60
ATF confirms cyberattack hit system containing info on its investigation targets
Qilin ransomware group claimed breaching the ATF, exposing data on investigation targets; the agency says a standalone system was hit with no mission impact.
The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a cyberattack on a standalone system holding information about targets of ATF investigations, designated a major incident, with no impact on case management, lab, or eForms systems. Qilin, a Russian-speaking affiliate-based ransomware group, claimed responsibility, though ATF declined to confirm involvement or the root cause. Qilin has claimed hundreds of victims across 60+ countries since 2022 and partners with Scattered Spider and Moonstone Sleet.
78
DOJ firearms agency says hackers breached system containing investigation targets
ATF confirmed a cyberattack on a standalone system containing investigation target data, calling it a major incident; Qilin listed ATF on its leak site.
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a cyberattack on a standalone computer system containing information about targets of ATF investigations, with no connection to case management, laboratory, or eForms systems. The agency designated the breach a major incident and immediately terminated connections, initiating incident response and forensics. The Qilin ransomware gang added ATF to its leak site without providing stolen data samples. Qilin was the second most active ransomware gang in July 2026 with 127 reported attacks, and has previously hit Kuala Lumpur International Airport, Asahi, and Palau's government.
74
ATF declares ‘major incident’ as ransomware gang claims hack
The ATF declared a major cybersecurity incident and notified Congress after a ransomware gang claimed responsibility for hacking the federal agency.
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) formally declared a major incident involving its cybersecurity and notified Congress, according to the agency. A ransomware gang has publicly claimed responsibility for the attack. ATF is the latest in a series of US federal agencies in recent years to report a major cyber incident, though the gang's identity and the scope of data affected were not specified in initial reporting.
74
ATF responds to 'major' cybersecurity incident after ransomware gang's claims
The ATF is responding to a major cybersecurity incident claimed by a ransomware gang, with the US Justice Department investigating the breach.
The US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) acknowledged a 'major' cybersecurity incident after a ransomware gang claimed responsibility for an attack. The US Justice Department is investigating the breach. Available reporting provides limited technical detail, and the scope of data theft and operational impact remains unclear.
72
Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting
DoJ seized domains of Chinese espionage botnet platforms QScan and QTRouter, run by private firm QTFY for MSS and PLA targeting.
The US Department of Justice disrupted QScan, a distributed vulnerability scanning system with nearly a decade of internet scanning data, and QTRouter, a covert communications platform routing traffic through compromised IoT devices, operated by QTFY under Chinese company Nanjing Xinjiuwei Network Technology. FBI and NSA advisories say QTFY customers include China's Ministry of State Security and the People's Liberation Army, targeting federal agencies, the US Senate, hospitals, telecoms and financial institutions. This is the third Chinese state-backed botnet disrupted since December 2023, following the KV botnet (Volt Typhoon) and Raptor Train (Flax Typhoon), and a sister network, JDY, has more than doubled since the KV disruption. Separately, the Qilin ransomware group claimed a breach of the ATF's CALEA system, briefly publishing 6.3 GB of case folders and forensic data.
76
30
Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far
TechCrunch's 2026 roundup covers SSA data exposure, Iranian water-utility attacks, Klue breach hitting ~200 firms, and Meta AI chatbot account hijacks.
TechCrunch's mid-year roundup highlights a whistleblower claim that DOGE uploaded a live Social Security database copy to an unsecured third-party server, which House Democrats called potentially the largest US breach in history. CISA reported Iranian hackers targeted over 100 US water providers over the summer, while Russian-linked attacks hit Polish, Swedish, and Norwegian energy and water infrastructure. Market research firm Klue was breached via a stale 2022 pilot credential, exposing cloud keys of ~200 customers including Jamf, HackerOne, and LastPass to extortion gang Icarus. Separately, tens of thousands of Instagram accounts were hijacked by abusing Meta's AI chatbot to trigger password resets to attacker-controlled emails.
50
Risky Bulletin: Two TeamPCP members arrested in Australia
Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.
The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.
74
42
30
60
45
Microsoft discloses two actively exploited zero-days among 974 vulnerabilities
Microsoft patches 974 flaws in record Patch Tuesday, including two actively exploited Windows zero-days enabling privilege escalation.
Microsoft's largest-ever Patch Tuesday addresses 974 vulnerabilities, with CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows Advanced Local Procedure Call) exploited before disclosure. Both zero-days carry CVSS 7.8 ratings and allow privilege escalation. More than 10% of the defects are rated critical, and researchers attribute the record volume to AI-assisted vulnerability discovery without a matching rise in active exploitation.
