SecurityTicks

DOJ, NASA, Others Among Victims of Chinese State-Sponsored Hack 2026-08-27 at 19:00 By The DOJ and other federal entities were targeted by a Chinese state-sponsored actor. This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE 2026-08-27 at 18:13 By Credit: Hacktron Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories 2026-08-27 at 18:12 By A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine. The rest of the week gets stranger: botnets borrowing

Parents rip Meta’s attempt to curb children from its social media sites after historic $18B settlement: ‘Not enough’ 2026-08-27 at 17:14 By David Landsel, Faran Krentcil Tech giant Meta agreed to a historic $18B payout to 47 U.S. states on Wednesday — as part of an effort to settle claims that social media has harmed

Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers 2026-08-27 at 16:39 By Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE

12.9M Exposed by Carhartt Data Breach 2026-08-27 at 15:03 By More than 50 gigabytes of documents were reportedly stolen. This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools 2026-08-27 at 14:00 By Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT. “The samples employ diverse lure themes, suggesting an effort to appeal to a broad

GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address 2026-08-27 at 13:13 By Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and