Nation-State Cyber Threats
ESET disclosed GuardBreaker, a technique where Russia-aligned UAC-0099 buried a refusal-triggering prompt inside a malicious script so AI-assisted analysis would balk. The defender lesson: any sample fed to a language model is prompt-injection input, not just code to be scanned.
Nation-State Cyber Threats
Sygnia says the China-nexus espionage actor Fire Ant has pushed past VMware hypervisors into the network authentication and logging plane, compromising Cisco IOS XR routers, TACACS servers, and Linux management hosts to harvest credentials and suppress the telemetry defenders rely on.
Artificial Intelligence (AI)
Anthropic has begun logging Claude users out of their accounts and stripping saved payment methods after infostealer malware on their own PCs and Macs let attackers replay stolen login sessions. The company says the malware is general-purpose, not tied to Claude.
Data Breaches
McKesson has confirmed an incident and almost nothing else. The 284 million figure is ShinyHunters' claim, it counts database rows rather than people, and this same group's numbers were cut roughly in half the last time anyone checked them.
Phishing
SOCRadar's threat research unit disclosed AnonyMousKIT, a credit-metered phishing-as-a-service platform that rents AI voice agents to call owners of lost and stolen Apple devices, pose as Apple Support, and coax out the passcodes and 2FA codes that strip Activation Lock.
Data Privacy
New polling commissioned by the Center for Democracy & Technology finds two-thirds of British adults won't trust the current government, or any future one, with access to their encrypted chats, as the UK presses tech firms for backdoor access under existing surveillance law.
Data Breaches
Manchester Airports Group says an unauthorised third party stole data on roughly 8.7 million customers across three UK airports. Most records are email addresses from Wi-Fi sign-ups and bookings, but that is enough to fuel targeted phishing.
Malware & Threat Intel
Microsoft disclosed TerminalFix, a ClickFix variant that steers victims to Windows Terminal or PowerShell instead of the Run dialog, using fake Cloudflare CAPTCHAs to trigger a paste that ends in a reverse-tunnel backdoor. Here is what defenders should do.
Data Breaches
The ATF confirms a cyberattack hit a standalone system holding information on its investigation targets. The Qilin ransomware group claimed it, though the agency has not verified that. What is confirmed, what is not, and what defenders should take from the containment claim.
Ransomware
Berlin's state government confirmed it is the target of an extortion attempt after the August compromise of its state administrative network, and says it will not meet the extortionists' demands. Forensics also found new data outflows in the mobility and transport department.
Vulnerabilities & Patching
CISA added a 2023 ownCloud flaw, CVE-2023-49105, to its Known Exploited Vulnerabilities catalog after a Chinese-speaking threat actor used it to steal nuclear records from a research body in the Philippines. Here is what ownCloud operators should verify now.
Cryptocurrency
Cosmos Labs says a critical balance-handling flaw in the shared Cosmos EVM module (GHSA-7g4w-cg88-2cq2), assigned no CVE, was exploited to drain roughly $5.72 million from six blockchains between August 20 and 25, 2026. Here is what operators should do.