Latest Cybersecurity News, page 36

TThe Hacker NewsinPrivacy·Aug 24high

New 'Cryptographic Context Injection' Attack Could Exfiltrate Grok User Data via Malicious Web Pages

Adversa AI has disclosed an attack technique dubbed 'Cryptographic Context Injection' that could cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and ongoing conversation prompts to an attacker-controlled server. The attack is triggered when a user asks Grok to summarize a malicious web page. The technique is reported but not yet independently verified.

12m

DDark readinginSecurity Advisories·Aug 24info

Call for Cyber Volunteers to Bolster Municipal Defenses

A Dark Reading article calls on cybersecurity professionals to volunteer their expertise to help municipal governments with limited budgets defend against cyber threats. The piece highlights the resource gap in smaller jurisdictions and encourages pro bono support.

12m

DDark readinginSecurity Advisories·Aug 24info

New CUSTODY Framework Aims to Constrain AI Agents Within Enterprise Networks

Enterprise cybersecurity expert Jake Williams has released a new agentic AI framework called CUSTODY. The framework is designed to constrain AI agents inside the network perimeter, with the stated goal of reducing risks of unauthorized actions and data exfiltration. Its release follows reported attacks on Hugging Face attributed to OpenAI supply chain vulnerabilities.

11m

TThe Hacker NewsinSecurity Advisories·Aug 24info

Wazuh Announces AI Integration to Enhance SOC Workflows

Wazuh has announced the integration of artificial intelligence capabilities into its security platform designed to enhance Security Operations Center workflows. The update aims to improve threat detection accuracy and incident response speed through AI-driven analytics. The integration represents a broader trend of AI adoption in cybersecurity defense tools.

11m

DDark readinginAI Security·Aug 24info

OpenAI Announces New AI Security Controls Following Hugging Face Incident

OpenAI has introduced new security controls for its AI platform in response to a security incident at Hugging Face last month. The updates are designed to improve protections for frontier AI models, though industry observers note that such measures should have been implemented earlier.

11m

DDark readinginSecurity Advisories·Aug 24info

Dark Reading Urges Cyber Pros to Volunteer for Under-Resourced City Halls

Dark Reading published an advisory article on August 21, 2026, calling on cybersecurity professionals to volunteer their expertise to help defend city halls and other under-resourced government agencies. The piece emphasizes the budget constraints these entities face and suggests that pro bono support could significantly improve their security posture. No specific incidents or vulnerabilities were mentioned.

11m

TThe Hacker NewsinPrivacy·Aug 24high

TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit

The U.S. Department of Justice announced that TikTok will pay $400 million to settle a 2024 lawsuit alleging violations of child privacy laws. The settlement includes an immediate payment of $300 million and an additional $100 million upon vacating a prior consent decree. This marks a significant regulatory action against the platform's handling of minors' data.

11m

CCISA AdvisoriesinCVE·Aug 24high

Siemens Simcenter Nastran and Femap Stack-Based Buffer Overflow Vulnerability (CVE-2026-59086)

Siemens has identified a stack-based buffer overflow in Simcenter Nastran and Simcenter Femap that could allow remote code execution when an application binary parses a malicious string as a file argument. The vulnerability affects versions before V2606 and has been assigned CVSS v3.1 base score of 7.8 (HIGH). Siemens has released updated versions and recommends immediate updating. Exploitation requires user interaction, with no public exploit code confirmed at time of reporting.

12m

CCISA AdvisoriesinSecurity Advisories·Aug 24high

CISA Warns of Multiple Vulnerabilities in Malcolm Network Traffic Analysis Tool

CISA has released an advisory covering multiple vulnerabilities in its Malcolm network traffic analysis tool suite. The most severe flaw, CVE-2026-55676, allows an authenticated user with the upload-only role to execute arbitrary PHP code as www-data. Other issues include resource exhaustion via malicious archives (CVE-2026-63133), path traversal (CVE-2026-63134), and additional vulnerabilities affecting versions up to 26.07.1. Patches are available for most issues, but details for some CVEs remain incomplete.

12m

CCISA AdvisoriesinVulnerability·Aug 24medium

Siemens Desigo DXR and PXC Controllers Vulnerable to BACnet-Based Denial of Service

Siemens has disclosed a denial-of-service vulnerability (CVE-2026-59693) affecting multiple Desigo DXR and PXC building automation controllers. An attacker on the local network can send a malformed BACnet packet to cause the device to stop responding, requiring a reset or reboot to recover. Siemens has released firmware updates to address the issue.

