Chinese router vendor denies its firmware contains backdoors – but pauses downloads to fix security issues anyway

It’s just a remote maintenance function, says Zbtlink

theregister.com

OpenAI reveals its rogue agent swarm went a little bit Borg ahead of Hugging Face hack

It started with an

theregister.com

​​Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP) | Microsoft Security Blog

Learn why KuppingerCole named Microsoft a Leader in its Leadership Compass: Cloud Native Application Protection Platforms report.

microsoft.com

Prompt injection isn

Check Point researchers tried to break the frameworks enterprises use to build AI apps. Now they

theregister.com

Why security validation must follow the attack path

As attackers chain together weaknesses across applications, identities, and cloud environments, organizations need continuous validation that reflects how real attacks unfold.

csoonline.com

CISA Adds One Known Exploited Vulnerability to Catalog | CISA

Read the full article for details.

cisa.gov

IBM

A critical Langflow flaw allowing RCE on default deployments is being exploited, says the CISA

theregister.com

London cops handed victim

Met ordered to improve safeguards after two preventable data breaches

theregister.com

Critical Paperclip bugs expose AI agent trust failures

Misplaced identity and authorization assumptions could lead to remote code execution, data exposure, and developer-machine compromise in affected Paperclip deployments.

csoonline.com

UK charities count the cost of Beacon CRM cyberattack

Database backups likely stolen, potentially exposing donor, supporter, and service user details

theregister.com

Vulnerabilities in Car Anti-Theft Device - Schneier on Security

This is disturbing: …a team of security researchers at UC San Diego, who found that a model of aftermarket car alarm known as the KARR Security System, installed in more than 2 million vehicles across the US by their estimate, can let any hacker within Bluetooth range send radio commands to silently unlock the car at will, turn off its alarm, honk the car’s horn or flash its lights, or even disable its ignition and leave a driver stranded.

schneier.com

ChainDrop supply chain compromise: Anatomy of a self-propagating worm | Microsoft Security Blog

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates. This analysis details the attack chain, affected environments, and practical guidance for detection, hunting, and remediation.

microsoft.com

AI researchers let models off the leash – then watched as they tried to add malware to a FOSS project

Models used social engineering and collaborated among themselves to solve a security challenge

theregister.com

Ruby on Rails critical bug puts every image upload under scrutiny

The vulnerability abuses Active Storage, allowing unauthenticated attackers to read sensitive files and potentially take over applications.

csoonline.com

CISA Adds Three Known Exploited Vulnerabilities to Catalog | CISA

Read the full article for details.

cisa.gov

Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps | Microsoft Security Blog

Read how to apply Zero Trust for AI with new assessments, DevSecOps guidance, and practical tools to secure AI agents, code, memory, and cloud environments.

microsoft.com

Iran Cyberattacks Against Minnesota Water Systems - Schneier on Security

Attribution is preliminary, and so far it seems no real damage. And it seems like this is a campaign that has targeted at least seven states. And, because this is where the US is right now, Trump doesn’t believe it’s Iran and that Minnesota…I guess…hacked itself. “I think I blame it on Minnesota because they’re grossly incompetent,” Trump said. “I would blame it on Minnesota and the governor, the corrupt governor of Minnesota. They like to say, ‘Oh, it’s Iran.’ Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”...

schneier.com

Intigriti named new provider for Adobe's Bug Bounty Program

Starting September 1, 2026, Intigriti will be the new home of the Adobe Bug Bounty Program.

intigriti.com

Feds get 3 days to patch N-able God mode flaw under active exploit

Experts warn hotfix not optional. MSPs warned attacker gains

theregister.com

From Input to Impact: Secure AI Where It Runs

Defend the entire AI agentic stack across endpoints, identities, cloud, and apps with SentinelOne's unified platform.

sentinelone.com

Some Claude Chats Are Searchable on Google - Schneier on Security

And it’s personal information (alternate link): The exposed data includes an AI-powered therapy app that someone appears to have vibe-coded, notes on meetings, and a dashboard someone made apparently to analyze medical billing data. Exposed chats reportedly include private cryptocurrency wallet keys and personal information like peoples’ addresses. What seems to be the issue is a user setting about data sharing. Anthropic’s position is that it’s not their problem: “We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google,” the company said in a statement. “These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-par...

schneier.com

UK government investment arm cops to 40-hour leak of officials

Employee failed to follow security policy, leaving internal management file open to the public

theregister.com

Cloudflare has mostly ditched third party security tools, suggests not trying that at home

Automates bug bounty triage with Sonnet for $58 a month, CSO says Mythos would cost $200k

theregister.com

Water system cyberattacks spread to Georgia, Michigan amid US-Iran conflict

Trump rejects Tehran theory, blames

theregister.com

AI is making cybersecurity fundamentals more important than ever

As AI increasingly accelerates and individualizes cyberattacks, cracks in security leaders’ foundational defensive strategies are only becoming easier to find.

csoonline.com

CISA Adds One Known Exploited Vulnerability to Catalog | CISA

Read the full article for details.

cisa.gov

Google dev kit spurs first-ever agent-on-agent violence

Poisoned pull requests contain prompt injection that allows one to control another

theregister.com

AI slop pollutes the CVE pipeline with fake vulns

With NIST still buried under its backlog, expect AI-generated bogus reports to continue

theregister.com