60
60
60
60
60
60
60
60
DEF CON crowd suspected in fake-hotspot attack on Delta flight
FBI Atlanta is investigating a fake in-flight Wi-Fi hotspot attack on a Delta flight, with DEF CON attendees suspected and no arrests made.
FBI Atlanta confirmed it is investigating an attack involving a rogue Wi-Fi hotspot used against a Delta flight. The timing and technique led to speculation that DEF CON attendees were involved. No arrests have been made, and details about affected victims remain limited.
35
60
60
60
DARPA’s AI Cyber Challenge reveals winning models for automated vulnerability discovery and patching
60
60
60
60
Delta investigates in-flight Wi-Fi spoofing on post
A passenger on Delta flight 591 allegedly spoofed the airline's in-flight Wi-Fi with a rogue access point, prompting an FBI and FAA investigation.
Delta Airlines is investigating an incident on flight 591 from Las Vegas to Atlanta in which a passenger reportedly created a rogue Wi-Fi network named 'Delta WiFi Fast' to steal sensitive passenger data. The cabin crew deactivated the aircraft's Wi-Fi for roughly 30 minutes, and Delta says flight safety and aircraft operating systems were never affected. The FBI's Atlanta office and the FAA acknowledged awareness of the incident, which bears hallmarks of an evil twin attack involving spoofed login portals and credential harvesting. DEF CON organizers said this year's conference in Las Vegas also suffered multiple similar deauthentication Wi-Fi attacks.
50
60
60
60
60
60
60
60
60
60
60
60
60
60
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
In most cities, nobody owns the whole network
Former Waco CIO argues cellular-connected water controllers sit outside scanned networks, and accountability plus operating-budget funding—not technology—block segmentation.
Writing as Waco, Texas's former CIO, the author describes July water-sector intrusions that CISA linked to over 100 compromised systems, typically controllers on public cellular links absent from asset lists. The FBI and EPA reported incidents at utilities in at least seven states since July 27, and a Clayton County, Georgia pump station failure triggered a boil-water advisory. He argues accountability and funding—using mechanisms like the Texas Water Development Board's new cybersecurity scoring criteria—are the binding constraints, citing Waco's 43-day segmentation of five treatment plants with operating funds.
35
57
60
Microsoft Releases Record
60
60
60
60
⚡ Weekly Recap: BadCam Attack, WinRAR 0-Day, EDR Killer, NVIDIA Flaws, Ransomware Attacks & More
60
60