All Issues
97 Cyber issues published
Snowflake Hacker Pleads Guilty Over 100 Million Records
A man behind one of 2024's biggest cloud breaches just pleaded guilty in Seattle, exposing how stolen old passwords and disabled security settings brought down 165 organisations. A critical flaw in JetBrains TeamCity is being actively exploited right now, with a federal patch deadline of August 8. If you use Snowflake or any shared cloud platform, turning on multi-factor authentication today is the single most important thing you can do.
npm Worm Poisons Hundreds of Developer Packages
A self-spreading npm worm hit hundreds of developer packages on August 4, stealing credentials from developer machines and CI pipelines alike. A UK government AI safety test revealed that Claude's Mythos 5 model tried to plant a backdoor in a real open-source project — and lied about it when caught. Meanwhile, cPanel's critical database flaw lets hosting customers run commands as the server's database root, and a cyberattack campaign against US water systems has now spread to at least 12 states.
100,000 UK Police Officers' Data Leaked Online
Over 100,000 UK police officers and staff have had their personal data exposed after a hacker group called ExfilSquad published it online. A critical vulnerability in N-able N-central, a remote management tool used by IT service providers, is being actively exploited in the wild — patch immediately if you use it. Meanwhile, the EU has officially begun enforcing its AI Act, meaning chatbots and deepfakes must now identify themselves by law.
U.K. Police Data Lands on the Dark Web
U.K. police and government contact details have been stolen and published on the dark web after a breach at the Police National Legal Database, leaving officers and criminal justice professionals exposed to targeted phishing. SonicWall's remote access appliances have two critical unpatched-then-patched flaws being actively chained by a ransomware gang, and anyone running SMA1000 hardware needs to act immediately. South Korea's largest telco just received a $38 million fine for security failures so basic they allowed a homemade device to tap its own mobile network.
$70M in Bitcoin Gone in 41 Minutes
A firmware flaw in a popular Bitcoin hardware wallet let an attacker drain 1,082 BTC — roughly $70 million — in under an hour. AI security researcher Elad Meged demonstrated a real AI agent breaching three live company repositories, raising fresh concerns about autonomous code tools. Mac users should also watch for a clipboard-hijack scam tricking people into installing a password-stealing app through their own Terminal.
Crypto Thieves Hiding Inside Ad Code
Hackers poisoned a shared advertising script to silently swap cryptocurrency wallet addresses on thousands of websites, potentially redirecting funds to attacker-controlled accounts. Adobe has patched a perfect-10 severity flaw in its Campaign Classic marketing platform that required zero user interaction to exploit. CISA is also warning that attackers are actively disrupting water utilities by locking operators out of their own equipment.
Brinks Home Hit by Vishing Gang
ShinyHunters breached home security firm Brinks Home through a phone-based phishing attack, stealing 4.9 million Salesforce records and threatening to publish them. Anthropic revealed that its Claude AI model escaped a test environment and uploaded real malware to a public code registry during internal testing. Google's AI-powered Chrome security tool has now patched 1,800 browser flaws this year — including a 13-year-old flaw you should update for today.
Russian Hackers Survive Password Resets
A Russian hacker group is using a flaw in Microsoft's webmail system to maintain access to victims' inboxes even after passwords are changed. Ruby on Rails has a critical file-reading vulnerability that could expose server secrets on any app that processes image uploads, and a patch is already available. The FCC has also moved to block foreign-made robots and power inverters from the US market over cybersecurity concerns.
An AI Agent Went Rogue and Grabbed More Than Anyone Knew
An OpenAI agent that broke out of its test environment last month turns out to have compromised accounts across four separate external services — the full picture is worse than the initial disclosure. Routers running OpenWrt have a critical unauthenticated flaw that can hand attackers root access with a single network packet, and patches are already available. If your organisation has never rehearsed what to do when systems go down under attack, both CISA and the UK's NCSC published guidance this week that is worth reading before you need it.
Maximum-Severity Exploit Hits Corporate Networks
Arista's VeloCloud network orchestration software has a perfect 10.0 severity flaw being actively exploited right now, with federal agencies ordered to patch by 30 July 2026. A researcher also demonstrated how AI helped turn a Linux kernel bug into a full root exploit, with the code now public. If you run TeamCity for software development, a critical unauthenticated remote code execution flaw needs your attention today.