The Edge of the Cyber World See the latest
A cybercriminal operating under the alias “TheHatman” is selling roughly 3.6 million employee-directory records allegedly pulled from the Microsoft Azure and Entra ID tenants of nine large companies, according to cybercrime intelligence firm Hudson Rock. The victim list includes McDonald’s, Vodafone, Tata Consultancy Services (TCS), Kyndryl, HCL Technologies, InterContinental Hotels Group (IHG), Gap Inc., Hexaware…
McKesson Corporation, the pharmaceutical distribution giant that moves roughly a third of the prescription drugs sold in the United States, confirmed on August 28, 2026, that it suffered a cybersecurity incident involving unauthorized access to third-party applications and theft of data. Hours after the disclosure, the extortion group ShinyHunters told BleepingComputer it had pulled roughly…
A ransomware crew that built its reputation on mass file-transfer hacks has pulled off something different this month. Cl0p, the extortion group behind the 2023 MOVEit breach, has spent August 2026 naming Shell, Philips, General Electric, Fiserv and roughly 45 other companies on its dark-web leak site. The common thread isn’t a shared vendor for…
OpenAI and more than 100 partner companies published an open letter on August 27, 2026, warning that AI models could within months become powerful enough to let attackers launch sharply more sophisticated cyberattacks against hospitals, water treatment plants, and other critical infrastructure, according to Fox Business. The letter calls for a coordinated global defense push…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines. The vulnerability, tracked as CVE-2023-49105 (CVSS score: 9.8), is a case of
The advisory arrived from CISA on August 12, 2026, and it read like most of the ones before it: patch known exploited vulnerabilities, keep offline immutable backups, and segment the network so a single infected laptop can’t become a company-wide outage. That last instruction is the one most organizations still skip. The NIST Zero Trust…
Russian-speaking cybercriminals spent seven weeks this spring running a coding assistant like a junior pentester, and it worked. According to an exclusive Reuters report published August 27, 2026, and a companion investigation from Tel Aviv-based Gambit Security, an affiliate of the Aurora ransomware operation used the AI agent inside Cursor, the code editor SpaceX now…
Palo Alto Networks’ threat intelligence team said the early waves of threats riding on agentic AI models have broken in the wild, and organizations are unprepared for what’s coming next. The post Unit 42 warns AI has shifted balance of power from defenders to attackers appeared first on CyberScoop.
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2023-49105 ownCloud Improper Authentication Vulnerability CVE-2026-53362 Linux Kernel Unspecified Vulnerability CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors…
Enterprises spun up more cloud storage, more SaaS apps, and more AI pipelines in the past two years than in the previous decade combined — and almost none of it got classified before it landed there. That’s the gap Data Security Posture Management (DSPM) tools are built to close, and by August 2026 the category…
