U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure. PLCs are industrial computers used to automate and control machinery and physical processes in factories and other critical infrastructure. The NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency issued the joint advisory Wednesday, saying the attacks are ongoing. "This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs)," reads the advisory. "However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems." The critical infrastructure sectors most targeted include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The agencies also note that Siemens S7 PLCs are used in the Defense Industrial Base, which could also be targeted.
Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected.
Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique. The activity, codenamed Operation CameraSwarm, was reconstructed from a 407 MB exposed working directory containing 2,616 files
Most email defenses still do the job they did a decade ago. Scan the message, look for something malicious, block it. That worked when the danger sat in the payload, a bad link or an attachment. It stopped working when the danger moved into the message's intent, and it is failing now that the sender is no longer a person. From Bad Content to Bad Intent to AI on Both Sides Phishing 1.0 was bad
Researchers tested 31 million patterns to disrupt surveillance AI, with promising results but significant gaps between simulation and real-world use. The Kansas City-based cybersecurity researcher Bill Swearingen spent the past year doing something that sounds almost too simple to work: printing patterns, watching cameras fail to detect them, and repeating. TechCrunch reports that after roughly 31 million tests, he can now generate patterns on demand that block license plate readers and surveillance cameras from recognizing whatever the pattern covers, whether that’s a person or a vehicle. The project is called noRecognition, and the core idea isn’t stealth in the traditional sense. The camera still records everything just fine. What breaks is the detection layer sitting on top of the footage, the software that flags license plates, tracks faces, or spots “activity of interest” across thousands of hours of video. Swearingen’s patterns don’t hide you from the lens; they make the algorithm looking through that lens shrug and move on. Swearingen, co-founder of the SecKC meetup, said his project started for personal reasons. He became concerned about the growing number of surveillance cameras in his town and the possibility of being tracked while attending a protest. What started as a simple experiment later became a reinforcement learning system. He taught the model to create patterns, learn from failures and keep improving. Over time, it learned how to avoid detection by several camera systems. Every time a pattern failed and got detected, the system adjusted and tried again, eventually learning to defeat multiple detection algorithms simultaneously rather than just one at a time. The research dashboard behind the project, published at sandbox.norecognition.org, goes considerably deeper into the numbers than the headline claim suggests, and it’s refreshingly upfront about what’s proven versus what isn’t. The team states its overall objective plainly as “one pattern that defeats every detector,” and by their own account that goal remains only partially met. Their strongest validated result against a detector extracted directly from a real deployed surveillance camera sits at 61.7% non-detection across held-out test subjects, a solid number, but nowhere near total, and still a digital simulation rather than a real-world fabric test. That distinction matters more than it might seem. Most of the dashboard’s headline figures are explicitly labeled as digital, simulated results, meaning the pattern was tested against a virtual camera and printed ink model rather than an actual garment photographed by an actual camera in the field. The gap between “works in simulation” and “works when Donut Media wraps a real 2009 Toyota Yaris in it,” which is the physical test Swearingen ran live at DEF CON, is exactly the gap this kind of research has to close before anyone should treat it as a reliable, everyday privacy tool. “On Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen ran his first real-world test. With help from Donut Media, the test involved covering a 2009 Toyota Yaris with one of Swearingen’s newest patterns to see if the car would be invisible to detection by a Flock camera.” reports TechCrunch. “We proved it was effective,” said Swearingen, though the wheels were a challenge. The video of the demo will be out in the next few weeks, said Donut Media.” That DEF CON demo is where things got concrete. Swearingen covered a car in one of his newest patterns and tested it against a Flock Safety camera, the kind widely deployed for automated license plate reading across the US. He said the test proved effective, though the vehicle’s wheels turned out to be a persistent weak point, curved surfaces apparently don’t cooperate with flat printed patterns the way a car door does. Source Tech Crunch – A photo of a 2009 Toyota Yaris at the Def Con conference in Las Vegas, covered in a pattern made by Bill Swearingen, as part of a test to see if it can defeat surveillance camera detection. Image Credits:Bill Swearingen / Donut Media Swearingen is not publishing his best patterns because he does not want camera makers to easily find and block them. Instead, he is using crowdfunding to develop and sell printed products such as T-shirts and hoodies, with vehicle wraps possibly coming later. It is still unclear whether the project will become a practical privacy tool for everyday users or remain mainly a DEF CON demonstration. Its real effectiveness will depend on how well the patterns work on real clothing, in different weather and camera conditions. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Surveillance camera)
Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts. According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows -
Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information from third-party logistics provider CEVA Logistics. While CEVA's systems were compromised in the cyberattack, the exposed records belonged to Pokémon Center customers who submitted orders on the site. The company then shared this information with the logistics provider to fulfill and ship PokemonCenter.com orders. CEVA Logistics is a subsidiary of the CMA CGM Group, the world's third-largest shipping company. The logistics provider operates 1,000 warehouses, handled 15 million shipments last year, and reported $18.3 billion in revenue in 2025. The company recently suffered a cyberattack in which attackers breached its servers between July 29 and August 1, affecting multiple retailers in Europe.
GitHub is down for some users as a widespread outage is causing errors across the website, API, Actions, Pull Requests, and several other services. GitHub confirmed the outage at 9:40 AM EDT on August 17, 2026, when it said it was investigating reports of performance problems affecting some of its services. The problems quickly spread across several parts of GitHub that developers rely on, including API Requests, Actions, Webhooks, Issues, and Pull Requests. According to GitHub's status page, the company is seeing error rates of around 20% across its web experience and API traffic. GitHub says archive downloads and raw repository content downloads are experiencing error rates of approximately 50%. Likewise, authentication-related services are also having problems, with SAML and OIDC authentication, SCIM, and Team Sync affected by the incident.
Author: Len Noe, Solutions Architect, BeyondTrust Every mature Active Directory environment has a component that quietly holds more power than the people running it usually admit: the Certification Authority (CA). The thing your entire estate has agreed to believe. When it signs a certificate, every machine, service, and authentication flow downstream treats that signature as truth. That is an enormous amount of trust concentrated in one system, and most organizations manage it like a utility installed once and never thought about again. Certighost, tracked as CVE-2026-54121, is a reminder of what happens when that trust is misplaced. Researchers published a working proof-of-concept on July 24, 2026, demonstrating that a low-privileged Active Directory user (holding nothing more than a standard domain account) can coerce an Enterprise CA into issuing a valid authentication certificate for a Domain Controller, then use that certificate to become the Domain Controller.
The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals. This incident was discovered after a threat actor using the "ZeroBytes" handle claimed the attack and listed a stolen database for sale on August 12 on the PwnForums hacking forum. "The in-depth investigations conducted since August 12, 2026, have established that, prior to their interruption, these access points had been used to consult and extract data concerning a total of 678,000 individuals and professionals, including tax data such as reference tax income, family quotient, and withholding tax rate, and, for businesses, data such as their company name and SIREN number," the French Finance Ministry said.
Confirm this action.
Leaving now will discard your changes.