Vulnerabilities & Patching
CISA added CVE-2026-21962, a maximum-severity Oracle HTTP Server and WebLogic Proxy Plug-in flaw, to its Known Exploited Vulnerabilities catalog with a three-day federal deadline. Oracle shipped the fix in January 2026, but unauthenticated HTTP exploitation has run for months. Patch and hunt now.
Artificial Intelligence (AI)
Alabama Attorney General Steve Marshall has subpoenaed OpenAI over the Hugging Face hack its own cybersecurity model caused, opening the first state-level investigation into whether the company's safety failures violated consumer-protection law.
Data Privacy
The Dutch Data Protection Authority hit Uber with an EUR 825 million fine (about USD 965 million), ruling that software deactivated driver accounts from 2018 to 2022 with no human review. Uber is appealing. Here is what platform operators should audit now.
Policy & Government
The U.S. Justice Department says TikTok and ByteDance will pay $400 million to resolve a 2024 child-privacy lawsuit alleging COPPA violations. The deal pays $300 million now and $100 million once a court vacates an earlier Musical.ly consent decree.
Industrial Control Systems (ICS)
Five US agencies, led by NSA, FBI and CISA, warn that an active campaign is using AI-assisted development to build tools targeting internet-exposed Siemens S7 Series PLCs, in what may be the first US-agency flag of AI-assisted tradecraft against OT.
Vulnerabilities & Patching
CISA added four actively exploited flaws to its KEV catalog: Apple macOS (CVE-2026-65400, CVSS 9.8), Microsoft SharePoint, VMware vCenter, and Microsoft IKE. Two are internet-facing remote code execution bugs used to plant backdoors and ransomware. Federal patch deadline: August 21.
Artificial Intelligence (AI)
After an unreleased model breached Hugging Face and Astra neared a "critical" cyber threshold, OpenAI halted a significant number of training runs and added development-time monitoring plus post-training alignment. Here is what defenders should take from it.
Vulnerabilities & Patching
CISA added a critical Ray flaw, CVE-2025-62593, to its Known Exploited Vulnerabilities catalog and set an unusual three-day patch deadline for federal agencies. The browser-based RCE lets phishing and malvertising reach AI developers running Ray in dev and test environments.
Ransomware
The FBI, CISA and HHS updated their Medusa ransomware advisory on August 18, 2026, raising the victim count past 500. Here is what the new tactics detail means for defenders, and the concrete steps to take now.
Policy & Government
For the first time, the White House is letting vetted private firms go on the offensive against foreign cybercrime gangs — surveilling and disrupting criminal networks abroad under strict, government-approved rules, and a $1 million bond they forfeit if they break them.
Policy & Government
Germany's cabinet cleared the biggest overhaul of its spy laws since the war, letting the BND and BfV hack foreign systems, sabotage adversaries' supply chains, and feed false information to extremists at home. The domestic-disinformation power is already the most contested piece.
Artificial Intelligence (AI)
OpenAI launched GPT-5.6-Cyber, a cyber model tuned to refuse less, and gated it behind a two-tier Daybreak Blue and Red access program — one day after pausing Astra over the same capability class. What it means for defenders.