U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure. PLCs are industrial computers used to automate and control machinery and physical processes in factories and other critical infrastructure. The NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency issued the joint advisory Wednesday, saying the attacks are ongoing. "This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs)," reads the advisory. "However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems." The critical infrastructure sectors most targeted include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The agencies also note that Siemens S7 PLCs are used in the Defense Industrial Base, which could also be targeted.
Over 50,000 exposed Stripe API keys show how leaked secrets can enable fraud, data access and account abuse within hours. Ransomnews researchers have documented a large-scale leak of Stripe merchant API keys found exposed in public code repositories, GitHub Actions logs, and misconfigured web servers, with over 50,000 unique keys identified in total. The research is practical rather than theoretical: the team tested a sample of the keys, found a meaningful portion still active, and documented exactly how quickly a fraudster could exploit them. The answer is fast. “A dataset published on a data-trading forum on 18 August 2026 contains live Stripe API keys for 659 merchant accounts, along with roughly 35 GB of customer and payment data pulled from them.” reads the report published by Ransomnews. “Ransomnews analysed the files offline and reported the exposure to Stripe before publishing. Stripe itself was not compromised. The keys belong to merchants.” Researchers said that after finding an active Stripe API key, they were able to access a merchant’s customer list, create a fraudulent payment link and make a $1 test charge within 17 hours. The key alone was enough to perform these actions, highlighting the risks of exposed credentials and insufficient API protections. The operations a live Stripe secret key unlocks are extensive: listing customers and their stored payment methods, creating charges and payment intents, issuing refunds to attacker-controlled accounts, modifying webhook endpoints to intercept future payment notifications, and in some cases accessing connected accounts if the merchant had enabled Stripe Connect. A secret key is not a partial credential. It’s full API access. The sources of the leaked keys are unsurprising to anyone who has done developer security work. GitHub repositories — both public and accidentally made public, account for the largest share, typically through hardcoded keys in configuration files, .env files committed without a corresponding .gitignore entry, or keys left in code comments. GitHub Actions build logs are the second major source: when a workflow prints environment variables for debugging, any secret that wasn’t properly masked ends up in a log that anyone with repository access can read. Misconfigured web servers are another major source of exposed Stripe API keys. Researchers found over 3,000 servers revealing Stripe-related strings, with about 12% containing keys that worked against the Stripe API. The source of the 659 exposed merchant keys is unclear, but likely includes infostealer logs, public repositories, exposed environment files and misconfigured backups. The collector’s real advantage was systematically validating the keys, accessing each account and organizing the stolen data. “The dataset doesn’t say, and we are not going to guess at a single source for 659 separate merchants. The realistic candidates are the ordinary ones: secret keys sitting in infostealer logs lifted from developer machines, keys committed to public repositories, keys left in exposed environment files, keys pulled out of misconfigured backups. Stripe’s own documentation says the company scans for exactly this, and describes finding merchant keys on repositories and package registries.” concludes the report. “What the collector added was patience. Gathering keys is common. Validating several hundred of them, then systematically walking the API for each account and archiving the results into a consistent folder structure, is a different level of effort.” Stripe does provide automatic secret scanning through GitHub’s partner program, which flags Stripe keys found in public repositories and can trigger automatic revocation when a merchant opts in. The problem is that opt-in rate is low, the scanning doesn’t cover private repositories, and it has no coverage over build logs, web server misconfigurations, or other platforms where keys surface. Ransomnews also found that some merchants had rotated their keys after a GitHub exposure but left the old keys active, possibly because Stripe doesn’t revoke keys on rotation unless you explicitly delete the old one. The remediation is not complicated. Audit your current Stripe keys against your version control history to see if any have ever been committed. Rotate any key that has touched a public repository, a build log, or a configuration file that wasn’t explicitly protected. Enable Stripe’s restricted keys for any integration that doesn’t need full account access — a webhook handler doesn’t need the ability to create charges. And enable Stripe Radar rules to flag unusual charge patterns that might indicate someone else is using your key before you’ve noticed it’s gone. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data leak)
Researchers tested 31 million patterns to disrupt surveillance AI, with promising results but significant gaps between simulation and real-world use. The Kansas City-based cybersecurity researcher Bill Swearingen spent the past year doing something that sounds almost too simple to work: printing patterns, watching cameras fail to detect them, and repeating. TechCrunch reports that after roughly 31 million tests, he can now generate patterns on demand that block license plate readers and surveillance cameras from recognizing whatever the pattern covers, whether that’s a person or a vehicle. The project is called noRecognition, and the core idea isn’t stealth in the traditional sense. The camera still records everything just fine. What breaks is the detection layer sitting on top of the footage, the software that flags license plates, tracks faces, or spots “activity of interest” across thousands of hours of video. Swearingen’s patterns don’t hide you from the lens; they make the algorithm looking through that lens shrug and move on. Swearingen, co-founder of the SecKC meetup, said his project started for personal reasons. He became concerned about the growing number