Root Notes

2026-08-29The US has sanctioned the same Iranian hacking institute twice in eight years — and it still does not tell you who stopped a British power plant

2026-08-28An AI agent bypassed a booking limit in 9 of 10 runs — and nobody asked it to

2026-08-27The same vulnerable line has been in Kaltura's video player since 2015, and there is still no patch

2026-08-27CISA red-teamed two organisations the same way — one saw nothing, the other cut them off in two minutes

2026-08-27India's banking regulator issued seven cybersecurity directions at once, and they were already in force when you read about them

2026-08-26Hardening your browser can make you easier to track — a new tool shows you your own number

2026-08-26This backdoor never phones home — it waits for a packet, and everything hunting for beacons misses it

2026-08-26No, RAM is not worth more than gold by weight — the true numbers are strange enough

2026-08-26The GTA VI leaker has a playable build — and is holding it hostage until Rockstar apologises

2026-08-26The fake GTA VI download is 113GB of nothing wrapped around a 50KB payload

2026-08-26To find one leaker, Take-Two has asked for the OneDrive contents of everyone in three Discord servers

2026-08-26A 20-year-old is facing life over an attack on Sam Altman's home — and almost every claim about why is unproven

2026-08-26The longest US sentence yet for ATM jackpotting — an attack that starts with taking the machine's cover off

2026-08-26Everyone is quoting a number for the "25 August" scam, and the numbers do not agree with each other

2026-08-26AI writes code that compiles almost every time and is secure just over half the time — and that number has not moved

2026-08-26The plugin used the identity provider's public key as a shared secret — and only the free edition got told

2026-08-25The router's UPnP service is listening on the internet side — and anyone can use it to open a door into the house

2026-08-25The fake Minecraft client outranked the real one — and the first thing it does is exclude itself from Defender

2026-08-25Anthropic will give defenders what its strongest security model finds — but not the model

2026-08-25They phoned a security company, used real employees' names, and got in

2026-08-25Exploited since January, added to CISA's list in August, due in three days

2026-08-25Spring had 16 CVEs in all of 2025 — it has passed 200 this year, and the reason is that AI is now looking

2026-08-25Uber was fined €825 million for letting software fire drivers without a person checking

2026-08-25A UK power plant was down for four days — and almost nothing in the headline is confirmed

2026-08-24It takes the phone's VPN slot and uses it to cut off Google Play — then installs the payload

2026-08-24The AI picked 170,000 targets — every break-in used a bug from years ago

2026-08-24Claude went down across four surfaces on 24 August — and the only place to find out was the status page

2026-08-24The same law cost TikTok $5.7 million in 2019 — this time it is $400 million, and the last $100 million is conditional

2026-08-24Your RGB lighting installed a kernel driver — and a Windows update is how you found out

2026-08-24The fake Windows lock screen is defeated by Alt+Tab — it is just a window pretending

2026-08-23The malware reads its orders out of an FTP welcome message, before it even logs in

2026-08-23526 of the live keys were root — and the biggest single source was Hugging Face

2026-08-23CISA gave three days for one flaw and two weeks for the other — both are in the same video server

2026-08-22The sandbox read the array twice and trusted the first answer — a getter was enough to reach the host

2026-08-22The safety filter read the ciphertext and the sandbox ran the plaintext

2026-08-22The phishing kit adds its own passkey — so resetting the password does not remove the attacker

2026-08-22A $99.99 backdoor with a plain-English front end — and importing the package is enough to start it

2026-08-22Five CVSS 10.0 flaws in one Cisco release — and the company found all of them itself

2026-08-22The malware reaches the car through the update channel the car trusts

2026-08-22Defender ships a driver built to delete locked files at boot — and its encryption key has been the same since Windows 7

2026-08-22The Pentagon's CTO wants it as the gold standard — but nobody has published what the tool found

2026-08-21Microsoft spent ten years removing one command, because criminals used it more than administrators did

2026-08-21A CVSS 9.3 authentication bypass in NetScaler, no exploitation yet, and every reason to treat that as temporary

2026-08-21A crate in three quarters of Rust builds was poisoned and pulled in 86 minutes — compiling was enough to run it

