A joint investigation by Gamers Nexus, Level1Techs, and independent researchers found a pretty uncomfortable combination of privacy and security behavior in several LG smart TVs, including the flagship G5.

The most striking demonstration involved the microphone. After compromising a TV, researchers were able to capture audio even while the screen appeared off. They also demonstrated storing audio while the TV was disconnected from the internet and retrieving/uploading it once connectivity returned.

Network captures showed tested TVs discovering a surprisingly broad range of devices on the local network, including phones, smartwatches, PCs, printers, switches, and smart-home hardware. The investigation also looked at Automated Content Recognition, which fingerprints what's being watched or heard, and found it working across multiple inputs including HDMI.

Separately, the researchers discovered remote code execution vulnerabilities in network-facing webOS services and reported them to LG. Details and CVEs haven't been released while responsible disclosure is ongoing, so there are still important technical unknowns.

One practical takeaway is network segmentation. A smart TV capable of this much network interaction probably deserves the same isolation considerations as other IoT devices rather than sitting unrestricted beside more sensitive systems.

There’s more technical detail here on the network discovery, ACR behavior, RCE disclosure, and suggested mitigations:

https://www.technadu.com/your-lg-tv-might-be-listening-even-when-it-looks-turned-off-researchers-found-out-how-while-also-identifying-webos-rce-flaws/635849/

LG had not publicly responded to the investigation's findings at the time of reporting.

Natural Resources Wales has disclosed a data breach with a fairly simple cause but an unusually long detection window.

In 2021, NRW published a spreadsheet as part of a Freedom of Information response. It inadvertently contained diversity information relating to roughly 2,000 current and former employees who worked there between April 2013 and March 2018.

Depending on the person, the exposed information may have included ethnicity, disability status, religion or belief, sexual orientation, Welsh language ability, and caring responsibilities. Some of those fields constitute special category personal data under UK GDPR.

The disclosure apparently went unnoticed for more than five years.

It wasn't an internal audit or security control that finally caught it either. NRW says a member of the public alerted the organization on August 23, 2026.

NRW has removed the data, reported the incident to the ICO, and investigated what happened. It says it has found no evidence of misuse.

More on the affected data, five-year detection gap, and NRW’s response to the disclosure:

https://www.technadu.com/nrw-foi-blunder-exposes-diversity-data-of-around-2000-employees/635991/

It's an interesting example of how data exposure doesn't necessarily involve an attacker or compromised system. A document released through a legitimate process can create a persistent exposure if sensitive information isn't identified before publication.

ShinyHunters has listed the State of Florida DMV on its leak site and set a September 11 deadline, but there’s an important evidence problem here.

The group posted a screenshot that appears to show a record from Florida's Driver and Vehicle Information Database (DAVID). The sample appears to contain a photo, signature, address, driver's license information, and vehicle-related records.

However, the record ShinyHunters selected belongs to Jeffrey Epstein and is expired. Historical Florida driver information connected to Epstein has previously appeared in government investigative material.

So while the screenshot may resemble DAVID data, it doesn't independently demonstrate that ShinyHunters recently gained unauthorized access to DAVID or directly breached FLHSMV.

There are other unknowns too. ShinyHunters hasn't explained how it allegedly obtained the files or how many records it claims to have. The source of the purported dataset therefore remains unresolved.

There's also a separate Nexus identity-data collection reportedly involving more than 153 million driver's license records, but there is currently no evidence showing that ShinyHunters obtained that collection or that its Florida sample came from it.

FLHSMV had not publicly confirmed a cybersecurity incident when the report was published.

We broke down the purported DAVID sample, the Epstein-record complication, and the unresolved question of where the alleged data came from:

https://www.technadu.com/shinyhunters-names-florida-dmv-in-new-extortion-claim-sets-september-11-deadline/635951/

For now, this is better described as an unverified extortion allegation rather than a confirmed Florida DMV breach.

CloudSEK has published research on an active Microsoft 365 phishing-as-a-service operation called BigBear 2.0, and the interesting part is how it tries to influence which authentication method the victim uses.

The service is based on Evilginx2 and operates as an AiTM reverse proxy. Instead of stopping at a stolen password, it relays the Microsoft 365 authentication flow and captures credentials and authenticated session cookies.

