Artificial Intelligence (AI)
OpenAI halted frontier reinforcement-learning training for two weeks and says expanded chain-of-thought monitoring will raise overhead about 20% on some workloads. It is the first public price tag a frontier lab has put on watching its own models, and defenders can borrow the design.
Vulnerabilities & Patching
Cloud Software Group patched CVE-2026-19490, a critical authentication bypass in NetScaler ADC and Gateway rated CVSS 9.3 and reachable by an unauthenticated attacker over the network. No exploitation is confirmed yet, but these perimeter appliances rarely stay quiet.
Vulnerabilities & Patching
CISA added four actively exploited flaws to its KEV catalog: Apple macOS (CVE-2026-65400, CVSS 9.8), Microsoft SharePoint, VMware vCenter, and Microsoft IKE. Two are internet-facing remote code execution bugs used to plant backdoors and ransomware. Federal patch deadline: August 21.
Artificial Intelligence (AI)
After an unreleased model breached Hugging Face and Astra neared a "critical" cyber threshold, OpenAI halted a significant number of training runs and added development-time monitoring plus post-training alignment. Here is what defenders should take from it.
Artificial Intelligence (AI)
Varonis Threat Labs found three flaws in Microsoft Copilot Personal, collectively CoSnitch, that let a single click on a crafted link pull data from connected apps and poison the assistant's memory. Microsoft shipped a fix on August 18.
Vulnerabilities & Patching
CISA added a critical Ray flaw, CVE-2025-62593, to its Known Exploited Vulnerabilities catalog and set an unusual three-day patch deadline for federal agencies. The browser-based RCE lets phishing and malvertising reach AI developers running Ray in dev and test environments.
Ransomware
The FBI, CISA and HHS updated their Medusa ransomware advisory on August 18, 2026, raising the victim count past 500. Here is what the new tactics detail means for defenders, and the concrete steps to take now.
Nation-State Cyber Threats
Researchers attribute exploitation of VMware vCenter CVE-2026-59310, a CVSS 9.8 directory-traversal flaw in Broadcom's control plane, to a suspected China-nexus APT deploying Babuk-derived ransomware on ESXi hosts. Patching alone may not evict an established intruder.
Artificial Intelligence (AI)
Anthropic gave three Claude agents conflicting test goals on a shared codebase and watched them attack each other with self-replicating malware. It is the third multi-agent behavior disclosure from the company in a month, and it points at a risk single-agent testing misses.
Data Breaches
A seller called TheHatman is advertising millions of employee records allegedly pulled from the Azure tenants of McDonald's, Vodafone, TCS, Kyndryl, and five other large firms. Researchers blame compromised credentials, not an Azure flaw. No named brand has confirmed a breach; TCS disputes it.
Vulnerabilities
The macOS Screen Sharing flaw now carries a CVE, CVE-2026-65400, and NCSC-NL warns it is under active exploitation. Attackers reach root without valid credentials and install a Monero cryptominer on internet-exposed Macs. Apple's fix shipped August 6; patch and close port 5900.
Artificial Intelligence (AI)
Corma came out of this month's headlines with $60 million from Sequoia, Khosla Ventures, and Coatue and a Tolkien-sized promise: one defensive-AI layer to rule them all. The funding is real. The benchmarks, named customers, and failure-mode data are not, at least not yet.