The Telegraph reports Iran-linked hackers took a small UK power facility offline for four days, with no mandatory disclosure regime involved - what it means for UK and EU industrial and energy operators.
Google's threat researchers confirmed three Russia-linked groups hijacking accounts through genuine login screens. No malware, no patch fixes it. Here is what does.
Zimbra's SNMP flaw, CVE-2026-73570, was patched July 20, 2026, but CERT Polska confirmed live exploitation on August 21. CISA gave US federal agencies three days; most European operators have no such deadline.
CISA, the FBI, and the NSA say AI-built exploit code is hitting Siemens S7 PLCs. The same German-made controller runs EU water, energy, and factory sites.
CISA added two actively exploited TrueConf Server flaws to its Known Exploited Vulnerabilities catalog on August 20, 2026, giving federal agencies three days to patch an unauthenticated remote code execution hole.
Apple patched a zero-click ImageIO flaw, CVE-2026-65346, that let a malicious image run code just by being processed. The fix reached iPhones back to 2018, a severity signal worth reading.
SSD Secure Disclosure published a working three-stage exploit chain against the Unisoc T612 modem, reachable over a VoLTE video call. No CVE, no patch, and Unisoc has not replied to either outreach attempt.
MLflow (CVSS 9.3) and FUXA (CVSS 9.5) were both hacked within hours of disclosure the same week - the real problem is no-auth-by-default, not either flaw alone.
Two chained Microsoft Copilot flaws, dubbed SearchLeak by Varonis, let attackers exfiltrate email, files and app data with no click beyond opening a webpage. Microsoft has patched it, but the pattern has not gone away.
Wiz's autonomous Red Agent exploited a five-day-old flaw in Snowflake's GitHub Actions setup, then blamed Copilot for writing it. GitHub's commit log says otherwise.
Ray, GitLab and Apple all disclosed critical, unauthenticated remote-exploit flaws in six days in August 2026, each mass-exploited within days of a patch.
Apple's August 17 security update fixes 29 vulnerabilities across iOS, iPadOS and macOS, and for the first time credits a single AI system, OpenAI's Codex Security, with finding more WebKit bugs than any human researcher listed.
Page 6 / 17
One considered note on infrastructure, governance, and measurement, most mornings. No theory.