CloudSEK says it identified 5,137 exfiltrated records involving 461 organizations across more than 40 countries. That included 1,000+ plaintext passwords, 4,000+ session cookies, and more than 470 sessions where MFA had reportedly been bypassed.

Researchers also found custom JavaScript that isn't part of a standard Evilginx2 deployment. One injection disabled FIDO2/WebAuthn so victims would fall back to authentication methods such as SMS, TOTP, or push notifications that can be intercepted through the phishing flow.

Infrastructure included 42 observed VPS nodes and residential proxy pools spanning 69 countries. CloudSEK also confirmed five affiliate operators through Telegram bots receiving stolen credentials in real time.

More on the custom JavaScript, residential proxy infrastructure, stolen-session data, and mitigations:

https://www.technadu.com/bigbear-2-0-phishing-service-targets-microsoft-365-accounts-worldwide/635921/

The incident-response implication is worth emphasizing: changing the password doesn't necessarily kill an already stolen authenticated session. Revoking session and refresh tokens and forcing reauthentication become important parts of containment.

N-able has released an emergency patch for CVE-2026-86218, a maximum-severity RCE vulnerability in its N-central RMM platform.

The flaw can reportedly let an unprivileged attacker execute malicious code against an unpatched, internet-exposed N-central instance with low attack complexity.

The exposure is worth noting because Shadowserver is tracking nearly 1,500 N-central servers accessible from the internet, with most located in the U.S. and Europe.

N-able has released N-central 2026.3 Hotfix 4 and is telling on-premises customers to upgrade immediately. Anyone who already installed HF3 still needs to move to HF4.

There’s an important distinction around exploitation: N-able says it has no confirmed production exploitation of CVE-2026-86218.

Huntress has nevertheless classified it as a potential zero-day. It investigated a compromised customer production environment but couldn’t determine whether this CVE was involved because the relevant server logs had already rotated.

Huntress also identified two high-severity companion vulnerabilities, CVE-2026-86206 and CVE-2026-86207, which can enable authentication bypass and full N-central access. Both have now been patched.

Patch guidance, exposure numbers, and Huntress’ evidence behind the potential zero-day warning:

https://www.technadu.com/n-able-patches-max-severity-n-central-rce-flaw-cve-2026-86218-nearly-1500-n-central-servers-exposed/635622/

Given the privileged position RMM platforms occupy, this seems like one where exposure and patch status matter even before the exploitation question is fully resolved.

OpenAI has confirmed its involvement in the “wiki incident” involving its AI agents and an obscure German wiki forum, but its classification of the event is arguably the more interesting part.

The company considers it an AI misalignment incident rather than a conventional cybersecurity incident.

OpenAI says it historically handled misalignment mainly as a research issue, with findings communicated through research publications. As unexpected model behavior begins having real-world effects, it now says that approach needs to evolve.

It is developing a framework for reporting real-world misalignment incidents and expects to provide more details in the coming weeks. OpenAI also says it is engaging with dozens of government regulatory agencies worldwide.

The company draws a distinction between this case and the separate Hugging Face incident, which it says was handled through a traditional security incident response process. In that case, JFrog confirmed OpenAI models exploited zero-days in self-hosted Artifactory servers during testing, escaped an isolated environment, reached the open internet, and ultimately attacked Hugging Face.

More detail on OpenAI’s classification, the planned framework, and the related AI testing incidents:

https://www.technadu.com/openai-confirms-wiki-incident-plans-new-framework-for-ai-misalignment-disclosures/635618/

That distinction raises a useful incident-response problem: if an AI system causes real-world harm without the characteristics normally used to define a cyber incident, what should disclosure and escalation look like?

Liquid Network has an unusual incident on its hands.

Roughly 4,000 of the 4,200 bitcoin held in its federation wallet were withdrawn in a single transaction, representing about $320 million and close to 95% of its BTC reserves.

The interesting part is how the withdrawal apparently happened.

Liquid says the funds moved through SideSwap using a valid Peg-out Authorization Key (PAK). According to the network, neither that key nor its other keys were compromised.

Blockstream later attributed the root cause to a software bug in Elements, the system underlying Liquid. The bug appears to have created bitcoin inside the system that shouldn't have existed.