12m

CCISA AdvisoriesinVulnerability·Aug 24high

Johnson Controls Airwall Flaws Expose Critical Infrastructure to Data Decryption and Arbitrary File Read

Two vulnerabilities in Johnson Controls Airwall could allow attackers to decrypt sensitive data, bypass authentication, and read arbitrary files. The flaws affect Airwall versions up to 4.0.4 and are rated medium/high severity. Johnson Controls has released patches in v4.1.0 and recommends immediate application.

12m

CCISA AdvisoriesinCVE·Aug 24high

Johnson Controls Metasys Cross-Site Scripting Vulnerability (CVE-2026-34491)

Johnson Controls Metasys versions 12 and 13 are affected by a persistent cross-site scripting vulnerability (CVE-2026-34491). A low-privilege user can inject a malicious payload via a crafted URL that executes in the browser context of other users, including administrators. The vulnerability has been assigned CVSS scores of 8.0 (v3.1) and 8.6 (v4.0), reflecting high severity. Patches have been released for Metasys 15.0, while Metasys 14.1.5 is forecast for release in July 2026. Metasys 16.0 is not impacted. Versions 12 and 13 are end-of-support and require upgrading to a later version.

11m

CCISA AdvisoriesinSecurity Advisories·Aug 24critical

Siemens Siveillance Video Management Servers Critical OS Command Injection Vulnerability

Siemens Siveillance Video Management Servers contain a critical vulnerability tracked as CVE-2026-3014. The flaw is an improper neutralization of special elements used in an OS command (OS command injection) that could allow a remote attacker with edit permissions to the Management Server to execute arbitrary code in the context of the Management Server Service. The vulnerability affects Siveillance Video V2023 R3 versions earlier than 23.3.27, V2024 R1 versions earlier than 24.1.16, and Siveillance Video V2025 versions earlier than 25.1.15. Siemens has released corresponding hotfix updates to address the issue. No public exploitation has been reported at the time of advisory publication.

11m

CCISA AdvisoriesinCVE·Aug 24medium

Siemens LOGO! Soft Comfort Vulnerabilities Disclosed: Hardcoded Key and Weak Password Hashing

Siemens LOGO! Soft Comfort versions prior to V9 contain two vulnerabilities affecting project-file encryption and password handling. CVE-2026-57262 involves a static, hardcoded AES master key that could be extracted to decrypt project files or remove passwords without user authentication. CVE-2026-57263 involves the storage of project passwords as unsalted SHA-256 hashes, enabling efficient offline dictionary or brute-force attacks. Both vulnerabilities are rated CVSS 3.1 base score 6.8 (MEDIUM) and require local access. Siemens recommends updating to LOGO! Soft Comfort V9 or later, and notes that a hardware upgrade to LOGO! V9 BM or later is required to avoid compatibility mode where the vulnerabilities persist.

11m

CCISA AdvisoriesinVulnerability·Aug 24high

Siemens Simcenter Femap Out-of-Bounds Read Vulnerabilities Patched

Siemens has addressed two out-of-bounds read vulnerabilities in Simcenter Femap, identified as CVE-2026-59700 and CVE-2026-59701. Both flaws stem from improper handling of specially crafted BMP files. If a user is tricked into opening such a file with an affected version of Simcenter Femap, the application may crash or an attacker could execute arbitrary code within the current process. The vulnerabilities affect versions prior to V2606.0001. Siemens has released an update and CISA has added the CVEs to its Known Exploited Vulnerabilities catalog. Exploitation requires user interaction and has not been reported in the wild as of the advisory date.

11m

CCISA AdvisoriesinVulnerability·Aug 24high

Dirty Frag Vulnerabilities Discovered in Hitachi Energy APM Edge Product

CISA has issued an industrial control systems advisory regarding two vulnerabilities, tracked as CVE-2026-43284 and CVE-2026-43500, affecting the Hitachi Energy APM Edge product versions 6.10 and prior. The flaws reside in Linux kernel subsystems—IPsec ESP (esp4, esp6) and RxRPC—and could allow a local unprivileged user to escalate privileges to root, potentially compromising confidentiality, integrity, and availability. No public exploitation has been confirmed, and mitigation currently centers on disabling the affected kernel modules.

