Cybersecurity company ReliaQuest has confirmed that one of its employees was targeted in a social engineering attack after hackers impersonated a member of the security team. In a statement over the weekend, ReliaQuest said that an attacker called multiple employees and tried to trick them into accessing "a fake ReliaQuest single sign-on (SSO) page behind a content delivery network." Last week, ReliaQuest's Threat Research team shared in a now-deleted post, that the ShinyHunters extortion gang was registering .claims domains to impersonate company's help desks and IT teams. "ReliaQuest is tracking a widespread ShinyHunters campaign using domains that follow the company[.]claims pattern. These domains incorporate the targeted organization’s name or abbreviation under the .claims TLD," read the company's post on X.
Microsoft is rolling out a new Teams meeting protection policy that allows administrators to automatically block all identified external bots from joining Teams meetings. This new feature builds on another Teams policy introduced in June that added smarter bot protection, ensuring all detected bots are tagged in the lobby and require organizer approval before joining. The new policy goes one step further and will automatically prevent external bots from joining Teams meetings, without requiring explicit organizer confirmation before they're admitted. "With this update, organizations can strengthen meeting security by configuring Teams policies to automatically block detected external meeting bots from joining meetings," the company said in a Microsoft 365 Message Center update on Friday. "This gives administrators additional control over how identified bots are handled and can help reduce organizational risk."
A breach at South Korea's government-backed startup platform exposed encrypted personal data after an encryption key was included in an API. Penta Security explains why encryption keys must be securely managed and kept separate from the data they protect.
Microsoft has confirmed that .NET Framework updates released as part of the August 2026 Patch Tuesday are breaking printing and PDF export in some applications. In a Windows release health alert seen by BleepingComputer, Microsoft says this known issue affects only apps that use the Windows Presentation Foundation (WPF) UI framework, an open-source graphical subsystem for building Windows desktop client applications. "After installing the August 2026 .NET Framework cumulative update, some WPF applications may fail with a System.IO.FileFormatException when printing or generating PDF/XPS content that uses certain fonts, including Calibri," Microsoft says. The complete list of impacted platforms includes both Windows client releases (including the latest versions of Windows 10 and Windows 11) and Windows Server (from Windows Server 2012 up to Windows Server 2025).
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies to patch an actively exploited vulnerability in Zimbra Collaboration Suite (ZCS) within three days. The Zimbra security team patched the security flaw (tracked as CVE-2026-73570) in version 10.1.20, released on July 20. Successful exploitation allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled on the targeted system. "Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user," it explained. CISA's warning comes after CERT Polska, the Polish Computer Emergency Response Team (CERT), first flagged the vulnerability as targeted in the wild last Monday.
Microsoft has shared a temporary fix for ongoing gaming issues caused by Windows 11 updates released during the August 2026 Patch Tuesday. On impacted PCs, users reported games crashing or failing to launch, as well as game freezes, "EXCEPTION_ACCESS_VIOLATION" errors, and even unexpected system restarts. When it confirmed it was investigating this known issue on Wednesday, Microsoft said it affects games like ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals on systems running Windows 11 24H2 and 25H2. "Following the release of Windows updates on August 11, 2026 (KB5121003) and later, Microsoft received reports of issues involving inability to run games as expected," Microsoft noted. In a Thursday update, the company linked the gaming issues to drivers or components installed by RGB devices on affected Windows systems.