of surveillance cameras in his town and the possibility of being tracked while attending a protest. What started as a simple experiment later became a reinforcement learning system. He taught the model to create patterns, learn from failures and keep improving. Over time, it learned how to avoid detection by several camera systems. Every time a pattern failed and got detected, the system adjusted and tried again, eventually learning to defeat multiple detection algorithms simultaneously rather than just one at a time. The research dashboard behind the project, published at sandbox.norecognition.org, goes considerably deeper into the numbers than the headline claim suggests, and it’s refreshingly upfront about what’s proven versus what isn’t. The team states its overall objective plainly as “one pattern that defeats every detector,” and by their own account that goal remains only partially met. Their strongest validated result against a detector extracted directly from a real deployed surveillance camera sits at 61.7% non-detection across held-out test subjects, a solid number, but nowhere near total, and still a digital simulation rather than a real-world fabric test. That distinction matters more than it might seem. Most of the dashboard’s headline figures are explicitly labeled as digital, simulated results, meaning the pattern was tested against a virtual camera and printed ink model rather than an actual garment photographed by an actual camera in the field. The gap between “works in simulation” and “works when Donut Media wraps a real 2009 Toyota Yaris in it,” which is the physical test Swearingen ran live at DEF CON, is exactly the gap this kind of research has to close before anyone should treat it as a reliable, everyday privacy tool. “On Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen ran his first real-world test. With help from Donut Media, the test involved covering a 2009 Toyota Yaris with one of Swearingen’s newest patterns to see if the car would be invisible to detection by a Flock camera.” reports TechCrunch. “We proved it was effective,” said Swearingen, though the wheels were a challenge. The video of the demo will be out in the next few weeks, said Donut Media.” That DEF CON demo is where things got concrete. Swearingen covered a car in one of his newest patterns and tested it against a Flock Safety camera, the kind widely deployed for automated license plate reading across the US. He said the test proved effective, though the vehicle’s wheels turned out to be a persistent weak point, curved surfaces apparently don’t cooperate with flat printed patterns the way a car door does. Source Tech Crunch – A photo of a 2009 Toyota Yaris at the Def Con conference in Las Vegas, covered in a pattern made by Bill Swearingen, as part of a test to see if it can defeat surveillance camera detection. Image Credits:Bill Swearingen / Donut Media Swearingen is not publishing his best patterns because he does not want camera makers to easily find and block them. Instead, he is using crowdfunding to develop and sell printed products such as T-shirts and hoodies, with vehicle wraps possibly coming later. It is still unclear whether the project will become a practical privacy tool for everyday users or remain mainly a DEF CON demonstration. Its real effectiveness will depend on how well the patterns work on real clothing, in different weather and camera conditions. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Surveillance camera)
Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts. According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows -
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Released on
Claude is experiencing a major outage, with users reporting login problems and degraded performance across several Anthropic services. The incident began on August 16, 2026, at around 21:58 UTC, and is affecting Claude.ai, Claude Code, and Claude Cowork. According to Anthropic’s status page, the company first said it was investigating an issue preventing some users from authenticating to Claude.ai, Claude Code, and Claude Cowork. A few minutes later, Anthropic reported a broader service disruption involving degraded performance on Claude.ai and platform.claude.com. For users, the outage can result in problems signing in, Claude failing to load, requests not completing, or other errors when using the affected services. Anthropic’s status page currently classifies Claude.ai, Claude Code, and Claude Cowork as experiencing a major outage. Claude Console and the Claude API are currently listed as operational.
A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal card data and send it to attackers in real time. In an incident investigated by the cybersecurity company Group-IB, a fraudster impersonated a bank employee and called the victim under the pretense of a problem with their payment card. During the call, the threat actor instructed the victim to sideload the SpyNote RAT disguised as a legitimate app and grant it Accessibility Service permissions, giving the attacker remote access to the Android device. To add credibility, the attacker personalized the malicious app label with the victim's name. After gaining remote access to the device through SpyNote, the attacker installed WindRelay without further interaction with the victim and used the banking app to take out a loan in the victim’s name.
A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. The weakness affected encrypted reasoning objects used by the providers' reasoning APIs, where a block created in one session could be replayed into another and, during testing,
Google says Chrome's anti-abuse systems reduced unwanted notifications on Android by more than 7 billion per day during the first quarter of 2026. In a new blog post, Google argues that notification abuse has increasingly been used to distribute scams, malware, phishing attempts, and fraudulent payment requests. To reduce the abuse, Google developed a "Swiss cheese" defense model, where several overlapping systems try to stop abuse at different stages. "Our goal is to ensure that if abuse slips through one layer, another is there to catch it," Google explained. "This approach allows us to halt abuse at the source, preventing deceptive content from reaching users while maintaining a healthy balance between utility and security." Chrome already removes notification permissions from inactive websites, as well as sites that repeatedly trigger suspicious-notification warnings.
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices thehackernews.com
Confirm this action.
Leaving now will discard your changes.