Cisco Nexus Flaws Open Door to Root Access
Cisco disclosed Nexus flaws risking unauthenticated root access and data center disruption.
Exploitation requires specific NX-OS configurations and no active attacks have been reported.
Despite the 9.8 CVSS score, I’d first check if vulnerable NX-OS features are enabled.
Check NX-OS features and versions on affected switches, then apply Cisco’s fixes.
Facebook Ads Hide Child Exploitation Links, Meta Fights Back
Meta is using AI to detect Facebook ads hiding links to child exploitation content.
The technology uses a LLM to identify attempts to bypass existing safeguards.
I think Meta’s biggest challenge is detecting malicious ads without flagging legitimate ones.
Audit for false positives and require human review before suspending legitimate accounts.
ASOS Customers Hit With Extortion Alerts
ASOS customers received a rogue app notification from hackers threatening to leak data.
The company confirmed unauthorized messaging activity and possible customer data exposure.
Audit your current TPRM for customer-facing messaging platforms.
Use TPRM tools and require MFA for administrative access.
IBM and Red Hat Uncover 400+ Java Vulnerabilities
IBM and Red Hat discovered and fixed more than 400 vulnerabilities in widely used Java libraries.
The findings came through their joint AI-assisted Lightwell security initiative.
Finding 400 vulnerabilities is impressive, but not all require immediate patching.
Check SBOMs and prioritize vulnerable dependencies by exploitability and impact.
Windows 11 Gets New Security Controls for AI Agents
Microsoft launched Windows 11 Execution Containers to limit AI agents’ file, network, and system access.
The technology enforces operating system-level boundaries to prevent unauthorized access.
OS-level restrictions can’t stop AI agents from being tricked into misusing authorized access.
Before deployment, verify Enforcement mode blocks unauthorized file and network access.
Are Your Network Devices an Easy Target?
Flaws in routers and switches can let attackers intercept traffic and disrupt operations.
How to harden network devices:
- Update network device firmware, disable unused services, and use network monitoring tools.
Detect compromised network devices and restore connectivity before operational disruption.
ChatGPT Teen Safety Report Exposes Parental Alert Gaps
AI safety nets might have a few holes parents should know about.
ChatGPT’s teen safeguards are facing scrutiny after Common Sense Media rated them an “Unacceptable Risk”, citing unreliable parental alerts, crisis referrals, and age detection.
After testing more than 4,000 prompts, Common Sense Media researchers found that newly created, parent-linked teen accounts could discuss self-harm or eating disorders for up to an hour without triggering parental alerts. Some older accounts did generate notifications, but only after weeks of conversations involving sensitive topics.
Researchers also found that ChatGPT failed to recommend crisis support in more than one in four situations where it was considered necessary.
For parents and educators: Verify that parental controls are activated, establish regular check-ins, and never rely solely on AI-generated crisis alerts.
43% of Security Pros Still Rely on Passwords
Security experts know the risks, but old habits die hard.
Despite growing awareness of passkeys, 43% of security professionals still use passwords at work, according to the 2026 Global State of Authentication report.
While 87% know about passkeys, only 25% use hardware-backed versions daily. Meanwhile, 70% reported increased phishing activity, and 44% said their organizations suffered an AI-driven attack in the past year, according to Yubico and Okta’s 2026 Global State of Authentication report.
The US leads in password dependence, with 50% still using traditional credentials, such as usernames and passwords, at work.
Security teams: Audit password-dependent apps, prioritize phishing-resistant authentication, and introduce passkeys during employee onboarding.
U.S. prosecutors charge ransomware recovery CEO over secret payments to hackers
U.S. prosecutors have charged the owner of a ransomware recovery company with allegedly defrauding victims for years by claiming to use proprietary decryption tech but instead secretly paid and cut deals with the hackers. MonsterCloud CEO Zohar Pinhasi, 50, pleaded not guilty and was released on bond. This comes years after Pinhasi was featured in a ProPublica story about the industry of ransomware negotiating middlemen, which pretty much just results in paying the hackers anyway. Prosecutors said Pinhasi has “no special technology to decrypt data.” He faces 20 years in prison if convicted — and would be the latest ransomware middleman to go to prison, after a trio were jailed earlier this year for moonlighting with the hackers.
FBI arrests suspect allegedly involved in breach of agents’ data
Reports broke Friday into the weekend that another ransomware negotiator has been arrested, this time “in connection” with the ShinyHunters breach of the FBI. A Canadian former executive of a cybersecurity firm named as Edward Dubrovsky was arrested while in Pennsylvania on extortion and conspiracy charges. Details are really thin, and it’s not yet clear exactly how he’s allegedly linked to the group, but he’s said to be directly involved with the hack itself. More details to come as I get ’em… but this will definitely be one to watch. Plus: Reuters spoke with a former cyber-crim and friend of the suspected FBI hacker, who Reuters named as Saif al-Din Khader. The friend told Khader it would be “crazy” to breach the agency. Khader, 17, was taken into Jordanian custody last week and is said to be cooperating with the FBI. Advanced persistent teenagers are no joke. Meanwhile: I wrote about what we can learn from the FBI and Pentagon data breaches.