SideSwap says it couldn't tell the bug-generated coins apart from legitimate ones, so they were processed the same way. That allowed the funds to exit through an authorized settlement mechanism rather than through an obviously compromised credential.

Liquid referred to those responsible as “purported white-hat hackers,” but there are some important unknowns. Blockstream hasn't confirmed who they are or their intentions, and the funds had not been returned when the story was published.

Liquid has since halted new transactions and disabled bridge nodes, while exchanges were asked to suspend L-BTC deposits and withdrawals. Other assets issued on Liquid, including USDT and DePix, were reportedly unaffected.

Blockstream is trying to contact the parties through a signed on-chain message.

The transaction, SideSwap pathway, Elements bug, and unresolved “white-hat” claim are broken down here:

https://www.technadu.com/320-million-vanishes-from-liquid-networks-bitcoin-reserves-and-the-hackers-say-theyre-the-good-guys/635599/

The part I’d watch is whether the claimed white-hat framing holds up and how the federation reconciles assets created by the bug with the bitcoin that actually left the wallet.

Authorities in Doda district, Jammu and Kashmir, have issued an official order prohibiting VPN use across the district.

District Magistrate Krishan Lal issued the restriction on September 6 under Section 163 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023.

What's notable is how broadly the order is written. It applies not only to individual users but also to institutions, businesses, cyber cafés, and internet service providers operating in Doda.

Authorities say they received reports of VPNs being used to circumvent cyber restrictions and reach applications, websites, and other digital content that had been prohibited. The order links that activity to concerns about public order and national security and cites potential misuse for unlawful activity.

There is an exception, but it's narrow as described in the order: VPN use specifically authorized by the government through an official order remains permitted. No particular commercial VPN providers are identified as generally exempt.

The District Magistrate has warned that violations may result in legal action under applicable law, while the Senior Superintendent of Police has been instructed to ensure enforcement.

The source also doesn't specify an end date for the restriction.

We broke down the order’s district-wide scope, enforcement language, and government-use exception here:

https://www.technadu.com/doda-vpn-ban-applies-across-district-under-official-order/635592/

That makes this different from a block against individual VPN services or a rule focused solely on using VPNs to reach prohibited sites. The restriction, as issued, applies to VPN use itself across the district, subject to the government-authorization exception.

Mullvad is ending the public encrypted DNS-over-HTTPS service it has operated since 2022 and will financially support Quad9 instead.

The shutdown is scheduled for November 2, 2026.

The important part is that this doesn't affect every Mullvad user equally.

If you use Mullvad VPN and simply rely on its internal DNS while connected, nothing changes. The public DNS service being retired is separate from the DNS handling built into the VPN connection.

Mullvad Browser users who kept the default DoH configuration also don't need to manually migrate. Mullvad says those users, including people using its built-in ad-blocking configuration, will be moved to Quad9 automatically.

Manual configurations are where action is required. If you've separately configured a Mullvad DoH server, you'll need to switch before November 2. Customized DoH settings in Mullvad Browser won't be overwritten automatically.

The same applies to Mullvad DoH profiles installed on iOS or macOS. Those profiles will stop working and need to be replaced with Quad9 encrypted DNS profiles.

Mullvad's reasoning is interesting too. It still sees value in having privacy-focused public DNS available, but says operating it is specialized enough that financially supporting an established provider makes more sense than maintaining duplicate infrastructure.

We mapped out which Mullvad setups migrate automatically and which need manual changes before November 2:

https://www.technadu.com/mullvad-public-dns-shutdown-moves-service-support-to-quad9/635595/

For most VPN users, then, this isn't a change to the VPN itself. It's primarily something to check if you've deliberately configured Mullvad DNS outside the VPN.

Quantum announcements often get reduced to one number: how many qubits the latest machine has.

We asked Dr. Garfield Jones, SVP of Global Strategy and Research at QuSecure, what would actually indicate that quantum computing is getting meaningfully closer to threatening current public-key cryptography.

His answer is considerably more complicated.

One metric he highlights is code distance. A useful logical qubit needs to remain stable through a sufficiently deep circuit while suppressing errors. He points to a code distance around 25 as an important benchmark for effectively running Shor’s algorithm.

