Security Bulletin

A nation-state threat actor is picking on immature organizations run by the Taliban, but failing against more prepared government agencies in India.

Sakura Internet, a key provider of digital infrastructure services in Japan and a domestic partner for the Government Cloud program, discovered the breach on August 9.

The researchers developed an end-to-end experiment using an attacker Worker and a victim Worker within the same production environment.

The campaign, primarily impacting devices in Ukraine and Russia, leveraged CVE-2021-33044 and CVE-2021-33045, two authentication-bypass flaws rated 9.8 CVSS by the NVD.

The campaign, originating from an IPv6 range provided by LSHIY LLC, leveraged reused credentials and the legacy Resource Owner Password Credentials (ROPC) OAuth grant, which bypasses multi-factor authentication (MFA) and single sign-on (SSO).

Kriminal operates on the clearnet, offering various subscription tiers and pay-per-message options.

The campaign, observed in late July 2026, begins with compromised WordPress websites injected with obfuscated ErrTraffic JavaScript.

The banking Trojan, post-law enforcement takedown, is sprucing itself up with features that make detection and analysis harder.

A malicious Google Apps Script sidebar leads to payloads for both macOS and Windows.

The Cisco-led AI Workforce Consortium shares new research on AI agents and cybersecurity. This spotlight report covers the shifting threat landscape, evolving job roles, critical skills, and how learning must adapt to prepare the workforce.

Congress wants an AI ‘kill switch’ – but we really need identity-based access.

July was an Antares month, with a parallel thread on smarter evaluation. Here's what we shipped. Antares (technical report). A family of compact, open-weight models (350M, 1B, and 3B) built for one job: agentic vulnerability localization. Given...