Clearing Cookies Did Not Break the Link. The Browser Called the App Through Localhost.
Meta Pixel and Yandex Metrica used Android localhost connections to link browser activity with native-app identities, bypassing familiar privacy controls.
China’s New Data Security Rule Starts Today. A Risk Assessment Is No Longer Just an Internal Document.
China’s new rules for network-data security risk assessments took effect on 20 August 2026. For organisations that process data in China, the important change is not simply another assessment obligation. The result may now have to leave the security team,…
US Charges Say Iran’s Academic Espionage Contractors Also Sold the Data They Stole.
US prosecutors allege Mabna Institute hackers served Iranian state clients while selling stolen research and university access through commercial sites.
The Firewall Did Not Need to Be Breached. Reloading It Was Enough.
Cisco says attackers are exploiting a denial-of-service flaw in ASA and Secure Firewall Threat Defense. The lesson is not only to patch the VPN edge, but to design for the moment the security device itself becomes unavailable.
JetBrains Left TeamCity Unpatched and Put Cadence Source Code and Credentials Within Reach
JetBrains closed the Cadence investigation after finding attackers could have reached current storage containing source code and credentials. The investigation is over. The risk is not.
The PLC Was Already Exposed. AI Collapsed the Expertise Barrier.
A joint US advisory warns that attackers are using AI-assisted snap7 scripts against exposed Siemens S7 PLCs. The decisive weakness is still reachability.
Five 10.0 Bugs, No Workaround: Cisco Hardens Crosswork and Secure Workload
Cisco fixed nine vulnerability classes across Crosswork and Secure Workload, including five with maximum CVSS scores. There are no workarounds, and several components must be upgraded together.
The Password-Reset Link Was Never Opened. The Account Was Still Taken Over.
A password-reset email is meant to be the point where an identity system proves that the person changing a credential controls the account. A critical Keycloak flaw allowed an unauthenticated attacker to bypass that step and set a new password…
The Hosting Systems Were Separate. 1.36 Million Customer Accounts Were Still in Scope.
Sakura Internet's investigation expanded from 583 rented-server accounts to a separate sales system holding 1.36 million customer accounts. Access was possible, but data exfiltration was not confirmed.
The Attack Needed No Exploit. ‘Anonymous’ Already Had Read Access.
ExfilSquad’s leaked data points to exposed Dataverse records, not a confirmed Dynamics exploit. Anonymous low-code permissions can be the entire breach path.
Apple Pulled iOS 27 Security Fixes Back Into iOS 26. AI Is Compressing the Patch Window.
Apple has moved fixes from next-generation betas into current systems. AI is shrinking the time enterprises have to test, approve and deploy patches.
Your WordPress Site Wasn’t the Victim. It Became the Attacker’s Infrastructure.
A compromised website is usually treated as the end of an incident: clean the files, reset credentials, restore the page and move on. The StopAndProtect operation shows why that model is incomplete. Almost 2,000 hijacked WordPress domains were not merely…