57
Hackers publish thousands of drivers’ data after breaching Florida motor vehicle database
ShinyHunters published hundreds of thousands of records from Florida's DAVID vehicle database, including SSNs and passports, after an unpaid ransom demand.
The ShinyHunters group published hundreds of thousands of files from Florida's DAVID motor vehicle database on its leak site, saying the victim did not pay a ransom. Stolen records include vehicle ownership certificates with names, addresses, and VINs, plus a smaller number of Social Security numbers, non-US passports, and immigration documents. FLHSMV confirmed the breach, which followed theft of a police officer's credentials stored on a personal device. It comes the same month as the IDScan hack exposing over 150 million driver's license images.
75
Srsly Risky Biz: America's Drivers Licence Breach is a National Security Disaster
Dark web service Nexus sold 153 million US and Canadian driver's licenses, linked to identity verification firm IDScan under FBI investigation.
Krebs On Security reported that a dark web service called Nexus sold access to 153 million US and Canadian driver's licenses, claiming over a year of continuous exfiltration from a major identity verification company, with roughly 400,000 new licences added in a single day. Krebs verified the data as genuine and linked the incident via circumstantial evidence to identity verification firm IDScan, whose licences of senior US officials including Secretary of War Pete Hegseth appeared in the database; the FBI is investigating and IDScan has confirmed a breach inquiry. The article argues the data has national security implications, citing how Chinese APT espionage (Anthem, Equifax, Marriott, OPM) and Bellingcat investigations exploited leaked databases. Class action suits are being prepared, and the piece calls for stricter oversight of identity verification firms.
92
Driver’s License Data for Sale
Schneier on Security highlights that driver's license data is being sold, underscoring concerns over monetization of driver records and surveillance.
A post on Bruce Schneier's blog is titled 'Driver's License Data for Sale.' The available excerpt contains no article body, so the specifics of the reported data sales are not detailed. The topic concerns the commercial availability of driver's license records, a recurring data-privacy and surveillance theme on the blog.
22
FBI Investigates Nexus Claim of 153M+ Driver’s License Records
FBI is investigating dark web service Nexus's claim to sell access to over 153 million US and Canadian driver's license records.
A dark web service called Nexus claims to offer more than 153 million driver's license records from the United States and Canada. The FBI is investigating the claim. The scale of the alleged dataset would make it one of the larger exposed PII collections if verified.
78
I rented a car, and within hours, my driver's license was for sale
Dark-web site Nexus is selling about 153 million driver's license scans, apparently harvested near real time from IDScan.net's service used by Hertz and others.
KrebsOnSecurity reported that the dark-web marketplace Nexus offered roughly 153 million driver's license scans for sale, including the author's license shortly after it was scanned at a car rental. New scans appeared within hours to a day of presentation, implying near real-time access to data flowing through IDScan.net's ID scanning service, which lists Hertz and 11 other companies as customers and captures infrared and ultraviolet spectra. License listings grew by about 400,000 over 24 hours, indicating the leak was ongoing. Nexus went dark hours after the report, and the FBI is investigating.
85
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
Check Point shows attackers can abuse Microsoft Defender's signed remediation driver for arbitrary Ring 0 file and registry operations without exploiting any vulnerability.
Check Point Research presents BTR Reforged, a technique that repurposes Microsoft Defender's trusted remediation driver into an attacker-controlled kernel operation primitive. The signed driver can be instructed to execute arbitrary file and registry operations from Ring 0 without exploits, vulnerabilities, or memory corruption. The work demonstrates how trusted security components can be turned into attacker primitives, which is relevant for defenders assessing driver abuse risks.
55
Microsoft Patches 398 Flaws Including a Windows Driver Zero
Microsoft's August Patch Tuesday fixes 398 CVEs, including actively exploited Windows zero-day CVE-2026-68820 used by Lazarus for SYSTEM privilege escalation.
Microsoft's August 2026 Patch Tuesday release addresses 398 new vulnerabilities, 62 rated Critical by the Zero Day Initiative, with CVE-2026-68820 (CVSS 7.0), a use-after-free in the afd.sys Windows kernel driver, the only flaw flagged as actively exploited. Check Point Research attributed exploitation of the privilege escalation bug to Lazarus' Operation Dream Job campaign. Four unauthenticated remote code execution flaws rated 9.8 affect Windows DNS Server (CVE-2026-62878, called wormable by ZDI), Windows Deployment Services (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815) and HPC Pack (CVE-2026-59124). The release also completes a two-part SharePoint fix with RCE component CVE-2026-63520, following July's authentication bypass fix CVE-2026-55040.
82
30
50
60
30
60
30
47
30
57
57
42
35
60
30
42
57
60
45
USN-8760-1: Linux kernel (NVIDIA) vulnerabilities
Canonical issues USN-8760-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across numerous subsystems and CPU architectures.
Canonical published USN-8760-1 to correct several Linux kernel (NVIDIA) vulnerabilities that an attacker could possibly use to compromise the system. The update fixes flaws spanning UAPI, the kernel build system, ARM32, ARM64, RISC-V, S390, and x86 architectures. Patched subsystems also include the block layer, cryptographic API, Compute Acceleration Framework, Intel NPU driver, ACPI and Bluetooth drivers, and the hardware random number generator core.
12
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.
82
Multiple Class Action Lawsuits Filed Against IDScan
At least four class-action lawsuits filed against IDScan.net over an alleged breach exposing 153 million driver's licenses; FBI investigating.
At least four class-action lawsuits were filed in the US District Court for the Eastern District of Louisiana against IDScan.net following reports of a potential mega-breach of driver's license data. A Russian cybercrime forum service called Nexus claimed over 153 million driver's licenses, mainly American and Canadian, plus over 10 million ID cards, travel documents, and medical cards. The FBI is investigating the incident, which was first reported by journalist Brian Krebs, and IDScan.net says it is investigating. IDScan.net provides B2B ID verification services for clients including Hertz, FedEx, and hundreds of US cannabis dispensaries.
90
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
Check Point researchers showed Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) can be repurposed as a universal kernel operation engine to bypass endpoint security without BYOVD. The DoJ charged 17 members of Iran's Mabna Institute, which on behalf of the IRGC stole over 31 TB of academic data from 144 US universities and compromised roughly 8,000 of 100,000 targeted professor accounts; the State Department offered a $10 million reward for five defendants. Separately, Acronis tracked a Grandoreiro campaign abusing DLL sideloading in the Duplicate Files Finder app across Latin America and Spain, while ErrTraffic ClickFix campaigns deliver Cruciferra (BYOVD) and Remus Stealer. OpenAI also previewed Private Safety Processing, a privacy-centric approach to monitoring model misuse without retaining customer content.
48
57
30
57
30
55
55
60
30
60
30