78
Russian national extradited to US for alleged involvement in bank-account takeover scheme
US extradited Russian national Sergei Filimonov over a bank-account takeover scheme using spoofed bank domains that defrauded two banks of $6.3 million.
US authorities extradited 36-year-old Russian national Sergei Anatolyevich Filimonov from the Republic of Georgia on charges including bank and wire fraud conspiracy and aggravated identity theft. He and unnamed co-conspirators allegedly ran spoofed bank domains, bought sponsored links to lure victims, and harvested over 5,000 victim login credentials starting in November 2023, causing unauthorized transfers of about $5.58 million and $735,000 from two banks in 2024. The FBI previously identified at least 19 US victims linked to the credential-storage domain, with roughly $28 million in attempted losses including $14.6 million confirmed. Filimonov faces up to 175 years in prison, pleaded not guilty on September 4, and remains detained in the Northern District of Georgia.
45
CIA’s Michael Ellis says cyber intelligence is changing how the agency operates
CIA deputy director says cyber operations built the intelligence picture enabling US forces to capture Nicolás Maduro in Operation Absolute Resolve.
CIA Deputy Director Michael Ellis said at the Billington Cybersecurity Conference that cyber operations built the intelligence picture that let US special operations forces locate and apprehend Nicolás Maduro within four minutes of landing during Operation Absolute Resolve. He cited the elevation of the Center for Cyber Intelligence to a full mission center as key to aligning resources around the cyber mission. The agency also created a Directorate of Mission Systems and cut its technology acquisition cycle from two to three years to a six-month target, completing more than 400 purchases within that period. Ellis said AI brings unprecedented speed and scale to cyber operations and analysis.
55
In most cities, nobody owns the whole network
Former Waco CIO argues cellular-connected water controllers sit outside scanned networks, and accountability plus operating-budget funding—not technology—block segmentation.
Writing as Waco, Texas's former CIO, the author describes July water-sector intrusions that CISA linked to over 100 compromised systems, typically controllers on public cellular links absent from asset lists. The FBI and EPA reported incidents at utilities in at least seven states since July 27, and a Clayton County, Georgia pump station failure triggered a boil-water advisory. He argues accountability and funding—using mechanisms like the Texas Water Development Board's new cybersecurity scoring criteria—are the binding constraints, citing Waco's 43-day segmentation of five treatment plants with operating funds.
35
European parliament members call for slowdown of Serbia’s EU entry over spyware use
29 MEPs urge delaying Serbia's EU accession after researchers found Pegasus and NoviSpy spyware on student activists' phones.
Twenty-nine Members of the European Parliament sent a letter Friday demanding Serbia's EU accession be slowed until an investigation into its spyware use is completed. The letter follows a SHARE Foundation report, with Amnesty International and the Citizen Lab, documenting Pegasus and NoviSpy infections on Serbian student activists' phones; NoviSpy evidence pointed to Serbian government authorities, though Pegasus attribution was not assigned. The MEPs also urged European Commission President Ursula von der Leyen to cancel a planned visit to Serbia and called the surveillance 'a direct state attack on democracy' ahead of upcoming elections. The Serbian government did not respond to requests for comment.
48
Why judgment is emerging as cybersecurity’s defining skill
CyberScoop op-ed argues CISOs should grant AI autonomy based on reversibility and blast radius rather than model confidence, and measure analyst overrides of AI recommendations.
A CyberScoop op-ed contends that as AI takes over analysis and recommendations in security operations, human judgment about context, reversibility and blast radius becomes the defining skill. The author argues autonomy decisions should rest on how reversible and impactful an action is rather than model confidence, citing examples such as patching vendor-certified medical devices and a service account whose 3 a.m. login spikes were normal quarterly-close activity. It also urges leaders to measure analyst approvals, edits and rejections of AI recommendations, and review latency, instead of automation rates or mean time to resolution.
12
Attackers exploit zero-days in consistently besieged SonicWall product
Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.
SonicWall disclosed and patched two zero-days in SMA 1000 appliances: CVE-2026-83548, a maximum-severity pre-authentication SSRF, and CVE-2026-83549, a high-severity OS command injection. Rapid7 said chaining the flaws yields unauthenticated remote code execution, and CISA added both to its KEV catalog Wednesday. The vendor provided no IOCs or victim counts, urging customers to hunt for compromise, reimage or redeploy appliances, and reset all passwords and tokens. The product has faced repeated exploitation, including ransomware-linked flaws used by INC and Akira.
