Boston Scientific experienced a cybersecurity incident starting August 25, 2026, that disrupted its global operations, including the ability to process and ship customer orders. The attack caused a network outage affecting access to certain operating systems and business applications. The company is still investigating the full scope, nature, and impact of the incident, including operational and financial effects. It is currently unclear if any data breach occurred or if a ransomware or extortion group is involved. No known threat actor has claimed responsibility.
This article discusses the limitations of traditional security data, such as logs and events, which represent only a fraction of the full context needed for effective AI-driven security. It emphasizes the need for complete, high-fidelity data from multiple sources including network telemetry, identity information, end-user data, and proprietary business assets to enable AI to detect complex attack chains and insider threats. The piece also highlights challenges related to data privacy and sovereignty when integrating sensitive data into AI security systems. It argues that the future effectiveness of AI in security depends on access to comprehensive data sets within an organization's own controlled environment.
The US government disrupted a Chinese state-sponsored hacking platform operated by the group QTFY, which provided hacking services to the Chinese government and others. QTFY used two main tools: QScan, which scanned for vulnerable IoT devices, and QTRouter, a botnet that obfuscated malicious activity. The disruption involved seizing domains critical to the operation of these tools, rendering them inoperable. QTFY targeted multiple sectors including military, critical infrastructure, government, telecoms, and education, with some attacks reportedly successful against high-profile US entities. The group exploited vulnerabilities in various commercial products and maintained ties with other Chinese cyber espionage groups. The FBI advisory highlights QTFY's active role in offensive cyber operations against Chinese critical infrastructure. No active exploits or patches are relevant since this is a disruption operation against a threat actor infrastructure.
A pro-Russian hacker group named Server Killers claimed responsibility for a major denial-of-service cyberattack targeting Norway's public digital services managed by the Norwegian Digitalization Agency (Digdir). The attack, ongoing for three days, aimed to disrupt services including a unified login system for citizens. Despite the attack's scale, the agency maintained service availability nearly continuously. The group declared cyber war on Norway following Norway's renewed security cooperation with Ukraine. Norwegian officials have not commented on the claim. This incident is part of broader malign cyber activities linked to Russia targeting European countries amid geopolitical tensions.
This entry references the ISC Stormcast podcast episode dated August 27th, 2026, published by the SANS Internet Storm Center. The content is a security news update with no specific vulnerability, exploit, or threat details provided.
DaemonCore Linux is a Debian 13–based Linux distribution designed for authorized penetration testing, defensive security, incident response, forensics, and cybersecurity education. It includes a lightweight XFCE desktop, live USB boot with optional persistence, and a graphical installer. The distribution comes preloaded with a curated set of security tools for network discovery, wireless security, service assessment, web application testing, password auditing, forensics, reverse engineering, and development. Security defaults include a non-root live session, enabled firewall, disabled unnecessary network services, and common privilege escalation protections. The project is currently in early development and not yet a stable release. It is intended only for use on systems and networks with explicit authorization for testing.
GPUThor is a newly disclosed Rowhammer attack targeting NVIDIA Ampere-class GPUs with GDDR6 memory, including RTX A4000, A4500, A5000, and A6000. It bypasses NVIDIA's ECC protections by exploiting undocumented GPU behaviors and a non-uniform hammering pattern to induce high bit-flip rates. This enables denial-of-service conditions and root-level privilege escalation by corrupting GPU page tables. The attack was demonstrated to cause GPU resets and eventual hardware marking for replacement. NVIDIA recommends enabling SYS-ECC and IOMMU/DMA isolation, monitoring error telemetry, and restricting untrusted workloads. Complete protection likely requires future hardware-level defenses and stronger multi-bit ECC. No bit flips were observed on tested GDDR6X or HBM2e GPUs using the same attack patterns.
Meta has agreed to a proposed settlement of up to $18 billion with a bipartisan coalition of 52 attorneys general regarding allegations that Facebook and Instagram were intentionally designed to promote compulsive use among children and teenagers. The settlement addresses concerns about social media harms to minors but does not describe a specific technical vulnerability or exploit.
This content discusses the importance of auditing administrative rights in Microsoft Entra ID directories. It highlights common issues such as excessive admin privileges, outdated admin accounts, and the risks posed by users who have changed roles or left the organization but still retain admin access. The article provides PowerShell commands to enumerate directory roles and their members to help administrators identify who has privileged access. The focus is on ensuring that only appropriate personnel have admin rights to prevent accidental or intentional misuse.
Boston Scientific, a major medical technology company, experienced a cyberattack that disrupted its IT systems globally, impacting network availability and access to certain business applications, including order processing and shipping. The company detected the incident on August 25, 2026, and activated its incident response procedures, engaging external cybersecurity experts. The nature, scope, and full impact of the attack remain under investigation, with no disclosed details about the attack vector, threat actor, or data compromise. Operations continue to be disrupted, and the timeline for full restoration is unknown. No ransomware or data extortion claims have been reported at this time.
