Security news.
Today's cybersecurity landscape is marked by active exploitation of critical vulnerabilities, a surge in AI-powered attacks and espionage, and significant data breaches. CISA has added several actively exploited flaws to its KEV catalog, urging immediate patching, while reports detail new Spectre-like attacks and widespread compromises of IoT devices.
CISA Adds MLflow Server-Side Request Forgery to KEV Catalog
CISA has added CVE-2026-64849, an MLflow Server-Side Request Forgery vulnerability, to its Known Exploited Vulnerabilities Catalog due to active exploitation.
Cloudflare Workers Vulnerable to Spectre Attack, Leaking JWTs
Researchers demonstrated a remote Spectre attack against Cloudflare Workers, leaking JSON Web Tokens (JWT) from a co-located Worker at a rate of up to 12 bits per second.
Hackers Compromise 14,500 Dahua Web Cameras in 35-Day Campaign
A campaign dubbed "CameraSwarm" compromised over 14,500 Dahua IP cameras, primarily in Ukraine and Russia, utilizing credential attacks, authentication bypasses, and a P2P relay technique.
US Warns of AI-Powered Attacks on Siemens PLCs in Critical Infrastructure
U.S. cybersecurity agencies caution that threat actors are employing AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) within critical infrastructure sectors.
US Charges Iranian Hackers Over $3.4 Billion Intellectual Property Theft
The U.S. has charged 17 Iranian individuals, allegedly members of the Mabna Institute, for a years-long operation that stole data and intellectual property from American organizations.
OpenAI Pauses Frontier RL Training to Tighten Defenses Against Unsafe AI Behavior
OpenAI has paused reinforcement learning training for its latest AI models for two weeks to implement additional defenses and expand monitoring against unsafe AI behaviors, following a previous incident.
Password Spraying Attacks Surge 155x, Exploiting MFA Gaps
Huntress reported a 155x increase in password spraying attacks in H1 2026, with some campaigns generating over 81 million login attempts, primarily exploiting legacy authentication and incomplete MFA policies.
StopAndProtect Operation Uses Nearly 2,000 Hacked WordPress Sites for Malware Distribution
A global cybercrime operation, "StopAndProtect," leverages almost 2,000 compromised WordPress websites to disseminate malware, control infected hosts, and exfiltrate stolen documents and logs.