⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
Ravie LakshmananAug 10, 2026Cybersecurity / Hacking A lot of security problems still begin with someone doing a completely normal thing....
Security
77 Counterfeit Open VSX Extensions Collected Developer and CI/CD Data
Seventy-seven counterfeit extensions appeared on Open VSX between July 26 and Aug. 1, impersonating legitimate Visual Studio Code Marketplace tools...
Fake The Odyssey Downloads Are Hiding Password-Stealing Malware
Cybercriminals are exploiting interest in The Odyssey to distribute Lumma Stealer through fake movie downloads. Bitdefender researchers identified malicious files...
Meta Ordered to Pay $567M and Overhaul Teen Safety on Facebook, Instagram
Meta’s latest legal headache comes with a $567 million price tag and a five-year to-do list for Facebook and Instagram....
Samsung’s August Update Patches 56 Security Vulnerabilities Across Galaxy Devices
Samsung is starting August with a security sweep that patches dozens of flaws across Galaxy phones and tablets. The company...
New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens
Swati KhandelwalAug 08, 2026Email Security / Vulnerability New research shows content inside an email can escape its message boundary and...
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Ravie LakshmananAug 08, 2026Zero-Day / Vulnerability Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data...
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
Ravie LakshmananAug 08, 2026Vulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity...
OnePlus 10T Is Out of Security Support: Should You Keep Using Yours?
The OnePlus 10T has reached the end of its guaranteed security-support window, but that does not mean owners need to...
15 AI Security Lessons From Black Hat and Ai4 2026
On July 29, 2026, Kiteworks published the 2026 Data Security and Compliance Risk: Annual Survey Report, a survey of 459...
Google Begins Restoring Blogger Sites After False Malware Alerts
Google’s effort to keep malware off Blogger briefly ended up locking out legitimate publishers instead. Beginning Tuesday, August 4, hundreds...
UK AI tests found 19 unauthorized agent actions involving Anthropic and OpenAI models
AI agents crossed the line during cyber evaluation. The U.K.’s AI Security Institute (AISI) said it uncovered 19 instances of...
AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
Swati KhandelwalAug 07, 2026Web Security / Vulnerability PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James...
New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables
Swati KhandelwalAug 07, 2026Network Security / Vulnerability Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network...
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
Swati KhandelwalAug 07, 2026Endpoint Security / Vulnerability Entra ID researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in...
