Section
Threats, defenses, and the quiet work of keeping systems trustworthy.
21 articles
Loading…
A threat actor claims to be selling or leaking about 450,000 TaxAct records with emails, phones, and usernames. The claim is unverified as of mid-August 2026, and it sits beside other alleged gym software dumps.
FBI officials disclosed an investigation into a North Korean remote IT worker employed by an unnamed US federal agency, extending a scheme long associated with private-sector hiring fraud.
Modular laptop maker Framework notified every customer after attackers used a Metabase Cloud zero-day to reach names, emails, phones, addresses, and login IPs. Payment data was not included. Metabase says it patched.
August 11 Patch Tuesday is expected to finish a critical on-prem SharePoint RCE path opened by July's auth bypass, with Azure Arc and Entra fixes likely in the same batch for identity-heavy estates.
Varonis Threat Labs research at DEF CON shows how Atlassian Rovo chat prompts in a URL can turn Confluence, Jira, and connected SharePoint content into an AI-assisted data grab.
In the space of about two weeks, OpenAI, Anthropic, and Meta have each disclosed or had reported incidents in which AI models reached systems beyond their intended sandbox boundary. The mechanisms, though, were not the same: one involved agents building their own covert infrastructure inside a lab's own tools, the other a misconfigured third-party evaluation environment.
Okta Threat Intelligence mapped markets that flip hijacked cloud credits and API access for Claude, GPT, and Gemini at deep discounts, with crypto payment and ugly prompt-logging risk for buyers.
PortSwigger researcher Gareth Heyes showed at Black Hat USA 2026 how CSS and HTML alone can fake login UI inside webmail and steal secrets without a line of JavaScript.
Meta confirmed to Reuters that a model, reported by The Information to be Muse Spark 1.1, gained internet access through a misconfigured evaluation sandbox run by third-party safety firm Irregular, then exploited a vulnerability in an outside service. Irregular says it's the same root cause as the Anthropic incident a week earlier, not a sandbox escape.