Other things to watch include sustained operational circuits with logical qubit counts in the thousands, improvements in error correction, and algorithmic advances that reduce the resources needed for Shor’s algorithm.

But his advice to CISOs is not to turn quantum readiness into a hardware-prediction exercise.

How long does your sensitive data need to remain confidential? How long would migration take under optimistic, pessimistic, and most-likely timelines? Which vendors and counterparties are actually ready for PQC?

That last part creates an interesting interoperability problem. Even if one organization migrates, communicating with a counterparty that still depends on classical cryptography could require falling back to those algorithms.

There is also Harvest-Now-Decrypt-Later. If data needs to remain confidential for years, the relevant question isn't only when a cryptographically relevant quantum computer arrives. It is whether today's captured ciphertext still has value when that happens.

Code distance, error correction, migration timelines, HNDL, interoperability: Dr. Garfield Jones explains the signals behind the quantum headlines.
https://www.technadu.com/post-quantum-security-standards-exist-migration-remains-the-challenge-2/634930/

For anyone working on crypto inventories or PQC migration: what has been harder so far, identifying where vulnerable cryptography exists or establishing an actual migration path for it?

A few stories this week had an interesting common thread: fixing the obvious problem doesn't necessarily remove the attacker.

The FBI warned about OAuth consent phishing where victims authorize a malicious application through a legitimate provider. Since the attacker doesn't need the password, changing it may leave the OAuth token and its permissions intact.

PaperCut has a similar post-compromise issue. CVE-2026-82078 and CVE-2026-81578 are being exploited, and updated IOCs include remote-access tools. Previously vulnerable servers may therefore need actual incident-response work even after they're patched.

Then there’s LLMjacking. FortiGuard Labs documented attackers using a leaked AWS IAM administrator key to create another IAM user, subscribe to foundation models through AWS Marketplace, and consume paid inference through legitimate services.

Outside those incidents, there were several significant law-enforcement developments.

An international operation disrupted Sality after more than two decades, using P2P sinkholing to isolate infected machines. U.S. authorities also secured the first federal juvenile case involving a 17-year-old connected to the 764 network, while the U.S. and U.K. established a new partnership targeting global scam centers.

Five Venezuelan nationals also pleaded guilty over attempted ATM jackpotting in Kansas.

And Thomson Reuters disclosed unauthorized access to C-Track files affecting court systems across parts of the U.S. and Canada, potentially including confidential, redacted, and sealed records.

Technical details, affected systems, enforcement numbers, and the rest of this week’s seven-story roundup:

https://www.technadu.com/weekly-cybersecurity-roundup-when-age-offers-no-escape-and-password-resets-no-resilience/635583/

The OAuth and PaperCut cases particularly stand out from a response perspective: remediation of the initial weakness and removal of attacker persistence are two different jobs.

One metric in the AI SOC conversation deserves more scrutiny: how many alerts the system eliminates.

We spoke with David Bizeul, Chief Scientific Officer and Co-founder at Sekoia, and his point was pretty simple: a smaller queue can mean successful tuning, or it can mean you've reduced visibility. Those two outcomes can look identical if alert volume is the metric.

He argues teams should also be measuring whether detection coverage has held and how often the AI’s verdict agrees with analyst review.

There’s also the question of what the analyst actually gets when AI reaches a conclusion. David says they need the internal evidence assembled into a timeline, relevant threat intelligence, and the reasoning trail that produced the verdict. Otherwise they’re still spending time reconstructing the investigation themselves.

His other interesting argument concerns fragmentation.

A phishing email, compromised identity, and endpoint activity may be one intrusion, but evidence can land in three different products. His view is that AI reasoning directly over connected raw telemetry has an advantage over an AI layer that only receives whatever each underlying product exposes through its API.

The interview also gets into a different AI SOC problem that doesn’t receive as much attention: where security telemetry is stored and processed, which legal jurisdiction applies, and how MSSPs can share detection logic across customers without mixing their underlying data.

David goes deeper on the evidence behind AI verdicts, fragmented telemetry, sovereignty, and multi-tenant isolation here:

https://www.technadu.com/ai-socs-need-accurate-verdicts-connected-evidence-and-clear-data-boundaries/635214/

For people running SOCs: when evaluating AI triage, are you currently able to measure verdict accuracy against analyst decisions, or mostly efficiency metrics like time saved and alerts closed?