U.S., allies seize tools used by China’s Flax Typhoon for hacks
A third ransomwa… nah, I’m kidding (can you imagine?!). In all seriousness, the U.S. and its allies are raising the alarm once again about the threat from a Chinese botnet operator called Integrity Tech (aka Flax Typhoon), after authorities seized a bunch of websites that hosted tools that the hackers relied on to target their victims, including governments, telecom companies, and beyond. The tools, Microscan and FishHub, were used for pen-testing websites to find flaws, and for handling phishing attacks. Flax Typhoon has long been accused of allowing its massive botnet to be used to hide Beijing’s malicious network activity. The group was previously sanctioned and exposed as part of China’s ongoing hacking campaigns — thought to be part of a wider effort to potentially invade Taiwan. CISA has some IOCs, so check your logs!
U.K. retailer Asos confirms data breach after hackers send in-app push notification
Rough week for U.K. fashion outlet giant Asos. A relatively new group of hackers calling themselves Xuanye Gateway broke into one of Asos’ third-party services, Simon AI (aka Monetate), to send out a fake push notification to app users telling them that their personal data had been stolen from the company’s data storage account hosted by Snowflake. It looks like MFA may not have been enabled, allowing the hackers in with stolen credentials. Asos’ stock dropped 15% in London after the push notification went out. The BBC later confirmed that the hackers stole names, home addresses, phone numbers, and customer profiles — including some customer website search terms. It’s unclear how much data was taken, but Asos serves over 17 million customers. The British cyber plods have some guidance on those affected. There’s a good thread on the incident by area cyber weatherman @GossiTheDog.
Thousands of exposed systems found across solar and wind farms
Modat: Security firm Modat found over 8,000 exposed systems across the European renewable energy sector alone, including exposed admin interfaces and control panels. In at least one case, the researchers found a dashboard with “Start, Stop and Reset” controls, and the turbine’s location on a map.
Hackers nab HTTPS certificates for Google domains and other big tech companies
As-yet-unidentified hackers broke into the systems of three top-level domains (.gh, .sl, and .as) and used that access to create fraudulent TLS (HTTPS) certificates for Google and several unnamed large organizations. With the certificates, the hackers could spoof those domains as if they were the real websites. Join @dangoodin on an explainer of the sticky tape and string that holds much of the internet’s trust together. Google, meanwhile, said it blocked the fraudulent certificates in Chrome fairly pronto.
Former CIA staffer pleads guilty to theft of $194 million and hundreds of gold bars
News broke earlier this year that a senior CIA officer with hundreds of gold bars in his house was arrested. That CIA officer has now pleaded guilty to defraud the government to the tune of $194 million. Court filings show David Rush used his position at the CIA, which included considerable authority over government intelligence programs and spending, to create a highly classified, top secret, but very fake program that only a handful of people knew about. He used this program to trick a defense contractor into buying the gold, thinking it would help the U.S. government in the event of a nuclear attack. If this wasn’t just mostly shuffling classified paperwork at Langley, this would be an epic movie. (Who on earth vetted this guy?) More via ABC News, the AP, and the Justice Department.
Denmark’s ID database hacked
Denmark’s national ID database known as CPR has been compromised, exposing 8.8 million people’s data, including those who are dead. The hackers, whose identities aren’t yet known, stole the data by abusing a legitimate Danish company’s access to the database. One of the accounts used to siphon off the data was reportedly secured with a password of “123456,” which might I remind you is literally the *worst* password you could possibly choose.
Wave of cyberattacks hit Japan
Tokyo has declared a “cyber space emergency” after dozens of companies, including retail, food, rental operations, and a rail group, were hacked with millions of people’s data leaked. The government is warning banks not to accept driver’s licenses as proof of identity to open new accounts, fearing the data might not be used legitimately. The U.S. has long expressed concerns over Japan’s cyber defenses.
AI hacks hit South Korean banks
South Korea also faced a bunch of suspected open-source AI-driven cyberattacks targeting several banks. CrowdStrike pointed the blame at a hapless Chinese national who used AI models to target the banks with weak security, but also doxed himself in the process. The hacker reportedly stole thousands of pieces of personal information, but that number might grow.
Cerner breach affects 20 million
The hack affecting Oracle’s Cerner electronic patient records unit in February 2025 included the personal data of 20 million people, including 3 million in Texas, which first reported the figure. Oracle didn’t say how many people had their health records exposed — so the number is probably not zero.
Flock staff flee
Reuters reported this week that surveillance giant Flock is asking around ~20% of its workforce to leave with voluntary buyouts as the embattled maker of license plate cameras faces continued pushback from communities and legislators. I asked if CEO Garrett Langley would take a pay cut as a result, but a spokesperson refused to say.