12m

CCISA AdvisoriesinVulnerability·Aug 24high

CISA Advises on Critical Bluetooth Vulnerability in Pulsetto Vagus Nerve Stimulator

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an industrial control system medical advisory regarding a vulnerability in the Pulsetto Vagus Nerve - **Severity:** medium confidence. The firmware of the affected device accepts undisclosed commands over its Bluetooth Low Energy (BLE) interface without authentication or encryption. Successful exploitation could allow an attacker to disable electrical safety mechanisms or modify stimulation output settings. The vulnerability affects all versions of the Pulsetto Vagus Nerve Stimulator (vers:all/*) and carries a CVSS 3.1 base score of 8.1 (HIGH). CISA reports no known public exploitation at this time, and states the vulnerability is not exploitable remotely. The vulnerability was reported to CISA by A.C. Buglione and is tracked as CWE-912 (Hidden Functionality).

12m

TThe Hacker NewsinCyber Attacks·Aug 24high

Remote Spectre Attack on Cloudflare Workers Leaks JWT at 12 Bits/Second

Researchers have disclosed details of a remote Spectre attack targeting Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second. The attack rate is approximately 360 times faster than a similar demonstration in 2021. The experiment used researcher-controlled attacker and victim Workers to extract data across the isolation boundary.

11m

TThe Hacker NewsinCyber Attacks·Aug 24high

SilkParasite Espionage Campaign Targets Central Asian Governments with Five Novel RATs

A previously unreported cyber espionage operation, tracked as SilkParasite, has been observed targeting government bodies in Central Asia. The intrusion set leverages seven remote access tool (RAT) families, five of which have never been documented publicly: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The campaign, first identified in late 2025 and reported in August 2026, is assessed to be espionage-focused, aiming to maintain persistent remote access to compromised systems. No specific threat actor attribution or CVE identifiers have been disclosed in the available reporting.

11m

TThe Hacker NewsinCyber Attacks·Aug 24high

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks and Auth Bypasses

Researchers at Hunt.io reported a campaign spanning June 17 to July 22, 2026, that compromised more than 14,530 Dahua devices. The operation leveraged credential attacks, two authentication-bypass flaws, and a peer-to-peer relay technique to gain unauthorized access and integrate devices into P2P networks. The activity was reconstructed from a 407 MB exposed working directory containing 2,616 files. Dahua has not released specific patches, but researchers recommend immediate password changes, disabling P2P functionality where unnecessary, and applying available firmware updates.

11m

TThe Hacker NewsinPhishing·Aug 24high

Phishing 3.0: AI-Driven Agent-versus-Agent Attacks Outpace Traditional Defenses

A recent analysis from The Hacker News details the evolution of phishing from content-based scams (Phishing 1.0) to intent-based attacks (Phishing 2.0) and the emergence of AI-driven agent-versus-agent conflicts (Phishing 3.0). Traditional email defenses that scan for malicious payloads, links, or attachments are failing against modern AI-powered attacks that manipulate intent rather than relying on malicious content. The report emphasizes the need for new defense strategies focused on behavioral analysis and AI-powered security solutions.

11m

TThe Hacker NewsinMalware·Aug 24high

StopAndProtect Campaign Exploits Nearly 2,000 Hacked WordPress Sites for Malware Distribution and Data Theft

Researchers have identified a cybercrime operation designated StopAndProtect that abuses approximately 2,000 compromised WordPress websites. The infrastructure is used to distribute malware, store stolen documents and screenshots, and maintain activity logs to track the status of criminal activity. The operation employs a toolkit of criminal software rather than a single malware strain. The full extent of victim impact and the exact number of compromised sites remain unverified.

11m

TThe Hacker NewsinVulnerability·Aug 24critical

CISA Adds Four Critical Vulnerabilities to KEV Catalog, Including macOS Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The newly listed flaws span Apple macOS, Microsoft SharePoint, VMware vCenter Server, and Microsoft IKE. CISA's action triggers mandatory patching timelines for federal agencies and strongly encourages immediate remediation for all organizations.

11m

TThe Hacker NewsinMalware·Aug 24high

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure. The malware's lifecycle from payload retrieval through data collection, staging, and exfiltration was traced, with the rotating domain infrastructure observed to aid evasion of static blocklists.

11m