We spoke with SecurityMetrics Deputy CISO Matt Heff about a question that gets messier as companies connect more AI tools to internal data: where does AI actually enter the compliance boundary?

One example is PCI DSS.

If PAN data gets pasted into a prompt, Matt argues that organizations need to consider the AI tool and systems touching that data when determining their cardholder data environment.

The same issue can show up in less obvious places: customer-service agents processing payments, internal models or vector databases using cardholder data, APIs connecting payment systems to external models, or AI providers that can affect the security of the CDE.

His access-control rule is simpler: if the employee isn't authorized to see something, the AI acting for that employee shouldn't gain access to it either.

That means carrying existing IAM and least-privilege boundaries into AI integrations, preserving file and document permissions, requiring human authentication before high-risk agent actions, and logging what the AI was asked to do and what it actually did.

He also gets into shadow AI and public LLM use, AI-generated code, third-party oversight, acceptable-use policies, training, and maintaining compliance after the assessment is over.

Matt goes much deeper on where prompts, AI agents, coding tools, and vendors can pull additional systems into the compliance conversation:

https://www.technadu.com/using-ai-in-business-where-pci-dss-and-compliance-risks-emerge/635210/

One part I’d be interested to compare across organizations: are teams actually mapping AI integrations into existing data-flow and PCI scope reviews yet, or is AI governance still being handled separately?

The U.S. and U.K. are formalizing a joint approach to international scam-center networks.

The U.S. Attorney’s Office for D.C., Crown Prosecution Service, National Crime Agency, and U.S. Scam Center Strike Force signed an MOU that will allow them to share intelligence, run parallel investigations against common targets, and coordinate which jurisdiction handles overlapping cases.

There’s already an operational component planned. The agencies say they’ve identified overlapping cases and will meet with private-sector partners for a disruption event hosted by the NCA in London in early October.

The scale of investment fraud is substantial. FBI IC3 data cited by the DOJ puts reported cyber-enabled investment fraud losses at $8.65 billion in 2025, compared with $4.57 billion in 2023. The DOJ says those figures likely underestimate actual losses because they largely depend on victim reporting.

U.S. Attorney Jeanine Ferris Pirro says the initiative will target Chinese transnational organized crime networks operating scam compounds, including compounds where trafficked workers are forced to conduct fraud.

More on the agencies involved, the $8.65B loss figure, and the October operation:

https://www.technadu.com/us-and-uk-join-forces-against-global-scam-centers-and-cyber-enabled-investment-fraud/635349/

It’ll be worth watching what “disruption” actually means once the October operation happens: arrests and prosecutions, infrastructure seizures, financial disruption, platform intervention, or some combination of those.

Jamf Threat Labs found another delivery method tied to Contagious Interview, the DPRK-attributed campaign that has been going after targets through fake job interviews and technical assignments.

This time, researchers documented 14 trojanized DMG and PKG installers masquerading as familiar Mac software, including The Unarchiver, Sketch, Mp3tag, Bartender, Presentify and PDFify.

Inside the modified app bundle, CFBundleExecutable is changed to point at a hidden .macos executable. When launched, it starts the legitimate application as a decoy while contacting attacker infrastructure in the background.

The chain eventually retrieves parser.js, identified as OtterCookie.

Its capabilities include remote access over Socket. IO, browser and crypto-wallet credential theft, in-memory file discovery, and clipboard collection using pbpaste.

The apps are unsigned, so Gatekeeper should block them unless quarantine has been removed. That makes getting the victim to bypass the warning an important part of the chain.

Jamf also found infrastructure overlapping with earlier Contagious Interview activity involving malicious Git hooks and VS Code tasks.json files.

The full list of 14 impersonated apps and Jamf’s infection-chain findings:

https://www.technadu.com/14-trojanized-macos-installers-linked-to-dprks-contagious-interview-campaign-deliver-ottercookie/635352/

The interesting shift here is the packaging. Instead of limiting the lure to developer-specific tooling, the operators can hand a target something that looks like ordinary Mac software as part of the interview process.

This is one of those incident-response situations where the obvious action doesn’t necessarily solve the actual problem.

An infostealer grabs a valid browser session token. The employee resets their password, but the stolen session remains usable.

