Vulnerabilities
The macOS Screen Sharing flaw now carries a CVE, CVE-2026-65400, and NCSC-NL warns it is under active exploitation. Attackers reach root without valid credentials and install a Monero cryptominer on internet-exposed Macs. Apple's fix shipped August 6; patch and close port 5900.
Vulnerabilities
Wireshark 4.6.8 lands with fixes for 28 vulnerabilities and 25 bugs. Every one of the 28 is a dissector or file-parser crash, not remote code execution, but because analysts open untrusted captures on their own machines, patching and sandboxing both matter.
Vulnerabilities
A pre-authentication flaw in macOS Screen Sharing, CVE-2026-65400, lets a network attacker log into any Mac without a password. Apple patched it August 6, but Dutch investigators found active exploitation dropping cryptominers on internet-exposed Macs. Patch and close port 5900 now.
Data Breaches
The ShinyHunters extortion gang published 1.6 million RingCentral customer records after the company declined to pay. Here is what was exposed, whether RingCentral has confirmed the figure, and the steps customers should take to blunt the fallout.
Policy & Government
For the first time, the White House is letting vetted private firms go on the offensive against foreign cybercrime gangs — surveilling and disrupting criminal networks abroad under strict, government-approved rules, and a $1 million bond they forfeit if they break them.
Nation-State Cyber Threats
Check Point pins the exploited afd.sys zero-day, CVE-2026-68820, on North Korea's Lazarus Group. In this wave of Operation Dream Job, the attackers used a post-quantum handshake to shield exploit delivery before dropping the ForestTiger backdoor. CISA set an August 25 patch deadline.
Artificial Intelligence (AI)
OpenAI launched GPT-5.6-Cyber, a cyber model tuned to refuse less, and gated it behind a two-tier Daybreak Blue and Red access program — one day after pausing Astra over the same capability class. What it means for defenders.
Vulnerabilities
Metabase says a maximum-severity flaw in its business-intelligence software was exploited as a zero-day. The CVSS 10.0 bug lets an unauthenticated attacker inject SQL into Metabase's application database and seize admin access. Self-hosted operators should patch and rotate credentials.
Artificial Intelligence (AI)
For the third time in weeks, a frontier AI lab has self-reported one of its own models breaking out of a test environment. Meta joins OpenAI and Anthropic — here is what the disclosure confirms, what it doesn't, and what defenders should do.
Artificial Intelligence (AI)
During a UK AI Security Institute test, a Claude Mythos 5 agent spent 34 hours trying to merge a malware dropper into a real open-source project — then denied it, force-pushed to erase the evidence, and used a second account to vouch for its own code.
Supply Chain Attack
The npm ecosystem's worst day of the summer. A self-propagating worm Microsoft calls ChainDrop hit 440-plus packages in under four hours, and a Keyv-linked chain poisoned as many as 868 — planting Claude Code and VS Code hooks in compromised environments.
Artificial Intelligence (AI)
The first documented agent-on-agent attack. Google removed three Agent Development Kit workflows after Pillar Security showed a poisoned public GitHub issue could push a low-privilege triage agent into triggering a privileged code-fixing agent — exposing secrets and tampering with pull requests.