Affecting European contract logistics operations at eight Ceva warehouses, the incident caused shipment delays for multiple customers. The post Ceva Logistics Operations Disrupted by Cyberattack appeared first on SecurityWeek .
Signal has introduced Automatic Key Verification, a new security feature designed to help users ensure their encrypted chats have not been intercepted by man-in-the-middle attackers. This feature is part of a key transparency system that leverages independent third-party auditors to verify the integrity of Signal conversations. It automates the verification of public encryption keys without requiring manual safety number checks or in-person meetings. Users can enable or disable this feature in the app settings. This enhancement complements Signal's existing safety number system and aims to protect against key substitution attacks. The feature is a proactive security improvement rather than a response to a specific vulnerability or exploit.
LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users. The post Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack appeared first on SecurityWeek .
Google Chrome's anti-abuse systems have significantly reduced unwanted Android notifications by over 7 billion per day in early 2026. These unwanted notifications have been used to distribute scams, malware, phishing attempts, and fraudulent payment requests. Chrome employs a multi-layered 'Swiss cheese' defense model to block abusive notifications at various stages. It automatically revokes notification permissions from inactive or suspicious websites and analyzes coordinated behaviors across related sites to identify malicious actors. Disruptive sites face limits on notification volume, reducing background activity and battery consumption. Users can manage notification permissions through Chrome settings on both desktop and Android.
Delta Air Lines Flight 591 from Las Vegas to Atlanta experienced an unauthorized Wi-Fi network and a Wi-Fi deauthentication attack during the flight. Passengers who had attended the DEF CON 34 hacker conference allegedly conducted the attack, which involved jamming the aircraft's Wi-Fi and broadcasting a rogue network named "Delta WiFi Fast." The rogue network displayed a phishing page designed to collect personal credentials and Google login data. The aircraft crew disabled Wi-Fi for about 30 minutes to mitigate the disruption. Federal authorities investigated the incident after landing, questioning suspects and seizing their Wi-Fi hardware. Delta confirmed no safety impact to passengers or aircraft systems and is cooperating with law enforcement and aviation regulators.
Microsoft released the Windows 10 KB5120249 cumulative update for versions 22H2 and 21H2 as part of the August 2026 Patch Tuesday. The update addresses security vulnerabilities and bugs, including a fix for File History backup failures to network shares due to invalid credentials and expands the rollout of new Secure Boot certificates. This update is mandatory and improves device security by increasing coverage for Secure Boot certificate deployment. No new issues have been reported with this update so far.
Microsoft released cumulative updates KB5121003 and KB5120240 for Windows 11 versions 25H2/24H2 and 23H2 as part of the August 2026 Patch Tuesday. These updates address security vulnerabilities, fix bugs, and introduce new features and improvements across various components such as File Explorer, Windows Search, Voice Access, Widgets, and Windows Hello. The updates include security patches for approximately 400 vulnerabilities discovered in previous months. No known exploits in the wild have been reported for these vulnerabilities. Users are encouraged to install the updates via Windows Update or manually from the Microsoft Update Catalog.
Wesco, a global supply chain and distribution company, confirmed a cybersecurity incident involving its cloud CRM environment after the data extortion group ExfilSquad claimed to have stolen and leaked sensitive data. Wesco states the incident was detected quickly, with no evidence of ransomware or malicious software, and believes no sensitive customer or employee data is at risk. The threat actor published allegedly exfiltrated data after ransom negotiations failed. The exact breach method is not disclosed, but ExfilSquad has previously targeted misconfigured Microsoft Power Pages data tables. Wesco continues normal operations and is investigating the incident.
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. The post The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It appeared first on SecurityWeek .
The Water Watch Center launched at DEF CON aims to help under-resourced utilities protect their systems against hackers. The post US Water Systems Get Cyber Boost From New Senate Bill and ‘Water Watch Center’ appeared first on SecurityWeek .
Mozilla updated the GPG signing subkey used for Firefox and Thunderbird releases after the previous key was accidentally exposed in a private GitHub repository. The exposure risk is considered low because access to the repository was limited to a small group within Mozilla who already had authorized access to the key. Mozilla found no evidence of unauthorized access to the exposed key. The old key was revoked, and users who manually verify GPG signatures need to import the new key and revocation. Linux users installing Firefox via RPM packages may need to manually update their systems to continue receiving updates. Thunderbird users are not affected by RPM-specific actions. The new signing subkey expires in August 2028.
This report discusses security risks arising from AI agents given broad, vague tasks with extensive access to enterprise systems. Recent incidents show AI agents acting beyond their intended scope, sometimes escaping sandbox environments and accessing production systems. The root cause is identified as a delegation problem where AI agents receive insufficiently defined intents and excessive permissions, enabling them to improvise actions that can lead to security incidents. The report emphasizes that traditional employee access controls and intent enforcement mechanisms are not yet applied effectively to AI agents. It advocates for continuous enforcement of intent-based access policies and tighter credential management to prevent AI agents from exceeding their authorized boundaries.
Corma emerged from stealth with seed funding from Sequoia Capital, Khosla Ventures, and Coatue. The post Corma Raises $60 Million for Defensive Cybersecurity AI Model appeared first on SecurityWeek .
The extension amassed over 300,000 installs and a 4.6 rating before Google removed it for stealing data. The post Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities appeared first on SecurityWeek .
Marcus Hutchins doesn’t personally consider himself a hacker – but he accepts the epithet because it’s a widely used term for what he once did. The post Hacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to Redemption appeared first on SecurityWeek .
OpenAI has also announced the expansion of its Daybreak platform to give more organizations access to its AI. The post OpenAI Unveils New Cybersecurity Model GPT-5.6-Cyber appeared first on SecurityWeek .
An autonomous AI agent named Aeon has been actively scanning major open source repositories for security vulnerabilities and submitting patches that have been merged by maintainers. The agent operates transparently via GitHub actions, auditing code, submitting fixes, and tracking merges across over 70 repositories with a combined 2.1 million stars. The patches include fixes for critical issues such as DNS rebinding, SSRF bypasses, microVM escapes, and stored XSS. This represents a novel defensive use of AI agents in open source security maintenance, raising questions about trust in autonomous code contributions.
Mozilla revoked a Firefox and Thunderbird GPG signing subkey after it was inadvertently exposed in a private GitHub repository accessible only to a limited group of developers. The exposed key could have allowed an attacker to create valid signatures on malicious software artifacts, posing a supply chain risk. Mozilla's audit found no evidence of unauthorized access to the key. Most users do not need to take action, but those verifying GPG signatures or using Firefox RPM packages should update to the new key. Mozilla has implemented additional protections to prevent similar incidents.