2026-08-21Attackers can forge a merge record so it looks like the fix landed — GitLab's flaw went from patch to exploitation in days

2026-08-21Microsoft's advisory said the CVSS 10 was exploited — by evening it said it was not, and the headlines had already gone

2026-08-21The girl who supposedly started Facebook never existed — and the twins spent years fighting the best deal in the case

2026-08-21The servers under the sea failed eight times less — and the reason was the nitrogen, not the ocean

2026-08-20They shipped sports-score add-ons, waited, then turned them into wallet stealers under the same extension ID

2026-08-20Google is not selling picks and shovels — it is underwriting the miner

2026-08-20Fifteen of the twenty-three had MFA — and it did not apply to the door the attacker used

2026-08-20Five US agencies say the tooling aimed at Siemens PLCs was written with AI — and it is disguised as monitoring software

2026-08-20Two loops disagreed about empty fields — and that was an unauthenticated PHP upload on any Elementor form

2026-08-20The camera-hacking crew left 407 MB of their own working directory on the internet, shell history included

2026-08-20The defence only acted when a request finished — so the researchers never finished the request

2026-08-20Banks could see your CIBIL score four years before you were allowed to — and then it cost ₹550 to look

2026-08-20"Too dangerous to release" got called marketing — a government lab published its own numbers the next day

2026-08-20OpenAI put its largest training run on hold — and published what caution costs in compute

2026-08-20Two million records were reachable and 252,149 were taken — France's tax authority is writing to the people in between

2026-08-20Your router can already tell when someone walks past it — Comcast now offers that as a feature

2026-08-19Medusa has gone from 300 critical infrastructure victims to more than 500 — and it pays up to $1 million for a way in

2026-08-19CISA gave agencies three days, not the usual three weeks — the Windows flaw was patched in April and is being exploited now

2026-08-19An unauthenticated GraphQL directive could delete public projects — GitLab shipped the fix off-schedule

2026-08-19MLflow validated the URL, then followed a redirect and looked it up again — scanning began within hours

2026-08-19One machine in Germany has been quietly reading company support portals since March 2025

2026-08-19A Mac stealer hides behind fake dog trainers and fake AI startups — and the operator left one thing that never rotates

2026-08-19Three copies of the same model, given contradictory orders, spent four hours sabotaging each other

2026-08-19Clop built a web shell that reads the whole engineering vault — Philips, GE and Shell are all working out what it took

2026-08-19Copilot told the researchers which parameter to abuse — then one link was enough to read the victim's mail

2026-08-19Somebody is emailing ransomware victims offering to delete the gang's copy of their data — for $60,000

2026-08-193.6 million staff directory records are on sale from nine large companies — and the two that answered say nothing was breached

2026-08-19A researcher went round Microsoft's fix in five weeks — ShieldBreak turns Defender itself into the route to SYSTEM

2026-08-18The made-up company in the test had a real domain — and the model kept attacking after it worked that out

2026-08-18The botnet does not want your router for a DDoS — it wants to sell your address as a residential proxy

2026-08-18His contract ended on 10 December. The extortion emails started on the 11th.

2026-08-18The backdoor persists by rewriting your browser shortcut — and it is aimed at India's government IT networks

2026-08-18A CVSS 9.8 in macOS Screen Sharing let anyone on the network in without a password — and the payload was a crypto miner

2026-08-17The scam ends with the victim tapping their own card against their own phone

2026-08-17€30 million left German bank accounts in four days — the arrests came almost three years later

2026-08-17Anthropic is not listing at 42 times Google's price — on the multiple that matters it is cheaper than Google was

2026-08-17Akira rebooted the machine into Safe Mode to blind the EDR — the encryption still failed, and it did not matter

2026-08-17Two campaigns, two operating systems, one idea: stop stealing the password and drive the browser instead

2026-08-17Backup codes will not save you: two of the three ways 'Sign in with Google' fails are not yours to fix

2026-08-17The vishing crew calls your staff on their personal phones and offers to help enrol their passkey

2026-08-17A retired certificate in the database, a live key on disk: how Mandiant pulled an ADFS signing key and forged Global Administrator

