News Threats

A whistleblower complaint from Twitter's former head of security alleges significant security and privacy failures at Twitter, including inadequate access controls, outdated and unpatched servers, non-compliance with a 2010 FTC order, and potential infiltration by foreign intelligence operatives. Twitter disputes these claims, calling the whistleblower disgruntled and asserting many issues have been addressed. The allegations have prompted congressional investigations due to concerns over national security risks.

A critical command injection vulnerability (CVE-2021-36260) affecting Hikvision surveillance cameras remains unpatched in over 80,000 devices worldwide nearly a year after disclosure. The vulnerability has a critical severity rating of 9.8 and allows remote command injection. Despite the severity, many devices remain exposed due to challenges in patching IoT devices and use of default credentials. Cybercriminals are actively selling access to these vulnerable cameras on dark web forums. The full extent of exploitation is unclear, but threat actors including Chinese and Russian groups could potentially leverage this flaw.

Microsoft announced that it paid over $20 million to 562 researchers through its bug bounty programs between July 1, 2025, and June 30, 2026. The largest single payout was $200,000. The company received 2,531 eligible vulnerability reports from researchers across 64 countries. While the bug bounty program has been successful in incentivizing vulnerability reporting, some researchers have expressed dissatisfaction with Microsoft's handling of certain reports, including allegations of mishandling, ignored communications, and withheld payments. No specific vulnerabilities or exploits are detailed in this announcement.

The provided information references an ISC Stormcast podcast episode dated August 4th, 2026, from the SANS Internet Storm Center. No specific vulnerability details, technical descriptions, or affected software versions are provided in the source content. The entry does not describe any concrete security threat or exploit.

New York State has awarded over $9 million in grants to 153 drinking water and wastewater systems to enhance their cybersecurity defenses. This initiative follows a recent multistate cyber campaign targeting water infrastructure, which caused operational disruptions in several states but did not affect New York utilities publicly. The funding supports cybersecurity assessments, upgrades, and compliance with new state cybersecurity standards for utilities. The campaign involved attacks on operational technology systems, including programmable logic controllers, and is suspected to be linked to Iranian threat actors. Federal agencies recommend removing exposed OT devices from the internet and securing remote access. The grants aim to improve resilience and compliance with mandatory cybersecurity measures for critical water infrastructure.

Xpsd is an open-source tool designed to analyze whether reported CVEs or vulnerability scan findings are actually reachable in a given source code tree. It integrates with GitHub code scanning and uses an LLM-driven approach combined with structural code navigation and advisory lookups to provide verdicts on vulnerability reachability. The tool helps developers prioritize which vulnerabilities pose real risks in their codebase by providing evidence, call paths, and SARIF reports. It supports multiple vulnerability report formats and can be integrated into CI workflows. There is no indication that Xpsd itself is a vulnerability or threat.

Many companies are showcasing their products and services this week at the 2026 edition of the Black Hat conference in Las Vegas. The post Black Hat USA 2026 – Summary of Vendor Announcements (Part 1) appeared first on SecurityWeek .

The payments giant says BioCatch’s behavioral and device intelligence will help financial institutions combat account takeovers, scams and other forms of digital fraud. The post Visa to Acquire Fraud Intelligence Firm BioCatch for $2.4 Billion appeared first on SecurityWeek .

Venture financing has become an essential factor in growing new business in today’s fast moving economy. Horizon3’s latest funding explains how and why. The post Horizon3 Raises $250 Million to Fund Continuing Growth appeared first on SecurityWeek .

Midnight Blizzard has been stealing Microsoft account credentials via compromised Wi-Fi networks at hospitality organizations. The post Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking appeared first on SecurityWeek .