A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr.
The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring
Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action is required.
The vulnerability, tracked as CVE-2026-69836 (CVSS score: 10.0), is a case of remote code execution impacting the tech giant's cloud-based identity and access management service. It was previously called Azure Active Directory
Cisco has revealed its Secure Workload Software, a micro-segmentation tool formerly known as Tetration that is supposed to stop attackers moving laterally across a network, has four critical flaws plus another high-severity bug. CVE-2026-20315 and CVE-2026-20317 are the two perfect-ten-rated bugs. Both relate to improper access control. Cisco has not offered much detail about either, saying only that 20315 “covers authorization, authentication, privileges, and bypasses” and that 20317 has to do with “missing authentication, authentication bypass, and reliance on untrusted inputs.” The 9.9-rated flaw is CVE-2026-20231, which describes issues related to “Improper neutralization of special elements (covers command, OS, argument injection).” CVE-2026-20318 is the 9.6-er and is an improper input validation problem. Coming in last, at 7.5, is CVE-2026-20319, a problem related to “Improper restriction of operations within the bounds of a memory buffer” including overflows and out-of-bounds writes. Cisco offers Secure Workload Software as a SaaS-y service and for on-prem deployment. The company has fixed the flaws with its SaaS, but users still need to upgrade the Agent and Connector tools needed to use the cloudy software. On-prem users who have deployed version 3.10 or earlier need to get to version 3.10.9.1. Users of version 4.0 or later need to adopt 4.0.4.16 sooner rather than later. Cisco revealed the flaws on Thursday and says it discovered them after “a comprehensive internal security review” that involved “existing testing processes as well as frontier AI models.” Cisco is a known participant in Project Glasswing, which grants access to Anthropic’s too-powerful-for-public-release Mythos bug-finding model. So maybe that’s the frontier model involved in this research. Thankfully, Cisco says it has detected no malicious use of the vulnerabilities. ®
Google is tracking three distinct suspected Russian cyber-spy groups that are targeting individuals in academia, aerospace, defense, government agencies, and think tanks across Europe and the US. The UNC (unclassified) groups, as Google calls them, have been orchestrating these highly targeted campaigns since at least last year, and they remain ongoing. Some of the phishing and OAuth-abuse operations used in the attack took place this month. Each campaign had fewer than 100 targets, and under 10 victims, the threat-intel team told The Register. Despite the small numbers, if you work in government, NGOs, academia, or aerospace, you may be a target, and over the past few months the Russian snoops have adapted their attacks to abuse legitimate authentication flows. This makes these types of social engineering tactics appear more legitimate – and allows the cyber operatives to compromise personal accounts across multiple platforms, Google warns. It also means that potential victims may not recognize these as phishing attempts. Google says it wants to raise awareness about these campaigns “so that targets can more readily recognize malicious outreach.” In other words: don’t blindly trust that calendar invite that purports to come from the US State Department. UNC6293 The security analysts have been tracking one of the three, UNC6293, for almost two years. UNC6293 is a suspected APT29 (aka Cozy Bear, which Google now tracks as Ice Relic – insert eyeroll) phishing squad that poses as US State Department employees to lure victims into giving the snoops long-term access to their email correspondence. APT29 is probably best known for the 2020 SolarWinds hack, and infosec analysts from the UK and US governments, and the private sector, often link it to Russia's Foreign Intelligence Service (SVR). On Thursday, Google’s Threat Intelligence Group (GTIG) said it's now tracking two other suspected Russian groups, UNC7005 and UNC5976, which also conduct phishing, abuse OAuth flows, and/or deploy malware to these same types of targeted individuals. Last summer, GTIG documented UNC6293 phishing for app passwords belonging to people who are critical of Russia. In this campaign, they impersonated State Department personnel, and they’ve continued using that lure while also adding OAuth phishing into their toolkit. “In June 2026, GTIG observed OAuth phishing where UNC6293 requested targets share either the full URL or ‘verification code’ after performing a legitimate login to an external provider,” Google threat analysts Gabby Roncone and Wesley Shields said in the Thursday report. “By providing the requested verification code the target would grant UNC6293 access to the account.” UNC7005 GTIG also asserts, with “moderate confidence,” that UNC7005 is another initial access group connected to APT2/Cozy Bear/Ice Relic – and the SVR. This crew, first identified in February, usually targets academia, diplomatic, and nonprofit personnel across Ukraine, Western Europe, and the US. While it shares similarities with UNC6293, Google tracks it separately “due to its lower sophistication and poor operational security, infrastructure with divergent characteristics, and incorporation of malware.” Reliaquest and Microsoft first sounded the alarm on this group - Redmond tracks UNC6293 as Storm-2945 - after spotting a campaign compromising captive portal networks to deliver infostealers, keyloggers, and other malware. The Russian intelligence operatives targeted users of public Wi-Fi networks at places like hotels, conference centers, and other shared venues in the hospitality sector in an AI-assisted operation that began in February. UNC7005 also enjoys device-code phishing for both Microsoft and WhatsApp accounts. Most recently, the phishing lures look like invitations to diplomatic events and conferences delivered via email with links to attacker-controlled websites. The crew also tends to reuse website templates. They did this in May, we’re told, re-using the website template from an operation that used the theme of an "embassy invite." The later campaign spoofed the real GLOBSEC forum - a