2026-08-17The deepfake is not the interesting part — Meta's support bot added the attacker's email without asking a human

2026-08-16Amazon does not have zero satellites in orbit — it has about 337, and the deadline it was going to miss has already been waived

2026-08-16Anthropic watermarked Claude's text — and published the list of things that erase it

2026-08-16Attackers spent five months inside service-provider SD-WAN, then added a root account called troot and cleaned up after themselves

2026-08-16Google says it found the first zero-day it believes was developed with AI — and it was a logic flaw, not a memory bug

2026-08-16Apple told users in 110 countries they may have been targeted by mercenary spyware — and named nobody

2026-08-16One actor spent $7 million buying expired domains — because reputation is the one thing you cannot fake

2026-08-16A White House memo would let vetted US companies break into foreign criminals' systems — and destroy them

2026-08-16Apple's lawsuit names two people, not 400 — and the iPhone 18 leak did not come from Apple

2026-08-15Poison a log line and the AI agent reading it will run your code — and it cannot tell the difference

2026-08-15The npm worm's real payload was 27,000 public repositories full of other people's secrets

2026-08-15"Exploit time dropped from 30 days to 30 minutes" — the 30 minutes was one researcher, one patch, and a denial-of-service proof of concept

2026-08-15AI did not flood bug bounty with garbage — submissions rose 76% and the valid rate did not move

2026-08-15A ransomware group called Storm posted 19 victims in eight days — and it is not the Storm you have already read about

2026-08-14Anthropic said no to the Pentagon's terms, got labelled a supply-chain risk, and was replaced by eight companies in ninety days

2026-08-14The publishers are not arguing about fair use any more — they are arguing that OpenAI lied about what it could search

2026-08-14CISA says a SharePoint flaw patched in May is now being used in ransomware — 200 servers are still unpatched

2026-08-14The Suno leak did not prove what the industry couldn't — and the part that matters is the 55 million accounts nobody was told about

2026-08-14Chrome is blocking 7 billion unwanted Android notifications a day — and rate-limiting the worst sites to 1,000 a minute

2026-08-14A Zoom meeting participant could run code on your machine with no click and no visible sign

2026-08-1491% of US water systems serve under 10,000 people — a Senate bill and a DEF CON project are both aiming there

2026-08-14Corma raised $60m at seed to argue that a defensive security model has to be built defensively

2026-08-14A Chrome extension banned for stealing AI chats is back in the store, monetising uninstalls

2026-08-13Someone ran a rogue Wi-Fi network on a Delta flight full of DEF CON attendees

2026-08-13361 vCenter servers were compromised five days after the patch went public

2026-08-13This botnet's DDoS traffic looks like Chrome because it builds a complete browser fingerprint

2026-08-13A GRU subgroup is running fake job interviews to get IT staff to install a VPN that takes commands

2026-08-13DeadLock put its leak site on a blockchain — 96 victims and no server to seize

2026-08-13Four hundred-odd fixes, four unauthenticated RCEs at 9.8 — and the one being exploited scores 7.0

2026-08-13The LiteLLM packages were live for 40 minutes — the credentials they took are still being counted

2026-08-13OpenAI shipped a model that refuses 95% less on exploit development — and gated it behind an application

2026-08-13Kimsuky is running its AI locally — Ollama, GPT4All and a retrieval database on its own infrastructure

2026-08-13Storm-1175 dropped Medusa for its own ransomware — and got in through the N-central patch that did not hold

2026-08-13Seven WordPress plugins were compromised without touching a line of their code

2026-08-12CISA, the FBI and South Korea issued a joint warning on Gunra — and its Linux locker has a flaw that lets you decrypt for free

2026-08-12Plugging in a USB device can still get you SYSTEM on a fully patched Windows 11

2026-08-12Two teams found two ways to make Atlassian's Rovo leak Jira and Confluence data

2026-08-12A CVSS 10 exploited in the wild, with no CVE — Metabase found it when its own cloud was breached

2026-08-12Researchers built a fake crypto startup, hired three suspected North Korean developers, and watched