Slovakia warns that vulnerable speed cameras could expose vehicle data, enable remote access and provide attackers with a foothold into public networks. Slovakia’s National Security Authority, NBÚ, recently issued a warning about several road speed cameras, calling them a significant cyber threat. The alert is not about someone deleting a speeding ticket. It is about connected devices that collect vehicle data, communicate with other systems, and may contain remote-access functions that the operator cannot fully control. The Slovak authority examined a sample of the NERO R-ONE camera system at the request of the Interior Ministry. It named three product lines in its warning: NERO R-ONE devices sold by Cyprus-based SODASUS, Cordon-series speed cameras made by Russia’s Simicon, and Cordon-series products sold by Croatia’s NEROline. “The National Security Authority warns of a significant cyber threat associated with the use of several types of road speed cameras.” reads the alert. “A security analysis has identified several risks and recommends that affected entities identify the products in question in their infrastructure.” The problems went beyond a simple configuration issue. NBÚ found differences between the documented and actual communication settings, uncertainty about where the hardware and software came from, software that did not match the declared version, and weak security protections. “The security analysis identified several risks, including the true origin of the camera hardware and software, inconsistency between the documented and detected configuration of the product’s communication interfaces, and pre-configured remote access and product management mechanisms.” the agency wrote on LinkedIn. That last point deserves attention. A road camera should be managed by the organisation that owns it, under controls that it can inspect, configure and audit. If a device includes pre-set remote-access or management mechanisms outside the customer’s full control, it creates a blind spot in a system that may sit on a public-sector network or communicate with other operational services. Speed cameras do much more than take pictures and measure speed. They photograph vehicles, record timestamps, process licence-plate data, store evidence and send information to backend systems used by authorities. Depending on the setup, they may also connect to mobile networks, roadside equipment, police systems, municipal platforms or third-party maintenance services. If attackers compromise a camera, they could access data, change or delete records, manipulate how it measures or reports violations, or shut it down. If the network lacks proper segmentation, they could also use the camera as a foothold to reach other systems. The camera may not be the real target. It could simply be the unlocked door. The warning aims to alert essential-service operators and other organisations that these road cameras could pose a serious cybersecurity risk. In the wrong circumstances, attackers could use them to disrupt networks, systems or services. The Slovak Interior Ministry reportedly took the equipment out of its pilot deployment while the matter was investigated. Public reporting also says the ministry asked the supplier to remove the units and replace them with equipment meeting Slovak and EU legal, technical and security requirements. The Russian connection adds an obvious geopolitical dimension, but it should not become a substitute for technical analysis. NBÚ did not say that every device was actively spying on users or that the equipment contained a proven backdoor. Its warning is about identified security risks, limited operator control, uncertainty over hardware and software provenance, and remote-management mechanisms that could not be fully accounted for. That is enough reason to take action. Security checks for connected public devices cannot rely only on the brand, the country listed on the invoice or the vendor’s claims. Operators should know exactly what software and firmware the device runs, how remote access works and who controls it. They should also use independent security testing, secure updates and network segmentation. The same lesson applies beyond Slovakia. Smart cameras, licence-plate readers, parking sensors, environmental monitors, traffic lights and roadside communication systems are becoming part of public infrastructure. They are often cheap, easy to overlook and managed by public agencies, contractors and manufacturers. That makes them just as important to secure as other critical systems. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Speed Cameras)
TikTok will pay $400 million to settle U.S. claims that it violated child privacy laws by collecting data from users under 13. The U.S. Department of Justice announced that TikTok will pay $400 million to settle a 2024 lawsuit over children’s privacy. “Today, the Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated entities (TikTok) resolving litigation concerning compliance with the Children’s Online Privacy Protection Act and its implementing regulations (COPPA).” reads the press release published by DoJ. “Under the settlement, TikTok will pay $300 million immediately and an additional $100 million upon entry of an order vacating a prior consent decree entered against TikTok’s predecessor, Musical.ly. The settlement represents one of the largest recoveries ever obtained in a COPPA case.” TikTok will pay $300 million immediately and another $100 million after a court order removes an earlier consent decree involving Musical.ly. The 2024 case, brought by the DoJ and FTC, accused TikTok of knowingly allowing children under 13 to create accounts and illegally collecting data from children using Kids Mode. Since the Justice Department filed its lawsuit against TikTok in 2024, the company has made major changes to its ownership, management, compliance, and privacy practices. It has also introduced stronger safeguards for younger users, improved age controls, and expanded parental oversight. The DOJ said these measures have advanced the goals of its case and strengthened protections for millions of U.S. families. The settlement reflects a focus on practical results, securing a significant recovery while recognizing TikTok’s compliance improvements. The case was filed in California and handled by the DOJ’s Civil Division following a referral from the FTC. “This settlement is a major victory for American children and parents,” said Associate Attorney General Stanley E. Woodward Jr. “The Department’s priority is ensuring that children are protected online and that companies entrusted with their personal information meet their legal obligations. This resolution secures a substantial recovery while reinforcing the protections that families expect and deserve.” TikTok has faced regulatory scrutiny over children’s privacy before. In September 2023, Ireland’s Data Protection Commission fined the company €345 million for breaching the GDPR through its handling of children’s personal data. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, privacy)
