SECURITYWEEK NETWORK: Cybersecurity News ICS Cybersecurity Conference Hi, what are you looking for? Latest Cybersecurity News In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities Noteworthy stories that might have slipped under the radar: government AI platform deal sparks outrage, North Korean IT worker breaches federal agency, DEF CON attendee blamed for Delta flight disruption. Trivy, Not LiteLLM Behind the 2,500 Org Compromise Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published. Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028. 1.6 Million Likely Impacted by RingCentral Data Breach The hackers published the allegedly stolen information, including names, addresses, email addresses, and phone numbers. Over 1,000 Charities Hit by Beacon CRM Data Breach The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts. 14,000 Trezor Customers Impacted by Data Breach at ShipMonk Hackers stole the customers’ shipping information, including names, addresses, email addresses, and phone numbers. Hackers Exploiting Unpatched GeoServer Zero-Day The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies. Cybersecurity M&A Roundup: 21 Deals Announced in July 2026 Significant cybersecurity M&A deals announced by Barracuda, CrowdStrike, Cyera, Okta, Palo Alto Networks, and Qualcomm. Adobe Commerce Bug Targeted Immediately After Disclosure The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches. WordPress 7.0.4 Patches Remote Code Execution Vulnerability Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files. Venture Firm Team8 Secures Additional $365 Million The Israeli company has nearly $2 billion in total assets under management since 2014. Fortinet Patches Authentication Flaws in FortiWeb and FortiManager The vulnerabilities could allow attackers to log in with random usernames and passwords or impersonate any FortiGate appliance. People on the Move Erika Dean has been appointed Chief Information Security Officer at Tricentis. C1 has named Jeff St. Clair Chief Revenue Officer. John Opala has joined Ralph Lauren as Chief Information Security Officer. 1Kosmos has named Frank Cohen Chief Revenue Officer. ServiceNow has appointed Simon Mouyal as Chief Marketing Officer. James Wilkinson has been named Chief Information Security Officer for the City of Dallas. Hackers Exploiting Unpatched GeoServer Zero-Day The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. Adobe Commerce Bug Targeted Immediately After Disclosure The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches. White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs Contracts may require a $1 million bond, which will be forfeited if a company fails to comply with operational requirements. Top Cybersecurity Headlines Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms. Ceva Logistics Operations Disrupted by Cyberattack Affecting European contract logistics operations at eight Ceva warehouses, the incident caused shipment delays for multiple customers. Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users. SecurityWeek Industry Experts The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren’t the biggest ones. They’re the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. SecurityWeek RSS Feed Webinar: Rethinking Cyber Defense for AI-Speed Attacks Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Virtual Event: CodeSecCon 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Cybersecurity M&A Roundup: 21 Deals Announced in July 2026 Cybersecurity M&A Roundup: 21 Deals Announced in July 2026 Bank of America to Acquire Cybersecurity Firm MDSec Bank of America to Acquire Cybersecurity Firm MDSec Okta to Acquire Identity Threat Detection Firm Permiso Okta to Acquire Identity Threat Detection Firm Permiso Cyera Acquiring Oasis Security in $1 Billion Deal Cyera Acquiring Oasis Security in $1 Billion Deal Cybersecurity M&A Roundup: 37 Deals Announced in June 2026 Cybersecurity M&A Roundup: 37 Deals Announced in June 2026 Cyber Insights 2026: The Ongoing Fight to Secure Industrial Control Systems Cyber Insights 2026: The Ongoing Fight to Secure Industrial Control Systems Cyber Insights 2026: Cyberwar and Rising Nation State Threats Cyber Insights 2026: Cyberwar and Rising Nation State Threats Cyber Insights 2026: Malware and Cyberattacks in the Age of AI Cyber Insights 2026: Malware and Cyberattacks in the Age of AI Cyber Insights 2026: Zero Trust and Following the Path Cyber Insights 2026: Zero Trust and Following the Path Cyber Insights 2026: Offensive Security; Where It Is and Where It’s Going Cyber Insights 2026: Offensive Security; Where It Is and Where It’s Going Cyber Insights 2026: Quantum Computing and the Potential Synergy With Advanced AI Cyber Insights 2026: Quantum Computing and the Potential Synergy With Advanced AI Hacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to Redemption Hacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to Redemption Hacker Conversations: Tal Kollander’s Journey From Black Hat to Hack Blocker Hacker Conversations: Tal Kollander’s Journey From Black Hat to Hack Blocker Hacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to Redemption Hacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to Redemption Hacker Conversations: Chris Thompson, Former Head of IBM X-Force Red, Co-Founder of RemoteThreat

Hacker Conversations: Chris Thompson, Former Head of IBM X-Force Red, Co-Founder of RemoteThreat Hacker Conversations: Isira Adithya, the Evolution of an Ethical Hacker Hacker Conversations: Isira Adithya, the Evolution of an Ethical Hacker CISO Conversations: Russ Kirby – Passion Is the Antidote to Burnout CISO Conversations: Russ Kirby – Passion Is the Antidote to Burnout CISO Conversations: Andreas Gaetje – From Economics to CISO at Körber AG CISO Conversations: Andreas Gaetje – From Economics to CISO at Körber AG CISO Conversations: Tarah Wheeler, Cybersecurity Leader, Thought Leader and Original Thinker CISO Conversations: Tarah Wheeler, Cybersecurity Leader, Thought Leader and Original Thinker CISO Conversations: Carl Froggett – Combining CISO and CIO at Deep Instinct CISO Conversations: Carl Froggett – Combining CISO and CIO at Deep Instinct CISO Conversations: Ross McKerchar, CISO at Sophos CISO Conversations: Ross McKerchar, CISO at Sophos Upcoming Cybersecurity Events SecurityWeek’s AI Risk Summit is the leading conference where technology, security, and risk leaders converge with AI researchers, developers, and policy makers shaping the future of enterprise AI. [August 11-12, 2026 | In-Person] SecurityWeek’s CodeSecCon 2026 will bring together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained. [August 19, 2026 | Virtual] SecurityWeek’s 2026 Attack Surface Management Summit will evaluate how organizations can protect corporate assets and reduce their attack surface in a modern security program. [September 16, 2026 | Virtual] SecurityWeek’s ICS Cybersecurity Conference celebrates its 25th anniversary in Nashville. Join the largest and longest-running event series focused on industrial cybersecurity. [October 6-8, 2026 | In-Person] Vulnerabilities In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities Noteworthy stories that might have slipped under the radar: government AI platform deal sparks outrage, North Korean IT worker breaches federal agency, DEF CON… (August 14, 2026) Read more In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities Noteworthy stories that might have slipped under the radar: government AI platform deal sparks outrage, North Korean IT worker breaches federal agency, DEF CON… (August 14, 2026) Hackers Exploiting Unpatched GeoServer Zero-Day The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. (August 14, 2026) Read more Hackers Exploiting Unpatched GeoServer Zero-Day The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. (August 14, 2026) Adobe Commerce Bug Targeted Immediately After Disclosure The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches. (August 13, 2026) Read more Adobe Commerce Bug Targeted Immediately After Disclosure The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches. (August 13, 2026) WordPress 7.0.4 Patches Remote Code Execution Vulnerability Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files. (August 13, 2026) Read more WordPress 7.0.4 Patches Remote Code Execution Vulnerability Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files. (August 13, 2026) Ceva Logistics Operations Disrupted by Cyberattack Affecting European contract logistics operations at eight Ceva warehouses, the incident caused shipment delays for multiple customers. (August 12, 2026) Read more Ceva Logistics Operations Disrupted by Cyberattack Affecting European contract logistics operations at eight Ceva warehouses, the incident caused shipment delays for multiple customers. (August 12, 2026) Snowflake Hacker Pleads Guilty in US Court Connor Riley Moucka was extradited to the United States in July 2025 after he was arrested in Canada. (August 6, 2026) Read more Snowflake Hacker Pleads Guilty in US Court Connor Riley Moucka was extradited to the United States in July 2025 after he was arrested in Canada. (August 6, 2026) Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison Maksim Silnikau was the creator and administrator of the ransomware group and involved in Angler EK’s distribution. (August 6, 2026) Read more Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison Maksim Silnikau was the creator and administrator of the ransomware group and involved in Angler EK’s distribution. (August 6, 2026) Weaponized Email AI Assistants Could Help Attackers Hijack Accounts Researchers demonstrate how attackers could abuse built-in email chatbots to evade detection, impersonate trusted employees, compromise executive accounts, and facilitate financial fraud. (August 4, 2026) Read more Weaponized Email AI Assistants Could Help Attackers Hijack Accounts Researchers demonstrate how attackers could abuse built-in email chatbots to evade detection, impersonate trusted employees, compromise executive accounts, and facilitate financial fraud. (August 4, 2026) In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities Noteworthy stories that might have slipped under the radar: government AI platform deal sparks outrage, North Korean IT worker breaches federal agency, DEF CON attendee blamed for Delta flight disruption. Trivy, Not LiteLLM Behind the 2,500 Org Compromise Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published. Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028. 1.6 Million Likely Impacted by RingCentral Data Breach The hackers published the allegedly stolen information, including names, addresses, email addresses, and phone numbers. Over 1,000 Charities Hit by Beacon CRM Data Breach The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts. 14,000 Trezor Customers Impacted by Data Breach at ShipMonk Hackers stole the customers’ shipping information, including names, addresses, email addresses, and phone numbers. Hackers Exploiting Unpatched GeoServer Zero-Day The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies. Cybersecurity M&A Roundup: 21 Deals Announced in July 2026 Significant cybersecurity M&A deals announced by Barracuda, CrowdStrike, Cyera, Okta, Palo Alto Networks, and Qualcomm. Adobe Commerce Bug Targeted Immediately After Disclosure The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches. WordPress 7.0.4 Patches Remote Code Execution Vulnerability Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files. Venture Firm Team8 Secures Additional $365 Million The Israeli company has nearly $2 billion in total assets under management since 2014. Fortinet Patches Authentication Flaws in FortiWeb and FortiManager The vulnerabilities could allow attackers to log in with random usernames and passwords or impersonate any FortiGate appliance. White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs Contracts may require a $1 million bond, which will be forfeited if a company fails to comply with operational requirements. Critical VMware vCenter Vulnerability in Attackers’ Crosshairs Tracked as CVE-2026–59310, the directory traversal bug allows remote attackers to execute arbitrary code. Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’ Dropped on Patch Tuesday, the exploit allows any user to spawn a shell with System privileges. The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity. Application Security Application Security Mozilla Issues New Firefox GPG Key Following Exposure The previous GPG signing subkey was inadvertently added to a GitHub repository and Mozilla decided to revoke it. Application Security Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds Application Security Obsidian Security Raises $85 Million at $1.1 Billion Valuation Application Security US and Allies Update SBOM Guidance Artificial Intelligence Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries... Critical Flaw Allowed to Azure Cosmos DB Pwnage Watch on Demand: Cloud & Data Security Summit Massive Password Spray Campaign Targeting Azure CLI ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact CISA has also published several advisories describing vulnerabilities in ICS and other OT products. New Jersey, Alabama Join States Targeted in Water Cyberattacks Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.