Category: Cyber Security News

A nine-year-old Linux kernel XFS race condition tracked as CVE-2026-64600 lets local attackers overwrite protected files and gain root privileges, and Qualys dubbed the flaw RefluXFS. The issue affects many major enterprise Linux systems with XFS reflink enabled, persists across reboots, and has already been patched in the Linux kernel. #RefluXFS #CVE-2026-64600 #XFS #LinuxKernel

CISA has proposed ANCHOR-CI, a new framework that replaces CIPAC and reshapes how the U.S. government collaborates with private industry on critical infrastructure resilience. The model adds sector, cross-sector, industry, and regional councils to better address modern threats like Volt Typhoon, AI risks, and supply chain dependencies. #CISA #ANCHORCI #CIPAC #VoltTyphoon

Microsoft is resolving an Exchange Online incident that has incorrectly quarantined some customers’ mailboxes since July 19, causing email delivery failures and calendar access issues. The problem, tracked as EX1436407, was tied to an infrastructure change that triggered excessive memory use and has required additional remediation after a similar previous issue, EX1434354. #ExchangeOnline #Microsoft #EX1436407 #EX1434354

Cisco Talos reports that the Chaos ransomware gang is using msaRAT, a Rust-based backdoor that hides command-and-control traffic by routing it through Chrome or Edge via the Chrome DevTools Protocol. By relaying communications through Cloudflare Workers and Twilio TURN, the malware avoids direct connections to attacker infrastructure and makes detection much harder. #Chaos #msaRAT #CiscoTalos #CloudflareWorkers #TwilioTURN

JadePuffer returned with EncForge, a Go-based ransomware built to encrypt AI and ML assets such as model checkpoints, vector databases, training datasets, and embedding indices. Sysdig found the autonomous AI agent adapted its delivery method in real time, used an exposed Docker socket for root control, and deployed encryption without evidence of data theft. #JadePuffer #EncForge #Langflow #CVE-2025-3248

France has become the first European country to ban social media access for children under 15, with the new law taking effect on September 1 and existing-account enforcement starting in January 2027. The legislation also bans cell phones in high schools and requires age verification for social media access, drawing criticism…

The federal government expanded its warning about Iran-affiliated attacks on internet-facing operational technology, adding Schneider Electric and Siemens PLCs to the previously cited Rockwell Automation and Allen-Bradley systems. The advisory highlights malicious HMI and SCADA manipulation that caused operational disruption and financial loss, and urges OT owners to restrict direct internet…

The House passed a defense policy bill that would extend the 2015 Cybersecurity and Information Sharing Act for another decade, preserving legal protections for sharing threat data between the private sector and the federal government. The measure still faces Senate opposition and final negotiations, while the House and Senate also differ…

South Korea said hackers compromised the National Diplomatic Academy’s online education system for ten months, exposing personal data belonging to current and former Ministry of Foreign Affairs employees, including overseas diplomats. The breach, which affected at least 6,000 people and may have involved up to 10,000, was linked to an exploited server vulnerability and was only discovered after a National Intelligence Service alert in February 2026. #NationalDiplomaticAcademy #MinistryOfForeignAffairs #NationalIntelligenceService

Upbound Group disclosed that threat actors used stolen customer data and documents to create fraudulent Acima lease-to-own agreements, causing about $13 million in losses. The company said it has launched mitigation steps, notified federal law enforcement, and continues investigating the incident. #UpboundGroup #Acima #RentACenter

Guardio Labs disclosed HermeticReader, a patched vulnerability chain in the Adobe Acrobat Chrome extension that could let an attacker silently read WhatsApp Web data from a victim’s session. The flaw, tracked as CVE-2026-48294, affects extension versions up to 26.5.2.2 and requires only that the victim visit a crafted page or interact…

Researchers disclosed CVE-2026-8933, a high-severity local privilege escalation flaw in snap-confine that can let an unprivileged user gain root access on affected Ubuntu Desktop systems. The issue stems from a sandbox initialization race condition that can be chained with FUSE and symlink abuse to write malicious files and trigger root command…

GitHub will halve its public bug bounty payouts starting July 27, 2026, replacing flexible reward ranges with fixed payments while reserving its highest payouts for an invite-only VIP tier. The change comes as AI-driven security research increases report volume and noise, with GitHub, Google, and curl all adjusting to faster automated…

A White House technology official accused Moonshot AI of distilling Anthropic’s Fable model to build its K3 model and of using a sophisticated internal platform to evade detection. The dispute has intensified U.S. concerns about Chinese AI firms copying proprietary American models, with lawmakers and industry leaders urging stronger protections for frontier AI systems. #Anthropic #MoonshotAI #Fable #K3 #Claude