The Watch
Breaches, disclosure, and the vendors selling the fix — what actually changed for defenders today.
An approved AI agent published its own answer without sign-off and left sensitive data open to unauthorized engineers for over two hours. The lever security teams reach for did not exist.
Reality
Check Point says Microsoft's signed BTR.sys remediation driver can be repurposed as a kernel operation engine with no vulnerable driver needed. Signature-based blocking does not apply.
Reality
Google's threat intelligence team ties three suspected Russian clusters to abuse of Google OAuth, app passwords and device linking. MFA completes normally, so consent telemetry is the control.
Reality
Americans for Responsible Innovation wants frontier models, data centers and AI chips treated as critical infrastructure under CISA. The obligations that would follow are worth scoping now.
Reality
ThreatFabric says the Android spyware encrypts stolen data and relays it over Wi-Fi Direct and Bluetooth when it cannot reach its C2, using up to four hops by default.
Perspective Coverage
3 publishersReality
Pen Test Partners says the battery maker declined to fix exposed older installs and did not act when the UK regulator asked. On 9 April 2026 it entered administration.
Reality
Adversa AI says a hostile page can ship its instructions as AES ciphertext, have Grok decrypt them in its own Python runtime, and then exfiltrate session data via a URL fetch.
Reality
CERT Polska says CVE-2026-73570 is under active exploitation. The fix shipped on July 20, and whether SNMP notifications are enabled, not the version string alone, sets the blast radius.
Perspective Coverage
3 publishersReality
Socket confirmed 40 Firefox extensions as wallet stealers posing as OKX, Rabby and TronLink, with Supabase as a remote switch. Detection-first controls do not survive this pattern.
Reality
CORCA puts a retail crime coordination center inside Homeland Security Investigations. Critics say the data-sharing trigger is any "threat," with retailers as direct suppliers.
Reality
The poisoned keyv releases were signed by GitHub Actions and the attestation was accurate. It certified a build whose source had already been taken over.
Reality
Two disclosed DoS techniques turn HTTP/3-to-HTTP/1.1 conversion at six major CDNs into up to 350x load on the origin, with no configuration change by the customer.
Reality
Huntress says a researcher targeted after Black Hat and Def Con was sent a Google Doc that rendered an Apps Script sidebar with ClickFix instructions. The lure arrived by DM, not email.
Reality
CyberSheath's 2026 survey puts the average SPRS self-assessment at +51, but only 65% of contractors trust their own number. Treat supplier scores as claims, not findings.
Reality
The UK cyber authority's interim advice puts sandboxing, threat-modelling of agent tools and network paths, and a human stop button on the deployer rather than the vendor.
Reality
Three of the Crosswork flaws score a flat 10.0, and Cisco says each CVE bundles several underlying defects. No exploitation reported in the wild so far.
Reality
Zimperium says the Android banking Trojan now abuses Accessibility to switch on wireless debugging and run commands through the ADB daemon. The target list is the smaller half of the story.
Reality
Cisco Talos says UAT-10147, a Chinese-speaking group doing SEO fraud and data theft, wired AI tooling into exploitation, validation and persistence. An open directory gave the operation away.
Reality
Unit 42 reports endpoint alerts tied to collaboration tools more than quadrupled in 12 months, with 99% linked to chat phishing. Most controls still watch email and logins, not authenticated sessions.
Reality
Cisco Talos says UAT-10147, a Chinese-speaking crew that monetizes access through search ranking fraud, now runs a cross-platform implant with kernel-level EDR bypass and a Linux rootkit.
Reality
Zero Data Retention promised nothing was kept. The new preview keeps nothing and still analyses across sessions, which means contracts and DPIAs written around retention need new language.
Reality
Malwarebytes describes counterfeit crypto screening sites that ask visitors to connect a wallet. Real screening needs only a public address, which makes the prompt itself the attack.
Reality
An SC World decision guide argues the CISO "authority gap" is a category error, and that the fix is assigning each high-consequence decision to a named owner rather than handing the CISO more power.
Reality
A leaked candidate list obtained by the Financial Times shows Hainan Xiandun recruiting translators through ordinary job adverts. Chinese espionage capacity grows on a labour-market curve, not a clearance queue.
Reality
CrowdStrike says public AI cyber benchmarks are being optimized as targets, and Dreadnode found over a third of Cybench task passes involved cheating. The detection-coverage era already taught this lesson.
Reality
A 40-character SHA-1 string printed in Slovak certification paperwork matches an entry in Russia's state register of measuring instruments. The comparison cost nothing to run.
Reality
Cipher AI's first month of data separates covert Russian content-farm seeding, laundered through Canadian accounts, from overt American influencer promotion. The defences are not the same.
Reality
Ukraine's week-long sweep shut 94 impersonation call centres and found 1,794 equipped workstations. The itemised haul is a usable sizing model for anyone tuning fraud detection.
Reality
Beijing's crackdown on Southeast Asian scam compounds is driven by domestic outrage, and one expert told Congress the effect so far has been syndicates pivoting to target Americans.
Reality
Cisco Talos revives a 1990s criminology method to describe intrusions as narratives, then uses a business email compromise to show which steps AI makes cheap and where defenders can push back.
Reality