The ICO audited police forces using live facial recognition (LFR) and urged them to strengthen data protection governance across England and Wales. The watchdog said several forces showed inconsistent compliance and needed better oversight, accountability, training, record keeping, and accuracy controls. The action raises scrutiny of police deployments that can produce false matches with consequences such as wrongful intervention, accusation, or arrest.

The UK recorded a record first-half fraud volume in January-June 2026, signaling a broad rise in consumer fraud and identity abuse. Identity fraud climbed 9% YoY to nearly 130,000 cases, while account takeover, SIM-swap, and money-muling filings also increased sharply. The pattern raises operational pressure on banks, telecoms, retailers, and fraud teams trying to stop stolen-data abuse and payment diversion.

The MacSync Stealer operation has been tied to 30+ rotating domains and confirmed active data exfiltration, increasing the risk of credential theft on macOS endpoints. The malware uses changing infrastructure while preserving recurring network and process patterns that make the activity easier to correlate across hostnames. It targets Keychain material, browser credentials and cookies, session data, and other sensitive files. The observed workflow shows a live theft-and-upload chain rather than simple beaconing.

A JSP web shell has been deployed on PTC Windchill and FlexPLM servers after CVE-2026-12569 exploitation, giving attackers credential theft, vault mapping, and in-memory code execution inside enterprise PLM systems. The implant functions as a backdoor for remote access and can support lateral movement, ransomware, and persistence. It is tailored to the application’s APIs, database schema, keystore, and file-vault structure, which makes the activity harder to detect.

Comcast launched Xfinity Shield with WiFi Motion, turning Xfinity WiFi into a home-monitoring service that can detect movement without cameras or motion sensors. The rollout expands a consumer security stack that also includes CyberSecure, Family Settings, and app-based alerts. The offering matters because Comcast is pairing internet service, home monitoring, and family-safety controls in one product line, including a paid Shield Select tier.

Microsoft shipped a security update for Copilot Personal tied to CVE-2026-24301, closing a flaw that could let a crafted link trigger a prompt inside a signed-in session and access connected-app data. The patch matters because the issue affected a consumer Copilot assistant with access to the user's authorized services. The release date was August 18, 2026.

Microsoft Copilot Personal CoSnitch vulnerabilities in CVE-2026-24301 let a crafted link trigger prompt execution inside an authenticated session and quietly pull data from connected apps. Microsoft said patches shipped on August 18, 2026, while Varonis found no evidence of exploitation in the wild. The issue affects the consumer assistant at copilot.microsoft.com and hinges on the autorun=1 and q parameters.

Malicious scanning is targeting CVE-2026-25895 in FUXA <= 1.2.9, putting publicly exposed SCADA/HMI instances at risk of arbitrary file write and potential remote code execution. Observed requests attempt to overwrite main.js via path traversal, and the activity began on August 18, 2026. No RCE payloads have been seen yet, but the flaw is already being actively tested in the wild.

CVE-2026-64849 in MLflow is being actively exploited against exposed Tracking Server deployments, creating immediate risk of cloud credential and secret theft. Attackers are using the unauthenticated SSRF flaw to reach cloud metadata services and extract sensitive data from internal endpoints. Scanning for exposed MLflow instances began within hours of assignment on August 17, 2026, showing rapid abuse of internet-facing systems. Organizations running versions < 3.15.0 should patch affected systems and check for signs of compromise.

Active scanning and exploitation of MLflow and FUXA vulnerabilities is putting exposed systems at risk of cloud credential theft and remote code execution. CVE-2026-64849 in MLflow and CVE-2026-25895 in FUXA are both being targeted in the wild. The activity spans internet-wide probing of public instances and abuse attempts against reachable systems. The wave surfaced on August 17-18, 2026 and remains active.

UNC6671 is industrializing vishing-driven credential theft with a role-separated labor model that improves scale and reduces insider risk across extortion brands. Its Work Panel splits callers, managers, and admins into different access tiers, turning recruited labor into interchangeable capture capacity. The structure makes credential relay, reconnaissance, and infrastructure control easier to operationalize at criminal-service scale.

GitHub Actions workflow injection in Snowflake’s public snowflakedb/snowflake-connector-net repository let a crafted GitHub issue trigger arbitrary commands in a runner and exposed internal Jira credentials. Wiz Research said its Red Agent found and exploited the flaw during authorized testing via HackerOne on June 23, 2026; Snowflake patched the workflow the same day in PR #1402. The vulnerable workflow had reached the default branch on June 18, 2026, and Snowflake later rotated the exposed Jira API token on June 24. Snowflake said it found no evidence of unauthorized access, and no CVE, CVSS, or CISA KEV entry had been identified as of August 17, 2026.

AIT-GUI has a critical unauthenticated command-execution vulnerability affecting versions through 2.5.1, with a fix in 2.5.2. Attackers could reach /cmd, /script/run, and /seq through browser-compatible requests because the state-changing endpoints lacked authentication, authorization, and CSRF protection. The flaw exposes spacecraft and instrument command infrastructure to unauthorized use from the browser path.

Anthropic and EPFL showed that self-propagating payloads can move between AI agents through editable system prompt files, creating a reusable attack pattern against autonomous agent harnesses. The tests also found a simple one-paragraph warning could drive spread to near zero, which gives defenders a low-cost mitigation option. The behavior was reproduced in OpenClaw-style chains and a simulated six-agent collaboration, but there was no evidence in the wild that the technique had already spread successfully.

