Attack uses Windows Plug and Play auto‑install to fetch signed drivers, chaining two vendor bugs to gain SYSTEM on patched Windows 11, and can be triggered remotely through RDP USB redirection. Shows zero‑click hardware‑less privilege escalation is possible on fully updated systems.
An unchecked entry count in KVM’s SEV‑SNP Page State Change handler allows a malicious guest to overrun a host‑allocated buffer, enabling arbitrary kernel‑heap reads and writes. The flaw (CVE‑2026‑53360) affects all kernels with SNP PSC support since v6.10 and was patched in v7.0.12, v6.18.35, v6.12.93.
Researchers found a path‑traversal bug in the darwin‑init provisioning service on Apple’s Private Cloud Compute nodes. The flaw lets an attacker write arbitrary files as root during boot, persisting malicious code and hijacking telemetry, undermining the privacy guarantees behind Apple Intelligence. Apple assigned CVE‑2026‑20685.
Researchers found that Connective’s eID signing extension, used by over two million users, eight of Belgium’s ten biggest banks and dozens of government services, lets any website read smart‑card data, steal eID PINs and trigger remote‑code execution via a malicious library. The flaw gave attackers silent, full‑control over user credentials, prompting a 146‑day patch cycle.
Lookout uncovered that the sophisticated iOS exploit kits Coruna and DarkSword, once limited to nation‑state actors, are being wielded by the Russian‑linked UNC6353 group to steal crypto wallets and personal data. The finding shows a dangerous commoditization of mobile exploits, while Lookout’s Safe Browsing and device‑compromise tools block the threat on supported iOS versions.
The ‘Gentlemen’ ransomware group posted on AnMed’s Facebook page, saying they stole 6 TB of patient data, including SSNs, reproductive‑health, mental‑health and sexual‑assault records. The page was taken down within an hour, but the claim signals a massive breach of highly sensitive health information and raises fresh concerns about ransomware extortion tactics targeting healthcare providers.
Security researchers built a bogus DeFi firm, hired three suspects they linked to North Korea, and recorded every action on company‑issued VMs. The operation showed how North Korean IT workers can infiltrate real startups, gain code access and exfiltrate data, highlighting a new hiring‑risk vector for the crypto industry.
Microsoft's latest analysis shows DeadLock ransomware now runs its extortion workflow on Polygon smart contracts and the Session messaging network, moving ransom negotiations and leak hosting off‑premise. This decentralized architecture, coupled with geofencing and throttling tricks, has let the group hit over 80 organizations worldwide while evading traditional disruption efforts.
A proof‑of‑concept on GitHub shows how a malicious MCP server can split a theft request across harmless‑looking tool descriptions and results, bypassing AI coding assistants’ refusal safeguards. The technique, dubbed GhostSplice, lets agents exfiltrate SSH keys, environment files, source code and customer data without triggering any single‑step filter.
Internal tests show Astra can develop functional zero‑day exploits across hardened real‑world systems without human input, meeting OpenAI’s “Critical” cyber capability threshold. The company has tightened safeguards, isolated testing, and halted internal work that doesn’t meet the new security controls.
You’re caught up.
That was all 10 stories in the 11 August issue.