Attackers are increasingly targeting identity verification processes such as employee onboarding and account recovery rather than direct login credentials. Social engineering and document forgery are used to impersonate legitimate users, enabling unauthorized access. Notably, North Korean threat actors have impersonated foreign nationals to gain employment, and groups like Scattered Spider have exploited service desk password reset processes. Weak identity verification methods, including security questions and basic ID checks, are vulnerable to manipulation, especially with advances in AI-driven synthetic identities. Solutions that combine government ID validation with biometric liveness detection can strengthen verification during these high-risk identity events.
Microsoft PowerToys 0.101.2362.0 introduces a new utility called Window Hopper that allows users to switch between windows of the currently focused app using a configurable keyboard shortcut. This feature enhances user productivity by limiting window switching to a single application context. The update also includes other usability improvements and new features but does not describe any security vulnerabilities or threats.
WhatsApp has introduced enhanced account security features, including support for multiple passkeys and stronger two-step verification. These improvements aim to bolster user account protection against unauthorized access.
WhatsApp has introduced new security features including support for multiple passkeys, an enhanced two-step verification (2SV) password replacing the previous six-digit PIN, and additional caller information for Android users receiving calls from non-contacts. These updates aim to improve account security and help users better identify potential scam calls. The multiple passkeys feature facilitates easier login across multiple devices. The stronger 2SV password allows longer and more complex passwords, enhancing protection. Android users now see caller country and shared group membership for calls from unknown numbers, helping to reduce scam risks.
The ICS Cybersecurity Conference will feature a hands-on Cyber Attack Methods (CAM) training course focused on cyber-physical systems. This course places participants in a virtual environment to simulate adversary tactics against industrial control systems, helping defenders and engineers understand attack processes and improve system resilience. The training is designed for a broad audience including engineers and developers, not just security professionals. It aims to enhance practical knowledge of how cyber-physical attacks unfold and how to mitigate them. The course is US citizen-only and requires an Intel-based laptop to run the virtual machine environment.
Law enforcement agencies from 22 countries conducted a coordinated operation, dubbed Operation Jackal IV, targeting cybercrime networks linked to West African criminal groups, including the Black Axe syndicate. The operation resulted in 58 arrests and disruption of networks involved in romance scams, cryptocurrency and investment fraud, and business email compromise. Additional coordinated actions, such as Operation Red Card 2.0 and Operation First Light 2026, led to thousands of arrests and significant asset seizures globally. These criminal groups often use Crime-as-a-Service platforms and have been linked to coercion and extortion schemes involving minors. The operations demonstrate international collaboration to combat organized cyber-enabled financial crime and associated violent offenses.
Taiwanese prosecutors charged nine individuals, including employees from Nvidia and Super Micro, for illegally exporting high-end AI servers to mainland China. These servers contained banned graphics processing units (B300 GPUs) restricted under U.S. export controls. The shipments circumvented regulations through multiple routes including Indonesia, Japan, and Hong Kong. The case highlights ongoing tensions and regulatory enforcement in the AI infrastructure competition between the U.S. and China.
Aegis Latent Core is an open-source AI governance and evidence gateway designed to improve compliance and forensic logging for multi-provider large language model (LLM) applications. It uses cryptographic methods such as a Rust-based write-ahead log and Merkle Mountain Ranges to create tamper-evident logs of AI inference requests and responses. The system exports forensic evidence bundles aligned with digital evidence standards. It is self-hosted and does not claim certification or service-level objectives. No vulnerabilities or exploits are reported in this project.
The U.S. Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated companies over alleged violations of the Children's Online Privacy Protection Act (COPPA). The allegations include allowing children under 13 to create regular accounts outside of restricted modes, collecting and retaining their personal data without parental consent, and failing to delete such data upon request. The settlement resolves these allegations without a judicial determination of liability. TikTok has reportedly made significant changes to its data management and compliance practices since 2024.
A 17-year-old security researcher discovered 55 critical vulnerabilities in the Punjab School Education Board (PSEB) portal, affecting over 10 million students. The vulnerabilities include 9 critical flaws that could allow server takeover and 45 high severity issues. Sensitive student data such as names, addresses, phone numbers, exam results, certificates, and parent information are at risk. The researcher reported the issues to PSEB and CERT-In in late July 2026, but as of 25 days later, no response or patch has been issued. This lack of government action has prompted public disclosure to raise awareness and urge immediate remediation.
Microsoft is rolling out a new Teams meeting protection policy that allows administrators to automatically block all identified external bots from joining Teams meetings. [...]
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job. The post Hired for One Job, Judged on Another: The CISO’s Real Problem appeared first on SecurityWeek .
Dutch Data Protection Authority said it is imposing a fine of 825 million euros because Uber violated the EU’s General Data Protection Regulation. The post Uber Fined Nearly $1 Billion by Dutch Regulators Over Automated Suspensions of Driver Accounts appeared first on SecurityWeek .
Microsoft has confirmed that .NET Framework updates released as part of the August 2026 Patch Tuesday are breaking printing and PDF export in WPF applications. [...]
Juan Manuel Gouveia-Aguilera has been sentenced to 8 years in prison for his role in an ATM jackpotting scheme that caused millions in losses. The post Venezuelan Gets Record Federal Prison Term for ATM Jackpotting appeared first on SecurityWeek .
The attack caused real-world operational disruption and raised concerns about the resilience of Britain’s distributed energy infrastructure and the potential for repeatable attacks. The post Iran-Linked Hackers Shut Down UK Power Plant for Four Days appeared first on SecurityWeek .
TikTok will pay $300 million immediately and another $100 million after an order vacates an earlier consent decree against its predecessor company, Musical.ly. The post TikTok Reaches $400 Million Settlement With US Justice Department Over Children’s Privacy appeared first on SecurityWeek .
Claude Security, currently in public beta for Claude Enterprise customers, now runs codebase scans on Mythos 5. The post Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund appeared first on SecurityWeek .