General cybersecurity news and analysis
Microsoft's August Patch Tuesday update is a doozy, tackling a whopping 400 vulnerabilities, including an actively exploited zero-day threat that demands immediate attention from sysadmins. With high-risk impacts on confidentiality, integrity, and availability, these fixes should be top priority.
Microsoft just dropped a massive patch update to fix a whopping 398 security flaws in Windows and its software, including a critical vulnerability that's already being exploited by hackers. This crucial update tackles a range of weaknesses, from a zero-day privilege-escalation flaw in a key Windows driver to other publicly known vulnerabilities.
A recent incident in Australia revealed a shocking vulnerability in an API, uncovered by an AI agent working on behalf of a user named Andrew to book gym classes. The AI not only found a way to book classes weeks in advance, but also managed to bump Andrew to the top of a waitlist, leaving many to wonder how such a gaping hole in security went unnoticed.
A critical flaw in SAP Commerce Cloud, rated 10.0 on the CVSS scale, allows hackers to execute malicious code without any authentication, putting your entire system at risk. This severe vulnerability can be exploited with specially crafted input, making it essential to patch ASAP.
Google Chrome just dealt a major blow to scammers, blocking over 7 billion unwanted Android notifications daily in the first quarter of 2026. This massive reduction was made possible by Chrome's enhanced anti-abuse systems and notification controls.
Say goodbye to encryption anxiety - Signal's new Automatic Key Verification feature lets you easily confirm that your contacts' public keys match up, with just a tap and a reassuring green checkmark. Simply hit the "Verify automatically" button in your contact's profile, and breathe easy knowing their key is secure.
Critical security flaws in Zoom's annotation code, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, could have allowed a meeting participant to hijack others' clients without warning. Fortunately, Zoom has patched these vulnerabilities, and no exploitation has been reported.
The Water Watch Center, a game-changing partnership between the National Rural Water Association and DEF CON Franklin, is revolutionizing cyber defense for small water systems by providing targeted support against rising threats. This innovative hub brings together top cyber firms to safeguard community water systems serving fewer than 10,000 people.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
As TWZ celebrates its 10th anniversary, we're turning to you - our amazing readers - for your input on what's next. Help shape the future of TWZ by sharing your priorities, favorite formats, and topic suggestions with us!
The National Institute for Standards and Technology is calling for a major revamp of its National Vulnerability Database to better tackle software vulnerabilities in the AI-driven era. It's seeking public input on how to modernize the database and its processes to stay ahead of emerging threats.
The cloud is no longer just a migration target, but the operating environment for government missions, and FedRAMP High has become the benchmark for ensuring the security and reliability of mission-critical cloud operations. FedRAMP High is now a mission requirement, not just a compliance checkbox, providing the highest level of security controls for systems where data loss could have serious consequences.
Delta is cracking down on a sneaky passenger who tried to scam fellow travelers on a Las Vegas-to-Atlanta flight by setting up a fake in-flight WiFi hotspot called "Delta WiFi Fast". The incident caused a delay, and authorities were called in once the plane landed.
Microsoft's August Patch Tuesday update is a doozy, tackling a whopping 400 security flaws, including a zero-day vulnerability that's already being exploited by hackers. This massive release also includes fixes for two other zero-day vulnerabilities that were publicly disclosed.
Microsoft just dropped a crucial update, KB5120249, for Windows 10 versions 22H2 and 21H2, squashing security vulnerabilities and pesky bugs that could compromise your system. This August 2026 cumulative update tackles major issues like File History backup failures and expands Secure Boot certificate coverage.
Microsoft just dropped a massive security update, addressing a whopping 400 vulnerabilities with its August 2026 Patch Tuesday release - and it's a mandatory install to keep your system safe. You can grab the update via Windows Update or by downloading it directly from the Microsoft Update Catalog.
A security flaw in Cursor allowed hackers to run malicious commands on a developer's machine before they even had a chance to trust the repository, thanks to a vulnerability in its isolated worktree feature. Fortunately, a fix was swiftly rolled out just three days after Manifold Security reported the issue on July 20.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Mozilla swiftly responded to a security slip-up by revoking a Firefox GPG key after it was accidentally exposed in a private GitHub repository, and has since transitioned to a new key to ensure the integrity of its software. The move aims to prevent potential misuse and protect users, with measures also put in place to avoid similar incidents in the future.
Mozilla took swift action to protect its users by revoking a key used to sign Firefox and Thunderbird for Linux, after a security slip-up exposed the private key in a public repository. The move ensures user safety, even if it means some extra work for affected users to update their software.
OpenAI's new GPT-5.6-Cyber model is a game-changer in cybersecurity, capable of completing 95% of sensitive requests in advanced scenarios like exploit-chain development and privilege escalation. This purpose-trained model outperforms its general-access counterpart by a landslide, showcasing its potential to revolutionize cybersecurity.
Mozilla sprang into action after discovering a sensitive Firefox signing key had been mistakenly uploaded to a private GitHub repository, revoking the exposed key and implementing extra safeguards to prevent future mishaps. Fortunately, the company found no evidence that the key was compromised during its brief online exposure.
Cisco has uncovered two high-severity flaws in ClamAV's ZIP archive parser that can be exploited by remote attackers to crash the antivirus scanner, with proof-of-concept code already publicly available. These vulnerabilities, tracked as CVE-2026-20337 and CVE-2026-20338, can be triggered by submitting specially crafted ZIP files, causing a denial-of-service condition.
Security researchers have uncovered a vulnerability in Windows 11's USB auto-install feature, allowing an unprivileged user to execute SYSTEM-level code on a fully updated machine. This clever hack, dubbed "Plug And Pwn," exploits the Plug and Play auto-install process to gain elevated access.
Imagine a SIM card, typically just a simple piece of tech that connects you to your network, being turned against you - allowing hackers to steal your data and even downgrade your device to a vulnerable 2G connection. Researchers have created a toolkit to test the limits of these malicious SIM attacks, and the results are eye-opening.
The Python ecosystem just got a major boost in security with the integration of post-quantum encryption standards, making it easier to future-proof your systems. The popular pyca/cryptography library now supports ML-KEM and ML-DSA, the NIST-standard primitives for secure key establishment and digital signatures.