OpenAI has introduced new security controls for its AI platform in response to a security incident at Hugging Face last month. The updates are designed to improve protections for frontier AI models, though industry observers note that such measures should have been implemented earlier.
Dark Reading published an advisory article on August 21, 2026, calling on cybersecurity professionals to volunteer their expertise to help defend city halls and other under-resourced government agencies. The piece emphasizes the budget constraints these entities face and suggests that pro bono support could significantly improve their security posture. No specific incidents or vulnerabilities were mentioned.
The U.S. Department of Justice announced that TikTok will pay $400 million to settle a 2024 lawsuit alleging violations of child privacy laws. The settlement includes an immediate payment of $300 million and an additional $100 million upon vacating a prior consent decree. This marks a significant regulatory action against the platform's handling of minors' data.
Siemens has identified a stack-based buffer overflow in Simcenter Nastran and Simcenter Femap that could allow remote code execution when an application binary parses a malicious string as a file argument. The vulnerability affects versions before V2606 and has been assigned CVSS v3.1 base score of 7.8 (HIGH). Siemens has released updated versions and recommends immediate updating. Exploitation requires user interaction, with no public exploit code confirmed at time of reporting.
CISA has released an advisory covering multiple vulnerabilities in its Malcolm network traffic analysis tool suite. The most severe flaw, CVE-2026-55676, allows an authenticated user with the upload-only role to execute arbitrary PHP code as www-data. Other issues include resource exhaustion via malicious archives (CVE-2026-63133), path traversal (CVE-2026-63134), and additional vulnerabilities affecting versions up to 26.07.1. Patches are available for most issues, but details for some CVEs remain incomplete.
Siemens has disclosed a denial-of-service vulnerability (CVE-2026-59693) affecting multiple Desigo DXR and PXC building automation controllers. An attacker on the local network can send a malformed BACnet packet to cause the device to stop responding, requiring a reset or reboot to recover. Siemens has released firmware updates to address the issue.
Two vulnerabilities in Johnson Controls Airwall could allow attackers to decrypt sensitive data, bypass authentication, and read arbitrary files. The flaws affect Airwall versions up to 4.0.4 and are rated medium/high severity. Johnson Controls has released patches in v4.1.0 and recommends immediate application.
Johnson Controls Metasys versions 12 and 13 are affected by a persistent cross-site scripting vulnerability (CVE-2026-34491). A low-privilege user can inject a malicious payload via a crafted URL that executes in the browser context of other users, including administrators. The vulnerability has been assigned CVSS scores of 8.0 (v3.1) and 8.6 (v4.0), reflecting high severity. Patches have been released for Metasys 15.0, while Metasys 14.1.5 is forecast for release in July 2026. Metasys 16.0 is not impacted. Versions 12 and 13 are end-of-support and require upgrading to a later version.
Siemens Siveillance Video Management Servers contain a critical vulnerability tracked as CVE-2026-3014. The flaw is an improper neutralization of special elements used in an OS command (OS command injection) that could allow a remote attacker with edit permissions to the Management Server to execute arbitrary code in the context of the Management Server Service. The vulnerability affects Siveillance Video V2023 R3 versions earlier than 23.3.27, V2024 R1 versions earlier than 24.1.16, and Siveillance Video V2025 versions earlier than 25.1.15. Siemens has released corresponding hotfix updates to address the issue. No public exploitation has been reported at the time of advisory publication.
Siemens LOGO! Soft Comfort versions prior to V9 contain two vulnerabilities affecting project-file encryption and password handling. CVE-2026-57262 involves a static, hardcoded AES master key that could be extracted to decrypt project files or remove passwords without user authentication. CVE-2026-57263 involves the storage of project passwords as unsalted SHA-256 hashes, enabling efficient offline dictionary or brute-force attacks. Both vulnerabilities are rated CVSS 3.1 base score 6.8 (MEDIUM) and require local access. Siemens recommends updating to LOGO! Soft Comfort V9 or later, and notes that a hardware upgrade to LOGO! V9 BM or later is required to avoid compatibility mode where the vulnerabilities persist.
Siemens has addressed two out-of-bounds read vulnerabilities in Simcenter Femap, identified as CVE-2026-59700 and CVE-2026-59701. Both flaws stem from improper handling of specially crafted BMP files. If a user is tricked into opening such a file with an affected version of Simcenter Femap, the application may crash or an attacker could execute arbitrary code within the current process. The vulnerabilities affect versions prior to V2606.0001. Siemens has released an update and CISA has added the CVEs to its Known Exploited Vulnerabilities catalog. Exploitation requires user interaction and has not been reported in the wild as of the advisory date.