geopolitical gabfest that focuses on Eastern Europe. Once victims visit the attacker-controlled website, the snoops fingerprint the victim’s system and prompt them to confirm their attendance at a conference. “The registration process is thorough, and notably contains an epicurean wine selection, which was a theme in multiple previous ICE RELIC-linked phishing campaigns,” the Googlers wrote. In May and June, UNC7005 carried out social engineering attacks spoofing WhatsApp and prompting the victim to either join a voice call, encrypted chat, or download a file. Joining the voice call triggers a malicious JavaScript that records audio and video of the target, which the malware uploads to the attacker’s command-and-control server. While Google doesn’t say how the Russians use the stolen images and audio, attackers can use both to help carry out convincing social engineering campaigns. Also in May, the goons conducted “a much broader phishing wave than any we had previously observed,” Roncone and Shields wrote. This one targeted prominent, mostly US-based academics, diplomats, and researchers whose work focused on Russia and former Soviet states. The miscreants’ website was more “elaborately built to social engineer the target,” with specific information about a resolution supporting Ukraine, plus contact details for general questions or tech support. Those contacts were a hotline to the attackers, not a helpdesk. information (that led to the attacker) for questions or tech issues. When users click the button that, they believe, will download a “Summit Companion App” to read the full resolution, they inadvertently put infostealers on their own Mac OS and Windows devices. Since August, the same crew also started both Google and Microsoft account OAuth phishing operations using cloud infrastructure. UNC5976 Finally, UNC5976 is yet another suspected Russian cyberespionage group and again likes to steal OAuth tokens. GTIG began tracking OAuth-related activity from this crew in March 2026. In these campaigns, UNC5976 buys up several domains with names related to file sharing and then creates a cloud project related to the domain. The domains host a fake file sharing page that prompts users to “Continue with Google” via a popup link. The links takes them to a legitimate Google OAuth login page, asks them to sign in, and after authenticating the credentials redirects the victim to a Google Cloud project URL that saves the authentication token for the attacker. GTIG calls UNC5976 “distinct” from the other two initial access groups, and notes that this may indicate “differing strategic mandates and potential alignment with alternative Russian intelligence services.” It also uses dedicated infrastructure for post-compromise activity instead of residential proxies, plus more malware and tooling in its OAuth operations. ®
The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation.
The affected releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published from the same owner
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S.
These clusters include UNC6293, UNC7005, and UNC5976.
"These clusters engage in persistent, adaptive
Three-quarters of organizations have found AI layoffs cost more than they saved, and as many as nine in 10 companies would rethink them given the chance.
US Bank says that it's investigating ransomware crew LockBit’s claims that it breached the financial institution and stole data, which the crims threaten to leak on September 3 unless the bank pays an extortion demand. “We’re aware of claims regarding a potential cybersecurity incident,” Lee Henderson, US Bank VP of public affairs, said in an emailed statement to The Register. The bank declined to answer specific questions about the claims, including whether it has communicated with the extortionists and how much LockBit demanded. If the extortionists’ claims are true, and even if the bank pays the ransom demand, there’s still no guarantee that the digital thieves will delete the stolen files. When cops took down an earlier iteration of LockBit in 2024, they found evidence that the crooks retained victim data - even after the victims paid the extortion demands. “At this time, there is no indication that our internal systems are impacted and no evidence of unauthorized access to our network,” Henderson continued. “US Bank takes the security and privacy of our clients' and employees' information very seriously. We continue to investigate and closely monitor these claims and remain, as always, vigilant in our efforts to mitigate potential exposure to cyber events.” LockBit added the bank to its leak site late Wednesday night, and gave the bank 14 days to pay a ransom demand or else see its data dumped online. The post doesn’t say how many files the crew allegedly stole, or what they contained. In February 2024, international cops seized servers, domain infrastructure, and decryption keys in an effort to dismantle the notorious ransomware group, and in May 2024, they outed LockBitSupp's true identity - although Dmitry Yuryevich Khoroshev, a Russian national, remains at large. In September 2025, however, LockBit reemerged with its new LockBit 5.0 ransomware variant. LockBit’s latest claims follow previous third-party breaches affecting US Bank customers’ data, and at least one law firm says that it’s considering a class-action lawsuit against US Bank National Association, the primary banking subsidiary of US Bancorp, on behalf of a small group of customers whose credit card information may have been exposed in a third-party security snafu that reached the bank through its vendor, Fidelity National Information Services. US Bank reportedly found out about the third-party incident on May 7, and in June, began notifying 537 customers, all Massachusetts residents, that their names, mailing addresses, and credit card numbers may have been stolen by the digital crooks. Customers’ Social Security numbers, online banking credentials, and account balances reportedly weren’t accessed. A much larger incident affecting around 11,000 customers occurred in 2022, after a different vendor “accidentally shared” a file containing personal information associated with closed US Bank credit card accounts, including names, addresses, Social Security numbers, dates of birth, closed account numbers, and outstanding balances.®
A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do.
