Cybersecurity firm Check Point Research recently uncovered a significant vulnerability within ChatGPT. Specifically, the flaw resides in the platform's HTML page preview feature. This defect successfully circumvents OpenAI's protective Lockdown Mode. Consequently, malicious actors could covertly exfiltrate confidential conversational records. Check Point promptly notified OpenAI regarding the weakness. Subsequently, OpenAI resolved the security loophole in September 2026 before public disclosures appeared.

SPECTER attack can leak data from compromised air-gapped PCs through USB power controls, phone charging changes and peripherals.

ASOS hack claims raise data protection and recovery questions; experts from SonicWall, Sectigo and Absolute Security comment on unfolding story.

Overview On July 11, 2026, two researchers from the ASSET Research Group at the University of Missouri-Kansas City, Sudipta Chattopadhyay and Murali Ediga, disclosed a novel attack technique named Ghostcommit. This attack is capable of exfiltrating the entire contents of a target’s .env file. The ingenuity of this attack lies in the fact that the […]

BlackFog CEO Darren Williams warns of new risks as ShinyHunters hacks rival Clop, whose site displayed: “Domain Seized By ShinyHunters”

Researchers found 36,769 exposed AI endpoints, but only 2% had an HTTP authentication gate.

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers

At a glance Malware family The Gentlemen ransomware (Go-based locker; Windows, Linux, ESXi builds) Threat actor GOLD SHERWOOD (confirmed by Sophos CTU) Targets Organizations across many sectors, worldwide; opportunistic victim selection Delivery vector Stolen VPN credentials and exposed firewall interfaces Key capabilities Rapid privilege escalation, BYOVD EDR killing, backup tampering, data theft Source Sophos Counter Threat Unit TL;DR The Gentlemen ransomware runs as a ransomware-as-a-service scheme under GOLD SHERWOOD.

A Berlin state government official has confirmed that hackers are attempting to extort the city after its administrative network was compromised earlier this month. Berlin has refused to pay the ransom demand, saying that Berlin will not be paying the attackers. The Senate Department for Mobility, Transport, Climate Protection, and Environment was affected by the incident.  An initial data leak was detected on August 7, followed by forensic analysis that detected additional exfiltrations between August 7 and August 12. On August 14, authorities took down the company's network as a result of the breach. As part of the response, the Senate Department for Urban Development, Construction, and Housing network was also shut down. There is currently no indication as to how much data has been stolen.  Senate Chancellery officials have reported that the investigation is still in progress and that the extent and nature of the data removed from the network cannot be ruled out. A figure circulating from the attackers claims that more than 5.7 TB of data has been stolen, including records relating to more than 12,000 individuals.  The city has not disclosed the extent of the data exfiltrated. On August 28, the ransomware group published the claim on their leak site. Berlin has not independently verified those figures, but the threat actor has also claimed that the stolen material included financial documents, contracts, human resources files, legal documents, complaints, passwords, and other confidential information. More than 16,000 email addresses and nearly 12,000 phone numbers are reported in the claimed haul. Despite not publicly identifying the attackers, the Rhysida ransomware group has claimed responsibility, briefly listing the city on its Tor-based leak site. The group has reportedly requested 30 Bitcoins, worth approximately $2.3 million, in exchange for not disclosing the unauthorized data.  Investigation Continues as Scope of Breach Remains Unclear Until the full scope of the compromise has been established, forensic investigators confirmed that additional data was collected from the Senate Department for Mobility, Transport, Climate Protection and the Environment between August 7 and August 12, before the affected departments were disconnected from Berlin's state network on August 14.  Rhysida has provided an extensive list of alleged stolen information, however, their claims have not been fully verified. Around 1.44 million files are reportedly contained within the claimed 5.79 TB haul, including government, legal, financial, contractual, and human resources documents. Also included in the list are identity documents, payroll information, email archives, database dumps, banking information, credentials, and more.  The group has also tried to press Berlin into paying through the alleged exposure of sensitive records. According to Rhysida, she threatened to publish the stolen files, citing potential GDPR violations as a further means of leverage. The Berlin Senate's Iris Spranger asserted that, despite the extent of the claims, no evidence has been provided to support election-related systems. There has been no evidence that election data has been compromised, according to Spranger.  Rhysida's initial access method has not been disclosed. As a result of the lack of details, there is no clear indication of the entry point and the circumstances under which the attackers gained access to the administrative network. Investigations are continuing by Berlin's State Criminal Police Office, the Public Prosecutors' Office, and federal security agencies.  Since its inception in 2023, Rhysida has been targeting government bodies, healthcare providers, educational institutions and critical infrastructure organizations. Researchers have linked the group to hundreds of attacks, making its claim against Berlin part of a broader pattern of attacks against public networks. It is still unclear whether Berlin has determined the full extent of the data theft or verified all information allegedly released by the attackers as part of the ongoing investigation.

At a glance Malware family Custom Java web shell (unnamed implant) Threat actor Clop / Cl0p (highly likely attribution) Targets Manufacturers running PTC Windchill; Shell named among affected firms Delivery vector Exploitation of CVE-2026-12569 (CVSS 9.3) in PTC Windchill Key capabilities Credential decryption, vault mapping, in-memory code loading, data theft Source ReliaQuest Threat Research; BleepingComputer TL;DR ReliaQuest found a custom Clop web shell built for…

Security researchers disclose a prompt injection flaw in xAI's Grok that turns a routine webpage summary into a silent data exfiltration attack, exposing user data without clicks.