CISA has issued an industrial control systems advisory regarding two vulnerabilities, tracked as CVE-2026-43284 and CVE-2026-43500, affecting the Hitachi Energy APM Edge product versions 6.10 and prior. The flaws reside in Linux kernel subsystems—IPsec ESP (esp4, esp6) and RxRPC—and could allow a local unprivileged user to escalate privileges to root, potentially compromising confidentiality, integrity, and availability. No public exploitation has been confirmed, and mitigation currently centers on disabling the affected kernel modules.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an industrial control system medical advisory regarding a vulnerability in the Pulsetto Vagus Nerve - **Severity:** medium confidence. The firmware of the affected device accepts undisclosed commands over its Bluetooth Low Energy (BLE) interface without authentication or encryption. Successful exploitation could allow an attacker to disable electrical safety mechanisms or modify stimulation output settings. The vulnerability affects all versions of the Pulsetto Vagus Nerve Stimulator (vers:all/*) and carries a CVSS 3.1 base score of 8.1 (HIGH). CISA reports no known public exploitation at this time, and states the vulnerability is not exploitable remotely. The vulnerability was reported to CISA by A.C. Buglione and is tracked as CWE-912 (Hidden Functionality).
Researchers have disclosed details of a remote Spectre attack targeting Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second. The attack rate is approximately 360 times faster than a similar demonstration in 2021. The experiment used researcher-controlled attacker and victim Workers to extract data across the isolation boundary.
A previously unreported cyber espionage operation, tracked as SilkParasite, has been observed targeting government bodies in Central Asia. The intrusion set leverages seven remote access tool (RAT) families, five of which have never been documented publicly: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The campaign, first identified in late 2025 and reported in August 2026, is assessed to be espionage-focused, aiming to maintain persistent remote access to compromised systems. No specific threat actor attribution or CVE identifiers have been disclosed in the available reporting.
Researchers at Hunt.io reported a campaign spanning June 17 to July 22, 2026, that compromised more than 14,530 Dahua devices. The operation leveraged credential attacks, two authentication-bypass flaws, and a peer-to-peer relay technique to gain unauthorized access and integrate devices into P2P networks. The activity was reconstructed from a 407 MB exposed working directory containing 2,616 files. Dahua has not released specific patches, but researchers recommend immediate password changes, disabling P2P functionality where unnecessary, and applying available firmware updates.
A recent analysis from The Hacker News details the evolution of phishing from content-based scams (Phishing 1.0) to intent-based attacks (Phishing 2.0) and the emergence of AI-driven agent-versus-agent conflicts (Phishing 3.0). Traditional email defenses that scan for malicious payloads, links, or attachments are failing against modern AI-powered attacks that manipulate intent rather than relying on malicious content. The report emphasizes the need for new defense strategies focused on behavioral analysis and AI-powered security solutions.
Researchers have identified a cybercrime operation designated StopAndProtect that abuses approximately 2,000 compromised WordPress websites. The infrastructure is used to distribute malware, store stolen documents and screenshots, and maintain activity logs to track the status of criminal activity. The operation employs a toolkit of criminal software rather than a single malware strain. The full extent of victim impact and the exact number of compromised sites remain unverified.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The newly listed flaws span Apple macOS, Microsoft SharePoint, VMware vCenter Server, and Microsoft IKE. CISA's action triggers mandatory patching timelines for federal agencies and strongly encourages immediate remediation for all organizations.
Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure. The malware's lifecycle from payload retrieval through data collection, staging, and exfiltration was traced, with the rotating domain infrastructure observed to aid evasion of static blocklists.
A JavaServer Pages web shell, attributed to the Clop ransomware group, has been deployed in the wild following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers. The shell functions as an extortion platform capable of mapping sensitive vault data and decrypting credentials. The vulnerability, tracked as CVE-2025-3866, affects enterprise Product Lifecycle Management environments. PTC and ReliaQuest have been referenced in connection with the flaw and its analysis, respectively. The full extent of victim impact and data exfiltration remains under investigation.
Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal, tracked collectively as CoSnitch. The flaws involve an undocumented URL parameter surfaced by the assistant that could allow a single click on a crafted link to silently exfiltrate data from connected apps and the Copilot session context. Microsoft has not yet released an official patch.
Security researchers from watchTowr and VulnCheck have reported two critical vulnerabilities currently being exploited in the wild. The primary flaw affects MLflow, an open-source AI platform, where a Server-Side Request Forgery (SSRF) vulnerability can be leveraged to steal cloud credentials and sensitive secrets. The second vulnerability impacts FUXA, an open-source SCADA/HMI platform designed for industrial automation and operational technology environments. Both products are witnessing malicious scanning and exploitation efforts, with affected instances likely exposed to the internet.
A threat actor identifying itself as Ransom Busters has been observed sending unsolicited emails to organizations affected by ransomware attacks. The group claims to have compromised ransomware group servers and offers to delete stolen data in exchange for fees ranging from $20,000 to $60,000. Security researchers at GuidePoint have flagged the activity as anomalous, noting that such proactive outreach from third parties is unusual in the ransomware landscape.