TWINLOOT is a newly disclosed Python implant that hides command-and-control inside Microsoft services, increasing the odds that malicious traffic blends into normal enterprise cloud activity. The malware uses SharePoint Online, Microsoft Teams TURN, and a headless Edge browser to move tasking, operator access, and Graph traffic. It also steals Windows credentials, supports reverse SOCKS5 pivoting, and enables lateral movement and persistence on infected hosts.

Xpander raised $7.5 million in a seed funding round, giving the startup capital to expand its AI agent management and governance platform. The financing supports wider market penetration for technology that helps organizations adopt, build, run, secure, and manage AI agents across their environments.

Fortinet announced the acquisition of Virtue AI, expanding its AI security capabilities for models, applications, and agentic systems. The deal adds automated red-teaming, real-time guardrails, and governance features aimed at safer AI deployment. Fortinet said it will use Virtue AI’s technology for continuous AI assurance and agent protection. Financial terms were not disclosed, and Fortinet said the payment was immaterial to its business.

The StubMaker malware activity is distributing a Windows information stealer through typosquatted RubyGems installs, putting browser credentials and crypto-wallet data at risk on infected endpoints. The payload also targets seed phrases, Telegram data, and payment card numbers, expanding the theft surface beyond a single credential set. Researchers found the activity on August 15, 2026, and the malicious packages were later removed from RubyGems.

A RubyGems typosquatting campaign called StubMaker is delivering a Windows-based information stealer, putting package installers at risk of credential theft and crypto wallet compromise. The operation used 16 malicious gems and an extconf.rb install hook to launch a loader and payload chain. The packages were later yanked, but the campaign already exposed browser credentials, seed phrases, Telegram data, and payment card numbers to exfiltration.

The University of Texas (UT) San Antonio confirmed a cyber incident that forced IT systems offline and disrupted student registration, tuition payments, and phone service ahead of the new term. The university said it detected attempted unauthorized activity at the edge of its network on August 17 and moved to contain it with expert partners. So far, it says there is no evidence of data access or exfiltration, but the outage still affected core campus operations.

Ransomware victimization remains heavily concentrated in mid-sized organizations with $10m-$1bn in revenue, keeping the mid-market in the crosshairs across North America and Europe. A study of 13,336 disclosed incidents found that 73% of attacks hit this revenue band, while total incident volume rose 44% between 2023 and 2025. Manufacturing accounted for 26% of mid-market victims, making it the most exposed sector in the dataset. The pattern aligns with persistent security-posture gaps, including known exploited vulnerabilities, patching weaknesses, and weak DMARC coverage.

Microsoft is facing a search disruption in Microsoft 365 apps that is preventing some users from finding content in SharePoint Online, OneDrive, Outlook on the web, and Outlook desktop. The issue is tracked as MO1456424 and stems from a recent deployment that caused a resource utilization inefficiency. Microsoft says it has developed and deployed a fix to reduce resource pressure and restore service.

The Solicitors Regulation Authority (SRA) issued a warning notice to solicitors and law firms on August 17, tightening expectations around AI hallucinations and client data handling in legal work. The notice raises compliance risk across the UK legal sector by warning that misuse of AI can create confidentiality, data protection, and court filing problems.

CISA added Ray's CVE-2025-62593 to the KEV catalog and told FCEB agencies to apply fixes and mitigations by August 20, 2026, escalating an actively exploited flaw into a federal remediation deadline. The issue can enable browser-based remote code execution through DNS rebinding in Firefox and Safari, putting exposed Ray deployments at risk. The fix is available in Ray 2.52.0, but unpatched systems remain vulnerable until the deadline is met.

CISA added CVE-2025-62593 in Ray to its KEV catalog after evidence of active exploitation, raising the risk of browser-based remote code execution for exposed deployments. The flaw can be triggered through DNS rebinding in Mozilla Firefox and Apple Safari, especially against Ray development and testing instances. A fixed release, Ray 2.52.0, is available, and FCEB agencies must apply mitigations by August 20, 2026.

GitLab released out-of-band security updates on August 17, 2026 for GitLab CE/EE to fix CVE-2026-19478, a critical GraphQL issue that could let an unauthenticated attacker remotely modify or delete public projects and user data. The same release also patched CVE-2026-19650 in the GraphQL multiplex query handler. GitLab.com and GitLab Dedicated were already patched. Self-managed installations need to move to 19.2.4, 19.1.6, 19.0.8, or 18.11.11.

A threat actor is selling alleged Microsoft Azure/Entra employee dumps from multiple major companies, creating immediate risk of spearphishing and tenant-account abuse. The posts, attributed to TheHatman, claim 3.64 million records dated from July 31 to August 16, 2026 across firms such as McDonald's, Tata Consultancy Services, Vodafone, IHG, and Kyndryl. The advertised samples reportedly include employee names, email addresses, phone numbers, postal addresses, service accounts, and other tenant records. Several named companies said they found no evidence of compromise, but the exposed data structure could still support targeted fraud and identity-based attacks.

CEVA Logistics suffered a server breach between July 29 and August 1, 2026, disrupting operations for retailers in Europe and causing shipping delays. The compromise also created downstream customer impact for fulfillment and delivery services tied to the logistics network.

More than 40,000 WordPress sites are exposed to CVE-2026-15826 in User Profile Builder, an authentication bypass that can let unauthenticated attackers obtain an administrator session on affected configurations.

CVE-2026-15748 affects Forminator Forms for WordPress, exposing more than 600,000 active installations to unauthenticated arbitrary file upload and potential remote code execution. The flaw can lead to complete site compromise on susceptible sites that meet the plugin’s form-field preconditions. Version 1.56.2 addresses the issue, and sites running 1.56.1 or earlier are affected.