AI-curated news for your industry

Several technology companies, including Anthropic, AWS, IBM, and Microsoft, announced a joint effort to discover, disclose, and fix security vulnerabilities in open source software. The alliance, named Akrites, will establish a shared security incident response team and a coordinated vulnerability disclosure process. This initiative is primarily driven by the emergence of frontier AI models, which have greatly accelerated the speed of vulnerability discovery, while the existing open source ecosystem struggles to respond quickly.

The Trump administration announced the launch of a vulnerability management hub called Gold Eagle, aimed at coordinating the security community to use cutting-edge AI models to quickly identify and fix vulnerabilities. The project, led by the White House, operates the VINCE platform in partnership with Carnegie Mellon University's Software Engineering Institute, focusing on open-source software to address the pressure on the security community from the AI-driven surge in vulnerabilities.

Researchers at VulnCheck warn that two critical Microsoft SharePoint vulnerabilities—an authentication bypass (CVE-2026-55040) and an input validation flaw (CVE-2026-63520)—can be chained to let unauthenticated attackers execute code on vulnerable servers. While the auth bypass alone has limited impact, chaining it with the second flaw achieves full criticality. Rapid7 disclosed a proof of concept on Aug. 11; exploitation was confirmed days later. Microsoft has released patches in its July and August security updates. Defused researchers report probing activity against honeypots using the chain.

CISA added the Zimbra vulnerability (CVE-2026-73570) to its Known Exploited Vulnerabilities catalog, requiring federal agencies to complete patching within three days. The vulnerability has been exploited by hackers since mid-August, and thousands of organizations worldwide still use vulnerable versions.

UK government officials confirmed that a small power facility was forced to shut down for four days in July due to a suspected cyberattack linked to Iran. Officials stated the incident affected only a single facility and did not have a broader impact on the national power grid.

Several senior House Democrats sent a letter to the Government Accountability Office (GAO) requesting a study on the recovery of the Cybersecurity and Infrastructure Security Agency (CISA) following large-scale layoffs and mission adjustments, assessing the impact on critical infrastructure protection and cyber threat response capabilities.

Microsoft disclosed a critical remote code execution vulnerability in Entra ID, identified as CVE-2026-69836, with a severity score of 10 out of 10. The vulnerability is related to the deserialization of untrusted data and was discovered by Microsoft's own security researchers. Microsoft stated that the vulnerability has been fully mitigated, requiring no additional action from customers, and emphasized that the disclosure aims to enhance transparency.

Since its launch in late 2024, the DEF CON Franklin Project has dispatched 27 volunteers to 21 water facilities, providing diverse support ranging from basic password management to emergency response planning. The project has not only enhanced the defensive capabilities of participating facilities but also, through research, uncovered real-world issues such as free security services coming with 'strings attached' and staffing shortages at small facilities. Despite its limited scale, the project's experience is spreading among peers through word of mouth.

Security researchers have been tracking attack campaigns targeting Cisco SD-WAN vulnerabilities since early 2026, which have impacted critical government websites and infrastructure providers. Experts note that edge infrastructure is the highest-value target in enterprise security, and Cisco products, due to their widespread deployment in government and enterprise networks, are frequently targeted by attackers.

In March, the Trump administration announced the launch of a pilot program to help states fund cybersecurity defense for critical infrastructure. However, three months later, at least 26 states and the District of Columbia have not participated in the program, with some states unaware of it altogether. The White House has disclosed few details about the program, raising questions about its commitments.