Signed drivers get turned against defenses. Legitimate apps help malware blend in. A weak header check opens a path to code execution. Elsewhere, exposed systems, old bugs, odd hiding tricks, and AI-assisted exploit research keep lowering the effort needed to cause damage.
Nothing here needs
The U.S. government on Wednesday warned of an "active threat" targeting critical infrastructure organizations in the country using artificial intelligence (AI)-generated exploit scripts.
The activity is targeting Siemens S7 SeriesProgrammable Logic Controllers (PLCs) to conduct reconnaissance and capability development using AI-generated scripts disguised as legitimate monitoring tools. That
The LG C6 OLED is one of my favorite TVs of 2026, with excellent color accuracy and picture quality - especially for this deal with free wall mounting and a free $200 gift card.
A young security researcher figured out a way to enroll a Linux device into Apple’s Find My network and read live location data from it. Find My is Apple’s app for, you guessed it, finding things – whether AirTags, iPads, or other supported devices and items. It also works for people. Families can track each other's whereabouts for safety reasons, and friends can tell when others are hanging out without them. In typical Apple fashion, though, the full Find My experience is limited to Apple hardware, like an iPhone or Mac. iBiz also offers Find Devices via the iCloud website, although it lacks Find My’s people-tracking feature for viewing locations others have shared with you. However, the 22-year-old researcher, who goes by “Zerotistic,” devised a way to enroll a Linux-based machine into the iNetwork, tricking Apple into sending the people-location data it exclusively reserves for Apple devices. It’s important to note, at this point, that this is not an exploit that allows anyone to arbitrarily retrieve any Apple user's location. It refers to registering a non-Apple device to the Find My network and retrieving the location data of people who had already chosen to share their locations with the Apple account owner. Retrieving people-location data requires Apple to trust that the machine you’re using belongs to its network and is capable of receiving the data, which is sent over Apple’s Push Notification service (APNs). The first step was tying the Linux machine to the researcher’s Apple account. Zerotistic obtained an identity delegate by going through Apple’s standard GrandSlam authentication protocol. In pursuit of an Apple Identity Services (IDS) device certificate, which links the intended device to an Apple Account, they then used that delegate to build a custom certificate signing request (CSR). Lots of trial and error later, Zerotistic discovered that the CSR had to use the PKCS#10 format and a 2048-bit RSA key signed using SHA-1, linking the Linux machine to their Apple account. They bundled this up into a compressed XML file and sent it to Apple’s authenticateDS profile-enrollment endpoint. The SHA-1 signature requirement and XML encoding were surprises. The researcher’s “best guess” is that the CSR had to conform to older standards because authenticateDS is a legacy endpoint. Apple signed the CSR, handing the Linux device the IDS certificate needed to register its public key to the researcher’s Apple account. The Linux device was registered at this point, but further work was needed to convince Apple that it was capable of running Find My. Zerotistic found that a Find My registration request required the device to subscribe to six different subservices, define the types of encryption it supported, and provide the public keys to support Apple’s device-to-device messaging format. It also had to be signed using an IDS certificate and an APNs certificate obtained during initial network setup. At this point, the researcher had enrolled the Linux machine in an Apple account and convinced Find My that it was capable of receiving location data via a persistent binary TLS connection to Apple’s private APNs servers. However, this registration did not automatically retrieve the location data of people who had previously shared their locations with Zerotistic, as a box-fresh Apple device would after setup. Issuing a SubscribeAndFetch request fixed this, prompting the device of the researcher’s friend to push an encrypted location key to the newly registered Linux device. The final challenge was reading the location data the Linux device fetched from Apple’s SearchParty service. Zerotistic was not simply using the GUI Find My app on Linux; they were receiving the encrypted data and had to figure out how to unpack the location message. This required a Linux script to unwrap Apple’s messaging envelope, extract the shared location key, and decrypt the Find My location data, which is comprised of coordinates, timestamps, and accuracy information. Once developed, the script could fetch and decode subsequent location reports for the existing location share. It took the researcher less than a week of tinkering to develop the Find My-busting technique, they said. The Register asked Apple if it was aware of the researcher’s work and if it had any plans to address the issue, but it did not immediately respond. ®
Login
