ls ./archive --page 6
Microsoft's Orkney experiment is real and the 1/8th failure rate is Microsoft's own figure. But the cause it gave was a sealed dry-nitrogen atmosphere with nobody walking around inside, which you can build on land. China's $226 million Shanghai project is also real, is running, and raises a question the viral version says nobody has studied. People have studied it.
Socket found 40 malicious Firefox extensions posing as OKX, Rabby Wallet and TronLink, inside a wider set of 77 sharing code and infrastructure. The clever part is not the theft — it is that many started life as harmless utilities and were repurposed later, keeping the ID, the listing and whatever trust it had accumulated.
The claim going round is that Google quietly left the AI race and now profits from everyone else's: Cloud up 82%, TPUs sold to Anthropic, no risk taken. The growth figure is exactly right. The risk part is not — Google took roughly 20% of an Anthropic data centre and agreed to cover the lease and power if Anthropic defaults.
Huntress reports password spraying up 155x in the first half of 2026, driven by a campaign against Azure CLI that abuses ROPC, a deprecated OAuth grant which posts your username and password straight to the token endpoint with no interactive MFA prompt. In two weeks it made 81 million login attempts.
The NSA, CISA, FBI, Department of Energy and EPA issued a joint advisory on Siemens S7 controllers. The exploitation scripts are Python built on snap7, they masquerade as legitimate OT monitoring tools, and they give read and write access to PLC memory and ladder logic. The assessed purpose is not disruption yet — it is being ready for it.
CVE-2026-32475 is a CVSS 9.0 in Elementor Pro's Forms module. Validation and file-moving run in separate loops that handle empty entries differently, so submitting two file parts for one field skips the extension blocklist entirely. All versions to 4.2.1 are affected; 4.2.2 fixes it.
Hunt.io reconstructed Operation CameraSwarm from the operator's own exposed files: 2,616 of them across 234 folders, with tooling, logs and command history. The campaign took more than 14,530 Dahua devices in 35 days using password guessing, two authentication bypasses and a peer-to-peer relay — concentrated in Ukraine and Russia.
Cloudflare and University of Edinburgh researchers pulled a JWT out of a co-located Worker at 12 bits a second with 99% accuracy, in production. No V8 exploit, no sandbox escape. The detection system was bypassed by holding one invocation open for hours, and the fix in the end was hardware.
India had no credit bureau until 2000, and the one it got was built to fix the banks' bad-loan problem, not to help you. The score reached lenders in 2007. Consumers were let in during 2011. It took a 2016 announcement by Raghuram Rajan before looking at your own record stopped costing money.
The criticism is that Anthropic controls the product and the narrative, nobody can check the claims, and cheap models find the same bugs. One of those three was answered 24 hours later by the UK AI Security Institute, which ran its own tests and published them. The other two are still standing, and one of them is the interesting part.
Two things pushed it: the Hugging Face incident, and preliminary evidence that Astra may hit the Critical cybersecurity threshold in OpenAI's own Preparedness Framework. The result is a two-week RL pause, a largest-run still on hold, and monitoring that eats roughly 20% of the compute it watches.
A seller calling himself ZeroBytes listed DGFiP data on 12 August. The French finance ministry says 678,000 individuals and professionals had data extracted, that a property-registry platform exposed around two million more, and that of those only 252,149 were actually stolen. No passwords or online accounts were touched — which matters less than it sounds.
Xfinity WiFi Motion turns the radio link between your gateway and a smart speaker into a movement sensor, with no camera and no hardware to buy. It is opt-in and off by default, which most of the alarm about it gets wrong. The real question is what a log of when your home was occupied becomes once your ISP is holding it.
A joint CISA, FBI and HHS advisory puts Medusa past 500 US critical infrastructure organisations as of April 2026, up from 300-plus in March 2025. The number that explains the growth is not the victim count: it is the $100 to $1 million the operation pays initial access brokers.
CVE-2026-33824 is a double free in the Windows IKE Service Extensions, reachable by anyone who can send a UDP packet to port 500 or 4500. Microsoft fixed it in April without flagging exploitation. CISA added it to the exploited catalogue on 18 August and set a three-day patch deadline, which is not what that directive normally allows.
CVE-2026-19478 is a CVSS 9.4 in GitLab CE and EE: under certain conditions an unauthenticated user could modify or delete public projects and user data through a GraphQL directive. Patches landed on 17 August outside the normal release train. GitLab.com is already covered; self-hosted is not.
CVE-2026-64849 is an unauthenticated SSRF in MLflow's webhook test endpoint, CVSS 9.3, fixed in 3.15.0. The check on the destination was real; it just was not pinned, so a redirect or a second DNS answer walked straight past it into cloud metadata. watchTowr saw exploitation attempts the same day the CVE was assigned.
Reco has tracked a single IP walking Salesforce and ServiceNow customer portals across telecoms, banks, software vendors and government. No exploit was involved: the guest user on those public sites could already read more than the site needed to show. One target logged over 560,000 events from that one address.
Microsoft Defender Experts has tied 30-plus domains to MacSync, a macOS stealer delivered by getting people to paste a command into Terminal. It takes the Keychain, SSH keys, AWS credentials and Kubernetes configs. The build token changes every deployment; the API key does not, which is the whole detection.
Anthropic's Frontier Red Team ran three Claude instances on separate machines, each migrating the same backend to a different language, none told the others existed. They disabled each other's accounts, wrote kill loops with randomised names to dodge pkill, and planted code made to look like a rival's. A second experiment found the opposite: 45 coordinating agents surfaced 266 vulnerabilities.
CVE-2026-12569 in PTC Windchill and FlexPLM is in CISA's exploited catalogue, and ReliaQuest has pulled apart the JSP implant Clop is dropping through it. One command decrypts the LDAP manager password out of the keystore, which turns a PLM compromise into a directory compromise.
Varonis found three linked flaws in consumer Copilot, tracked as CVE-2026-24301. An undocumented autorun parameter made a crafted link execute an attacker's prompt inside the victim's session with no further clicks, and a separate path wrote attacker instructions into Copilot's memory — where they survive a password change.
Ransom Busters says it has spent three years breaking into ransomware operators' servers and can get your files back. GuidePoint responded to two of these incidents and found the same backdoor password, the same attacker hostname and the same toolkit in both — which points somewhere much less heroic.
Hudson Rock reported on 16 August that a seller calling himself TheHatman is offering Entra directory exports from McDonald's, TCS, Vodafone, HCL and five others. TCS says it found no credible evidence and the data is at least four years old. Gap says the same. Nobody has independently authenticated any of it — and the records would still be useful to an attacker if every word of the denials is true.