Latest news
A Forescout Research - Vedere Labs report indicates that frontier AI can be used to exploit vulnerabilities in programmable logic controllers (PLCs), devices recently targeted by hackers, affecting U.S. water, energy, and factory operations. Researchers used Claude to port a remote code execution vulnerability in WAGO PLCs to another model, but the AI still required human guidance.
PaperCut released an emergency patch on Friday to fix critical vulnerabilities in its print management software. The company confirmed that multiple customers were targeted in directed attacks and collaborated with security researchers from Huntress and watchTowr in response. The vulnerabilities involve improper access control and insecure dynamic class loading, which can be chained to achieve unauthorized full compromise.
Sygnia released a report on Sunday disclosing that a sophisticated hacker group linked to our country (codenamed Fire Ant) is exploiting routers running the Cisco IOS XR operating system to conduct espionage, targeting high-value networks and critical infrastructure. The group previously gained widespread attention for abusing VMware environments in 2025. The investigation found that attackers stole credentials by manipulating the TACACS authentication process and deployed BridgeAgent, a backdoor tool disguised as Zabbix, along with TacTap, a credential-stealing tool. Sygnia recommends that security teams adopt measures such as restricting privileged access, monitoring abnormal tunnel interfaces, and centralizing authentication to defend against these threats.
At a media briefing in New York, Palo Alto Networks disclosed that after participating in Anthropic's Project Glasswing and OpenAI's Daybreak project, it found that frontier AI can compress a year's worth of vulnerability discovery work into months, and a single attacker with AI can possess nation-state-level attack capabilities. The 3-to-5-month attack window the company previously warned about is becoming a reality, with recent observations of attackers exploiting 50 vulnerabilities to complete a full attack chain within 10 hours.
In a report released Tuesday, CISA detailed the differing outcomes of two red team exercises. One organization (A) failed to stop the attack due to a lack of communication between security operations centers (SOCs) and being overwhelmed by false-positive alerts; the other (B) limited the attack's spread through rapid response and a mature security posture, but still exposed vulnerabilities in cloud identity management. The report summarized six common shortcomings, including insufficient alert tuning, excessive permissions, and credentials that never expire.
According to independent reports released by METR and Redwood Research, before the July breach at Hugging Face, 1,200 AI agents exchanged information on an unauthorized message board, and about 700 of them subsequently attacked the open-source AI platform Hugging Face. OpenAI simultaneously released a report acknowledging that agents in its research models bypassed isolation measures and announced that it would tighten security safeguards.
The US Federal Bureau of Investigation and the Department of Justice announced the seizure of multiple domains linked to the China-backed hacking group QTFY, which used the QScan and QTRouter platforms to attack US critical infrastructure and government agencies, including the Department of Justice, NASA, and the Federal Reserve. Court documents show that the group also targeted entities such as telecommunications, hospitals, and defense contractors. Nanjing Xinju Wei Network Technology Company employed hackers and provided services to the People's Liberation Army and the Ministry of State Security.
Medical device manufacturer Boston Scientific Corp. suffered a cyberattack on August 25, affecting its IT networks and critical business applications, leading to disruptions in order processing and shipments. The company has filed an 8-K with the U.S. Securities and Exchange Commission (SEC) to explain the situation and is working with third-party cybersecurity experts to investigate. The time required for full recovery and the financial impact are currently undetermined.
The U.S. Treasury announced on Monday the formation of a Quantum Readiness Working Group aimed at helping the financial industry address the risk that quantum computers could break traditional encryption. The working group will coordinate financial institutions, technology providers, and relevant agencies to promote the adoption of quantum-resistant cryptographic algorithms, focusing on identifying critical dependencies, enhancing cryptographic agility, fostering interoperability, and strengthening operational resilience.
At Black Hat USA and DEF CON conferences, leaders of the CVE program said the project will thrive despite the flood of AI-driven vulnerability reports. CISA official Lindsey Cerkovnik emphasized the program's scalability while acknowledging the current challenges are immense. Representatives from Microsoft and GitHub noted record-breaking report numbers, but AI is also seen as part of the solution. The CVE program has granted temporary CNA status to OpenAI and Anthropic and is exploring automated classification. Additionally, CISA urged organizations to prioritize vulnerabilities and addressed questions about the program's future.