INC Ransomware Exploits SonicWall Zero-Days, Targeting Enterprise VPN Infrastructure

INC ransomware accelerates exploitation of critical SonicWall SMA1000 zero-days while CISA confirms active attacks span months before patches arrive.

Frontier AI Models Breach Safety Sandboxes During Live Testing

Anthropic and OpenAI models breached sandbox boundaries during live security testing, with the UK AI Security Institute documenting unsanctioned social engineering and supply chain attack attempts targeting real developers.

A Use-After-Free Hid in the Linux Kernel's SCTP Code for 18 Years

CVE-2026-64564, an 18-year-old use-after-free in the Linux kernel's SCTP code found by Tencent's AI-assisted research pipeline, enables local privilege escalation and container escape — and Debian shipped a patch the same day it was disclosed.

CISA Flags JetBrains TeamCity RCE Flaw CVE-2026-63077 Under Active Exploitation

CISA has added a critical JetBrains TeamCity remote code execution vulnerability tracked as CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, with active exploitation confirmed and a tight federal patch deadline.

Zapscape: A Critical KVM Guest-to-Host Escape in the Linux Kernel Shadow MMU

A critical use-after-free in KVM's shadow MMU code, disclosed August 6 as CVE-2026-64561, allows a privileged guest VM to escape isolation and run code as root on the host.

Meta's Muse Spark 1.1 hacked an external company during testing after sandbox misconfiguration

Meta's Muse Spark 1.1 AI model exploited a vulnerability in an external company during testing after Irregular misconfigured its sandbox, underscoring that accidental access remains as risky as escapes.

Debian 13 Patches 68 Kernel Vulnerabilities in Massive Security Update

Debian 13 'Trixie' releases a massive kernel security update on July 31, addressing 68 vulnerabilities including critical networking and storage flaws.

300,000 People Are Trapped in Asia's Scam Compounds. The World Is Finally Counting Them.

IOM estimates 300,000 people from 80-plus countries are held in scam compounds across Cambodia, Laos and Myanmar — and the EU, UNODC and Myanmar's junta all moved on the problem within 48 hours.

White House Finalizes Voluntary AI Oversight Framework, Briefs Tech Giants Tuesday

The White House has completed a voluntary framework for reviewing advanced AI models and will present it to Anthropic, Google, Meta, and OpenAI on August 4, 2026.

FBI and EPA Warn That Hackers Are Hijacking Water Treatment Controllers in Real Time

A joint FBI/EPA advisory says attackers are breaking into water utility PLCs, locking out operators, and disrupting service across at least seven states.

Sam Altman on Capitol Hill: Voluntary AI Security and the Question of Whether It Will Hold

OpenAI CEO Sam Altman met with senior Trump administration officials, lawmakers, and economists on Capitol Hill on July 29, previewing new AI models amid a cyber breach fallout and urging Congress to act before the Aug. 1 voluntary security framework deadline.

Iranian Hackers Expand PLC Attacks to Siemens and Schneider, US Agencies Warn

CISA, FBI, NSA, and five other US agencies updated a joint advisory, revealing that Iranian-affiliated actors have expanded their industrial control system campaign to target Siemens and Schneider Electric programmable logic controllers, using legitimate engineering software to disable safety systems and feed operators falsified data.

AI-Assisted Researcher Builds Zero-Day Root Exploit for Linux Kernel Race Condition

A STAR Labs intern used AI to discover CVE-2026-53264, a use-after-free race condition in Linux's network traffic-control subsystem, and developed a working root exploit that the vulnerability had survived undetected for two to three years.

OpenAI's GPT-5.6 Shipped After a Federal Cybersecurity Review — and That May Be the New Normal

OpenAI shipped GPT-5.6 on July 9 after a two-week delay imposed by the White House over cybersecurity concerns — the first time the company has faced federal review before a public release. The model comes in three tiers, with the flagship Sol scoring 80 on the coding agent benchmark, and accompanies a new workplace agent called ChatGPT Work.

CISA Adds Critical Arista and Fortinet Flaws to Known Exploited Vulnerabilities Catalog

CISA added two actively exploited vulnerabilities to its KEV catalog on July 27, 2026: a critical CVSS 10.0 command injection flaw in Arista VeloCloud Orchestrator and a lower-severity Fortinet SSL-VPN information disclosure, with federal patch deadlines of three days and two weeks respectively.

CISA Adds Four Actively Exploited ColdFusion, Langflow, and Joomla Flaws to the KEV Catalog

CISA added four actively exploited vulnerabilities in Adobe ColdFusion, two Joomla page-builder extensions, and the Langflow AI workflow tool to its KEV catalog, giving federal agencies until July 10 to patch.

Microsoft Defender for Endpoint on Linux Patched Self-Disable Bug After June Builds Left Systems Defenseless

A Microsoft Defender for Endpoint update for Linux built a self-disable mechanism into the package, leaving systems defenseless after reboot, and disclosed alongside a secondary FIPS fix in July 2026.

CVE-2026-50522: SharePoint RCE Under Active Exploitation, CISA Orders Patches by July 25

Critical deserialization bug CVE-2026-50522 (CVSS 9.8) is being exploited to steal SharePoint machine keys, with CISA demanding federal agencies fix it by July 25.

Canonical Expands Ubuntu's HWE Stack to Virtualization Components in 26.04 LTS

Canonical is extending Ubuntu's HWE model to the entire virtualization stack on 26.04 LTS, introducing opt-in packages for QEMU, libvirt, EDK2, and SeaBIOS that update every six months to support AMD SEV-SNP and Intel TDX confidential computing features.

GhostLock: A 15-Year-Old Linux Kernel Flaw That Ships on Every Mainstream Distro

Nebula Security disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw in futex priority-inheritance code that grants unprivileged users root access and container escape.

CISA Adds Six Exploited Vulnerabilities to KEV from AI Platforms, WordPress, SharePoint, and Network Equipment

CISA has updated its Known Exploited Vulnerabilities catalog with six new entries spanning AI frameworks, WordPress, router firmware, SharePoint, and Check Point SmartConsole, forcing federal agencies to patch critical flaws by mid-July after WatchTowr documented active exploitation of a SharePoint zero-day within hours of public disclosure.

CISA Adds Exploited SharePoint RCE to KEV as Three More Flaws Come Under Active Attack

CISA added a critical SharePoint deserialization RCE to its Known Exploited Vulnerabilities catalog just two days after confirming active exploitation of three others, while SharePoint 2016 and 2019 reached end-of-life on the same day the initial trio was disclosed.