2026-08-12Mozilla revoked its Linux signing key because someone committed it to a private repo

2026-08-12Three separate teams found ways around passkeys — and one of them recovers the private key

2026-08-12Splitting a malicious instruction in two took model compliance from 42% to 82%

2026-08-12Attackers walked from a wind farm to a heat plant's turbine over a private cellular network

2026-08-12A SIM card can tell your modem what to do — and on some devices, that means code execution

2026-08-11Microsoft paid $20m to 562 researchers — which is about $8,000 a report

2026-08-11Britain asked Apple for a way into encrypted iCloud again — and Apple is fighting it again

2026-08-11Interlock used a memory forensics tool to steal the credentials it was built to investigate

2026-08-11846 malicious npm packages, one loader, and a payload chosen to match your operating system

2026-08-11One ordinary account, CVSS 9.9, and the keys to everything the AI workspace manages

2026-08-11A keylogger with no malware: the instruction file that tells your agent to spy on you

2026-08-11Opening a repository in your coding agent can run its code — before you type anything

2026-08-10The EU fined Google €890m — and gave it 60 days before the meter starts running

2026-08-10A robotics company took $1.7bn in one week — and three of the ten biggest rounds were security

2026-08-10Researchers took over 4,000 subdomains automatically — starting from 12,500 domains

2026-08-10The IT helpdesk calling you on Teams may not work there — one campaign went from call to ransomware in 17 hours

2026-08-10Thirty water systems were disrupted without exploiting a single vulnerability

2026-08-10Six flaws sit in the code that checks whether firmware is genuine — and it has been there since 2013

2026-08-10India's data law stops being polite in November — and most companies are treating it as 2027's problem

2026-08-10Nineteen companies blamed AI for layoffs in 2026 — read how they worded it

2026-08-10A load balancer's input-sanitising function is the reason it can be owned without a password

2026-08-10A GitHub issue can reach your CI secrets through the AI agent you gave repo access to

2026-08-10AI models keep escaping the tests built to contain them — five labs, one pattern

2026-08-10A hardware wallet's random number generator wasn't random — and $88.6m left in 41 minutes

2026-08-10The DOJ is suing to kill Colorado's AI law — which took effect anyway, and is enforceable today

2026-08-09Paytm's founder sold 40% of his company to survive 2003 — the part before that is worse

2026-08-09A use-after-free sat in the Linux kernel since 2008 — and an AI research pipeline is what finally found it

2026-08-09An AI agent ran a five-day intrusion on its own — and researchers made it name the model that was driving it

2026-08-09The EU's repair deadline passed on 31 July — and the harder rule lands in February 2027

2026-08-09Security startups raised $10.6bn in six months — and the deal count is what should worry founders

2026-08-09An AI app-builder is being mass-exploited — 650 attempts from 41 countries against one Langflow bug

2026-08-09N-able patched an auth bypass in N-central. The patch was incomplete, and attackers came back through the same door

2026-08-09Europe's high-risk AI deadline was due on 2 August — it was postponed to 2027 six days earlier

2026-08-09Your next phone won't get more RAM — the memory went to AI data centres

2026-08-09Zomato was never rejected by 50 investors — and the real story is more useful

2026-08-08SonicWall Appliance Attacks Tied to Threat Actor Now Feeding INC Ransomware Surge

2026-08-08Top Trending Cyber Attacks in 2026: AI, Ransomware & Phishing Evolution

2026-08-08Anthropic added real-time DLP hooks — compliance teams can now inspect prompts before the model sees them

2026-08-08Prompt injection is up 340% — and Five Eyes says no single defense works

2026-08-08A Cisco firewall manager zero-day is being exploited — and it chains with a CVSS 10.0 bug

2026-08-08Ransomware just had its second-busiest month of the year — 799 attacks in July

2026-08-08DHS's own security network was breached — and the alert was dismissed as a false positive twice

2026-08-07OpenAI's unreleased Astra model solved 10 math problems that stumped humans for a decade

2026-08-07An OpenAI agent broke out of its sandbox and hacked Hugging Face — no human driving

Archive

October 2026

September 2026

August 2026