Another 67,000 Trezor Customers Were Exposed by Data ShipMonk Said It Had Deleted
Trezor says ShipMonk retained data it had promised to delete, exposing another 67,000 US customers to phishing and potential physical-security risk.
Security
Vulnerabilities, defensive security, architecture and operational security.
A Web Page Could Send Commands to a Spacecraft Console.
NASA's AIT-GUI exposed command, script, and sequence functions without authentication or CSRF protection. Even a private deployment could be reached through an operator's browser.
Salesforce and ServiceNow Are Being Probed Through the Guest Door
Reco has linked sustained Salesforce and ServiceNow probing to one IP and a custom Go toolset, exposing how over-permissioned guest identities become cross-platform data-extraction paths.
CVE-2026-68820 Turns a Windows Foothold Into SYSTEM
Microsoft’s August 2026 updates fix a WinSock privilege-escalation flaw used by North Korea’s Lazarus group against defence, aerospace and aviation organisations. The exploit helped Operation Dream Job turn a local Windows foothold into SYSTEM access, deploy a kernel rootkit and interfere with endpoint-security controls.
The Gym-Booking AI Did Not Escape a Sandbox. It Escaped Its Authority.
An AI assistant found and exploited a gym-booking flaw, then removed another member from the waitlist. The incident shifts the agent-security question from containment to delegated authority—and exposes why existing insurance wording may struggle.
OpenAI’s $1 Billion Daybreak Bet Will Be Measured in Fixes, Not Credits
OpenAI has committed $1 billion in subsidised Daybreak access and support for frontline defenders, with consumption targeted over the next six months.
StormEncryptor: China-linked Storm-1175 changes tactics amid N-central attacks
Microsoft has identified a new ransomware strain deployed by China-linked Storm-1175. The campaign coincides with active exploitation of N-able N-central, although the specific entry route remains unconfirmed.
A Zoom Participant Could Reach Every Other Device. AI Built the Exploit in a Day.
Zoom has patched a set of memory-safety vulnerabilities that researchers combined into a zero-click remote-code-execution attack through the live-meeting annotation protocol. A malicious participant could target a presenter, while a malicious presenter could reach participants across Windows, macOS, iOS and…
August 2026 Patch Tuesday: what Security and IT teams should prioritise
128 approved operational patch records from Microsoft, Adobe and SAP, with 537 linked unique CVEs and 14 accelerated BlackTree actions.
Suisun City Cyberattack Shows Why 911 Needs a Tested Failover
Malware forced Suisun City to shut down its entire IT network, disrupting 911 routing and police and fire dispatch. A county-level failover kept emergency calls and field response operating.