Security researchers, including work from SpecterOps, have documented at least 39 distinct methods that can undermine passkey authentication despite the underlying FIDO2 cryptography remaining secure. These techniques target the surrounding infrastructure rather than the cryptographic keys themselves, including browsers, operating systems, password managers, sync services, Bluetooth transport, and account recovery workflows. Many have working proof-of-concept tools, and some techniques are already surfacing in real-world attack activity.
bleepingcomputer.com
· 2026-09-04
A threat actor dubbed Spring Ring is running voice-phishing campaigns against Microsoft Teams users, tricking victims into granting remote access to their sessions. Once inside, attackers use that foothold to deploy malware and attempt to seize control of broader organizational infrastructure.
darkreading.com
· 2026-09-02
AI security startup HiddenLayer has closed a $100 million Series B led by Delta-v Capital, with Ten Eleven Ventures and others joining. CEO Chris Sestito says annual recurring revenue grew more than 10x in the past year, reaching the tens of millions, driven mostly by new enterprise customers in financial services, big tech, and government agencies including the Department of Defense.
techcrunch.com
· 2026-09-02
Security researchers have observed active exploitation of CVE-2026-0768, a critical flaw in Langflow, the low-code platform used for building AI applications. This marks the latest in a series of attacks targeting the platform, which has drawn increasing attention from threat actors this year.
darkreading.com
· 2026-09-01
OpenAI published an open letter urging global coordination on cyber defense, stating that AI-enabled cyberattacks will become significantly more widespread and sophisticated in the coming months as AI models grow more capable. The letter calls for collective action among governments and organizations at local, national and international levels to prepare defenses before this escalation occurs.
zdnet.com
· 2026-08-31
Researchers analyzing blood samples from 17,710 people found that those with the highest xylitol levels were 57% more likely to die or suffer a heart attack or stroke within six years than those with the lowest levels, with elevated risk persisting for decades. The findings, presented at the European Society of Cardiology's annual congress in Munich, showed a dose-dependent relationship between xylitol blood levels and cardiovascular events.
science.slashdot.org
· 2026-08-29
The Australian Federal Police announced the arrest of two men from Western Australia on 14 charges related to alleged membership in TeamPCP, a hacking collective linked to widespread supply chain attacks. Authorities say the group's malware, known as Shai-Hulud, spread through compromised open source packages and infected more than 1,000 organizations globally by exploiting CI/CD development pipelines.
arstechnica.com
· 2026-08-28
The Australian Federal Police, working with the FBI and Western Australia Police, arrested and charged a 21-year-old and a 23-year-old accused of belonging to TeamPCP, a hacking collective blamed for injecting malicious code into widely used open-source packages. The group's tampered code allegedly reached over a thousand organizations, including GitHub, OpenAI, Mistral AI, SAP and the European Commission, leading to theft of roughly half a million credentials and exfiltration of at least 300GB of data.
bleepingcomputer.com
· 2026-08-27
At Black Hat USA 2026, PortSwigger research director James Kettle unveiled an open source AI-driven tool called HTTP Terminator, designed to test whether AI could invent original hacking techniques rather than just find known bugs. The tool autonomously produced new HTTP desync, or request smuggling, attacks and used them to breach real enterprise sites, including several belonging to financial services firms.
darkreading.com
· 2026-08-26
Digital car keys, which rely on UWB or NFC to confirm phone proximity, avoid the relay attacks that plague traditional key fobs. However, they introduce new vulnerabilities: a stolen or dead phone could theoretically lock owners out or grant access to thieves, though automakers build in safeguards like remote lockdown features and reserve battery power for NFC access lasting up to five hours after a phone dies.
engadget.com
· 2026-08-24
GoKawiil