82
The G7 tells industry to hurry up and prep for post-quantum encryption
A G7 working group report urges governments and industry to accelerate post-quantum cryptography migration, framing quantum risk as a near-term economic threat.
A cybersecurity working group formed at the June 2026 G7 Summit in France called on organizations to stop postponing migration of critical systems to post-quantum cryptography, warning that harvest-now-decrypt-later attacks against currently encrypted data exist today. The report was signed by CISA, the UK NCSC, France's ANSSI, Germany's BSI, Canada's CSE, Japan's NCO, and Italy's ACN. It also cautions that some NIST-selected PQC algorithms have already been broken on classical computers, reinforcing support for crypto-agility. The push aligns with a recent US executive order moving federal PQC migration timelines from 2035 to 2030, while Google and others target 2029.
45
Jail time for Maine child in 764 marks turning point in federal law enforcement
A 17-year-old from Maine became the first minor federally adjudicated for 764 extremist crimes, including child exploitation, signaling a policy shift on prosecuting juveniles.
The FBI said a Maine teenager is the first child federally charged and adjudicated for crimes tied to the nihilistic violent extremist collective 764, part of The Com network. Charges include conspiracy to sexually exploit a child, distributing CSAM, interstate threats, cyberstalking, and identity theft. The case marks a turning point in federal policy on prosecuting juveniles and continues heightened enforcement: Kyle Spitze was sentenced to 77 years and Alexis Chavez to 40 years in related cases. The FBI is investigating more than 500 subjects connected to 764 and its offshoots nationwide.
48
FCC proposes public scorecard to rate telecoms on anti-robocall efforts
The FCC proposed a public scorecard rating telecoms' anti-robocall effectiveness and removed 14 providers from US networks for compliance failures.
The Federal Communications Commission issued a public notice proposing a scorecard that would assess how effectively retail voice providers, including wireless, wireline and VoIP, prevent illegal robocalls, drawing on Robocall Mitigation Database filings, consumer complaint and enforcement data. The agency stressed it is not a rulemaking imposing new requirements, and it is seeking comment on scope, such as whether to focus on larger providers. The same day, the FCC removed 14 providers from the Robocall Mitigation Database for non-compliance, effectively requiring other US providers to block their traffic within two days.
25
Dogged Russia-based botnet dismantled after 23-year run
Law enforcement, CrowdStrike and Shadowserver dismantled the 23-year-old Sality P2P botnet that infected more than 11 million devices.
Sality, a Russia-based peer-to-peer botnet active for 23 years and infecting over 11 million devices, was dismantled by law enforcement working with CrowdStrike and the Shadowserver Foundation. CrowdStrike poisoned the botnet's peer list so infected machines permanently disappeared from the operator's view, while domains were seized in a coordinated effort involving the FBI, Justice Department, Europol and authorities from Bulgaria, Hungary and Romania. The financially motivated operation enabled cryptocurrency theft, DDoS attacks and other cyberattacks, and Europol said the effort dates back to 2017; the operators were not named.
72
Pegasus, NoviSpy variant spyware found on devices of Serbian activists
Researchers confirmed the first 2026 Pegasus infection and a new NoviSpy variant on 14 Serbian activists, likely surveillance by Serbian authorities ahead of elections.
Citizen Lab confirmed with high probability the first forensically confirmed Pegasus infection of 2026, on a Serbian student activist hacked via a zero-click exploit between December of last year and January. Amnesty International confirmed two devices infected with a new NoviSpy variant, and the SHARE Foundation documented 14 targets including a member of parliament and a local government official, the largest documented spyware wave in Serbia to date. Evidence points to Serbian police or intelligence services, with NoviSpy infections occurring around police detention ahead of key local and parliamentary elections. Apple threat notifications preceded the findings, and updated iOS versions break the exploit chain.
68
Wyden seeks upgraded NSA security guidance on commercial VPN use
Senator Ron Wyden asked the NSA to update public guidance on commercial VPN security risks and answer questions about foreign surveillance threats against single-hop VPNs.
Sen. Ron Wyden sent a letter to NSA Director Gen. Joshua Rudd urging the agency to revise public guidance on commercial VPNs, following earlier letters to federal agencies in March and July. He argues single-hop VPNs offer little protection against sophisticated adversaries able to compel or compromise the single provider, citing a Congressional Research Service paper favoring multi-hop and mixnet architectures. The letter references a September NSA advisory on a China-sponsored campaign against telecom, government and military networks and asks unclassified questions about multi-hop systems such as Apple Private Relay, Tor and Nym versus mixnets.
35
30
42
30
30
30
60
60
55
45
30