iAuthFlow v2 phishing toolkit uses a phished Google session to enroll an attacker-controlled passkey that survives password resets. Abnormal Security researchers have published an analysis of iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for $10,000 base price. The author also offers for sale additional capability modules separately. The headline feature is not the phishing itself. It’s what happens after the phishing succeeds. “Once the target completes a phishable Google login, the toolkit uses the authenticated session to enroll a passkey controlled by the operator.” reads the report published by Abnormal Security. “In the seller’s recorded demonstration, the account owner later changes their password, invalidating the active session—but the operator authenticates with the newly enrolled passkey and returns to the mailbox.” That’s the architecture. The phishing flow gives the attacker a temporary window. iAuthFlow v2 uses that window to create a permanent key that doesn’t close when the window does. The toolkit uses a browser-in-the-middle attack. The victim sees what looks like a real Google login page, while iAuthFlow v2 runs another browser on the attacker’s server. Everything the victim types, including their email, password and two-factor code, is sent to that remote browser, which logs in to Google. The victim provides the credentials, while the attacker gets the authenticated session. In the demo, the fake login page used a trycloudflare.com subdomain, giving the link a valid TLS certificate and a more trustworthy appearance. Once the relay gives the attacker’s browser Google’s session cookies, iAuthFlow v2 holds the target on a “Verification, Processing” page while the toolkit works inside the account. This pause is a named state in the software, not a recording artifact. The session log timestamps tell the story precisely: login at 21:37:18, passkey created and saved at 21:37:24. Six seconds to establish persistent access. The passkey module navigates the target’s Google passkey settings through the authenticated browser and requests a new credential. Google may ask for identity re-verification before allowing the enrollment; the demo shows the toolkit handling this. The enrolled passkey is then stored on the attacker’s side, and the toolkit records “Passkey created and saved.” “The log records “Passkey created and saved.” At this point, the operator no longer has only the authenticated session created through the phishing flow.” continues the report. “The newly enrolled passkey is a separate authentication credential registered to the target’s Google account. The subsequent demonstration shows Google offering that passkey during a later sign-in, consistent with the operator retaining the credential needed to use it.” This is more serious than simply stealing a session cookie because a password reset does not remove a passkey. Changing a Google password ends active sessions, revokes app passwords and invalidates some OAuth tokens. A passkey is different: it is a separate cryptographic credential linked to the account and remains active until it is manually removed. The demo shows the risk clearly. After the victim changes their password, the attacker’s session stops working. But the attacker can choose “Try another way,” use the passkey they previously added and regain access to the mailbox. The victim may have no idea this happened. Abnormal notes a technically plausible mechanism for how iAuthFlow v2 stores and uses the passkey: Chromium’s software-based virtual authenticators, which support WebAuthn registration and retain private keys without requiring the target’s physical device. The researchers don’t confirm this is what the toolkit uses, since the demonstration doesn’t reveal the implementation. What they confirm is that the behavior shown is consistent with how passkeys work, and there’s an available path to produce it. The toolkit targets Google in the build Abnormal examined, but the seller advertises versions for Microsoft, iCloud, and LinkedIn. The same post-authentication persistence logic applies wherever passkeys can be enrolled. Containment after an iAuthFlow v2 compromise needs to go further than incident response teams are often used to going. “That cleanup is particularly important with iAuthFlow v2 because neither a password reset nor session revocation removes an attacker-enrolled passkey.” states the report. “Restore the account only after unauthorized authentication methods and other persistence mechanisms have been removed.” The full sweep should cover unauthorized passkeys and security keys, malicious Gmail filters and forwarding rules, delegated access, OAuth grants and app permissions, and recovery settings. Organizations running Google Workspace can use the Security Investigation Tool to audit the account before declaring it clean. The best way to prevent these attacks is to rely on authentication methods that cannot be easily stolen through phishing. WebAuthn-based authentication is tied to the real website, so stolen passwords or codes cannot be used through a relay attack. Google Workspace can enforce this with the “Only security key” option for 2-Step Verification and through the Advanced Protection Program. These settings also disable app passwords, which the toolkit may target on less protected accounts. The toolkit’s price and professional sales channels suggest this is an ongoing business, not a one-time release. If a Google account is compromised but appears clean after a password reset, security teams should also check the account’s passkeys and security keys before closing the case. “iAuthFlow v2 illustrates how phishing has evolved beyond stealing credentials or even hijacking a single authenticated session. Once an attacker gains legitimate access to an account, that access can become a starting point for establishing new authentication methods, modifying account settings, and creating other forms of persistence.” concludes the report. “Response and recovery cannot end with a password reset or session revocation. Organizations must also examine what changed after authentication—especially newly enrolled credentials, recovery methods, OAuth grants, and mailbox settings—and remove anything the attacker left behind. “ Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, iAuthFlow v2 phishing toolkit)
If your developers are using AI coding tools, you are probably already seeing the upside: faster development, more code, and less time spent on routine work. The harder part is what comes after. AI can also introduce open-source packages at a pace your security team was never built to handle. More dependencies mean more vulnerabilities to review, more remediation work, and a backlog that can
Confirm this action.
Leaving now will discard your changes.