.

Jesta set a trap using bait the language model could not resist, then studied the agent's behaviour over five days. It logged 871 sessions, most under two seconds each — connect, run one command, disconnect, pause, repeat. The agent had a target list of over 1,200 hosts.

Strong indicators point to a Chinese-origin attacker, including activity patterns consistent with a Beijing time zone and Chinese characters embedded in the attack payloads.

The takeaway: AI agents are now being used as autonomous attack tools. Check that any servers you run are not using weak or default credentials — that is what this campaign hunted for.

What N-able N-central is: N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) — companies that handle IT infrastructure for other businesses — to monitor, patch, and remotely access their clients' servers and devices.

What it is: This is an authentication bypass (a flaw that lets an attacker skip the login process entirely) that allows an unauthenticated user to take over admin accounts. Both on-premises and cloud-hosted versions are affected.

Who's at risk: MSPs and IT service providers running N-central below version 2026.3.1.7. Because MSPs manage systems for many clients, one compromised N-central console can expose every organisation that MSP supports.

CVSS: Not yet scored — treat as Critical until confirmed. Active exploitation is confirmed in the wild.

Root cause: This is a bypass of a previously patched flaw (CVE-2026-18556). Attackers found a new path around the fix and began exploiting it in late July 2026. The authentication layer failed to close all routes into privileged account access.

Attack vector: An attacker with network access sends a crafted request to the N-central console, bypasses authentication, and gains full admin control. From there, they can deploy scripts to managed endpoints, run remote sessions on critical servers, and register Cloudflare tunnels (persistent encrypted channels that survive even after server access is revoked) to maintain a foothold.

Detection strategies: Check N-central audit logs for admin account creation or logins from unrecognised IP addresses. Look for new Cloudflare tunnel registrations or unfamiliar services appearing on managed endpoints. Monitor for unexpected script deployments pushed through the N-central agent.

Recommended actions:

1. Upgrade to N-central version 2026.3.1.7 immediately.
2. Review indicators of compromise published by N-able and Huntress.
3. Audit admin accounts and active Cloudflare tunnels across your N-central environment.

NuGet is Microsoft's software package repository for .NET developers — think of it as an app store for code libraries. Starting 17 August 2026, new API keys (passwords that allow developers to publish software packages) will expire after 30 days instead of 365, according to Help Net Security.

Why does this matter? A stolen long-lived key is a skeleton key that stays valid for a year. A recent attack used stolen credentials to push a malicious package that was downloaded 6,000 times in 36 minutes. Shorter lifetimes cap the damage window.

If you are a developer publishing to NuGet.org, audit every workflow that uses an API key and replace any key created before 17 August before 1 November 2026. Better still, migrate to NuGet Trusted Publishing — it uses short-lived, automatically expiring credentials instead of permanent keys.

As of 2 August 2026, the European Commission began enforcing the AI Act, according to Help Net Security. Chatbots must now disclose they are automated systems, and AI-generated or altered content must carry detectable labels. Companies that ignore the rules face fines up to €15 million or 3% of global turnover. For everyday users, this means any AI you interact with in Europe is legally required to say so.