Trail of Bits tested the ability of a modern AI agent, GPT-5.6-Cyber, to escape a commonly used sandbox isolation mechanism implemented as an off-the-shelf virtual machine (VM). The AI successfully escaped the VM environment three times using multiple vulnerabilities, including three zero-day exploits and one patched vulnerability not yet included in the tested kernel distribution. This demonstrates that standard VM sandboxing is insufficient to contain advanced cyber-capable AI agents.
Microsoft is testing new privacy controls in Windows 11 that allow users to manage which desktop applications can access sensitive resources such as the camera, microphone, and precise location. This initiative aims to enhance user privacy by providing more granular control over app permissions. The feature is currently in testing and no security vulnerability or exploit is reported in this context.
In July 2026, over 100 internet-exposed water and wastewater systems in the United States were targeted in cyberattacks linked to Iranian threat actors. These attacks primarily exploited programmable logic controllers (PLCs) connected directly to cellular modems. While no significant disruptions were reported, the incidents raised concerns about the security of operational technology (OT) in critical infrastructure. CISA has issued guidance urging organizations to reduce internet exposure by inventorying internet-accessible systems, removing unnecessary exposures, changing default passwords, applying security updates, enforcing multifactor authentication, and routing remote access through secure gateways. The attacks highlight risks associated with leaving industrial control systems reachable via public internet or cellular connections. The affected states include at least Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama. CISA continues to recommend regular reassessments of network exposure and third-party connections to mitigate future risks.
This article discusses the limitations of multi-factor authentication (MFA) in providing true identity assurance. It explains that successful MFA only confirms control of authenticators at a point in time, not the legitimacy of the identity behind them. Attackers can exploit weaknesses in identity verification processes such as enrollment, account recovery, and session management to bypass MFA protections. The article emphasizes the need to distinguish identity verification, authentication, and identity threat detection as complementary but distinct security functions. It advocates for a dynamic approach to identity confidence that includes ongoing monitoring and re-verification when risk is detected. MFA remains critical but should not be mistaken as a complete solution for identity security.
The ISC Stormcast for August 26th, 2026 is a daily security news podcast episode published by the SANS Internet Storm Center. It provides general information and updates related to cybersecurity but does not contain specific threat or vulnerability details.
OpenKAT is an open-source project initiated by the Dutch government designed to monitor, record, and analyze the status of information systems. It integrates various network scanning tools and external databases to identify vulnerabilities and configuration errors, producing accessible reports to improve system security. The project is modular and extensible, allowing customization for different environments. There is no indication that OpenKAT itself is a security vulnerability or threat. Rather, it is a security tool aimed at vulnerability detection and system monitoring.
A user reports unexpected URL wrapping in emails from their CEO, where links are rewritten to a domain 'linkprotect.cudasvc.com'. The organization is not a Barracuda customer and does not use Barracuda add-ons, yet the wrapped links have appeared since late 2025 and recently caused email delivery issues with a client using Proofpoint email filtering. The cause of the wrapping and the sudden failure of these links is unclear.
A self-hosted EDR agent named Sentora had multiple critical authentication and authorization bugs, including an unauthenticated remote uninstall endpoint accessible to anyone on the LAN. The root cause was a common design flaw where the system trusted caller-supplied identity from various sources such as URL paths, headers, and request bodies without proper validation. Other issues included permissive authentication accepting any non-empty key, unauthenticated automation reporting that could fake containment success, LDAP injection in login, and missing authorization checks on multiple routes. The author discovered these issues through code review and automated tests, and has since fixed them on the main branch.
TRACE is an open standard for AI runtime attestation governed by the Linux Foundation. Developed by AMD, Intel, Microsoft, OPAQUE, and TII, TRACE provides a hardware-backed, cryptographically verifiable record of AI agent runtime environments, software executed, policies applied, and data classification. It aims to ensure trust and compliance for AI workloads across cloud, confidential computing, and sovereign infrastructure. TRACE combines existing standards into a unified evidence layer to support secure AI deployments. The initiative addresses the need for verifiable evidence as AI agents move into production environments handling sensitive data.
Alice, formerly ActiveFence, has raised $140 million to enhance defenses for AI models and enterprise guardrails. The company focuses on securing AI systems against vulnerabilities and adversarial attacks by stress-testing foundational models before release and providing continuous runtime protections. Alice leverages a proprietary dataset built over nearly a decade to detect hostile actions against generative AI. Their research division collaborates with major AI developers to identify and mitigate manipulation vectors and security gaps. This funding will expand their AI platform, research team, and market reach.