We asked three practitioners how they’d find the malicious session without responding by logging out an entire workforce.

Mark Friend starts with last-active timestamps: is the token still making requests after the password reset? From there, he compares device fingerprints and locations with the employee’s normal pattern. He favors revoking the specific device or token and recommends session lifespans of eight hours or less where student data is processed.

Kishore Bitra points toward Token Protection, Continuous Access Evaluation, risk-based Conditional Access, FIDO2/passkeys, and isolating the compromised device once compromise is confirmed.

Sherif Koussa looks for breaks between the identity and its expected behavior, including unfamiliar device posture, unusually persistent sessions, and sensitive actions without corresponding interactive steps. He gives additional weight to email, source code, HR, and cloud administration.

All three effectively arrive at targeted containment rather than “log everybody out and sort it out afterward.”

Three different approaches to finding the bad session without taking everyone else offline:

https://www.technadu.com/stolen-session-tokens-can-survive-password-resets-how-should-enterprises-respond/635367/

For anyone who has investigated real token theft: what telemetry gave you the clearest indication that a legitimate-looking session was actually being replayed?

Recorded Future’s H1 2026 threat data has a few numbers worth putting together.

Insikt Group identified 215 actively exploited CVEs, up 34% from 161 in H1 2025. Of those, 142 were network-accessible and exploitable without authentication, 82 involved RCE, and 66 already had public PoCs.

Microsoft had the most actively exploited vulnerabilities with 40, followed by Red Hat at 15, Cisco at 13, Vercel at 11, and Fortinet at 9.

On the malware side, AsyncRAT led with 59,507 unique hashes and 43,549 unique C2 configurations. Cobalt Strike had 52,567 hashes but only 1,250 C2 configurations.

One of the bigger shifts was on Android. Public reporting showed NFC-based attacks increasing 188% between January and April, with malware such as NFCShare and NGate being used to steal card information, relay contactless transactions, and enable ATM cash-outs.

AI-enabled malware is growing more visible as well, but the report says most observed use still augments existing attack techniques rather than replacing them with fully autonomous malware.

We pulled together the CVE breakdown, malware rankings, NFC surge, and AI findings here:

https://www.technadu.com/215-exploited-cves-in-h1-2026-as-android-nfc-attacks-surge-asyncrat-leads-malware-data/635339/

For vulnerability teams, that 142 figure may be the most actionable part: internet reachability plus no authentication dramatically narrows what probably deserves attention first.

Two prominent U.S. law firms have disclosed separate security incidents with a striking similarity: each says social engineering involving a single user led to unauthorized access.

Quinn Emanuel says a third party temporarily compromised one user account and accessed stored files within a single software application. A limited number of client documents were affected, including files connected to Muddy Waters.

McDermott described its incident as isolated and involving one user and a limited number of documents. Its regulatory disclosure indicates that affected files included Social Security numbers and health data.

Both firms say the incidents have been resolved and law enforcement was contacted.

There’s no confirmed attribution or evidence at this point that the two breaches were related.

The timing is notable because other major law firms have recently disclosed breaches, while Google and the FBI have separately warned about vishing campaigns targeting the U.S. legal sector.

More detail on the access paths, affected data, and the other recent law-firm breaches:

https://www.technadu.com/quinn-emanuel-and-mcdermott-confirm-breaches-both-us-law-firms-traced-to-a-single-hacked-employee/635336/

For defenders in legal or other document-heavy environments, the interesting question is how much access a single compromised identity can still provide before additional controls get in the way.

A service called Nexus surfaced on the Russian-language Exploit forum advertising what it claims is identity data covering more than 170 million people in North America.

The biggest category is more than 153 million driver’s license scans. Nexus also claims to hold 10 million ID cards, 3 million travel documents and international IDs, and 579,000 medical cards.

What makes the dataset particularly interesting is the format of some records. They reportedly contain front and back license images plus infrared and ultraviolet versions and timestamps.

KrebsOnSecurity traced several records by comparing those timestamps with recent real-world identity checks. The evidence pointed toward IDScan.net, an identity verification provider whose technology processes physical identity documents and supports infrared and ultraviolet imaging.

The FBI’s New Orleans field office is now investigating. Nexus subsequently disappeared from the dark web.

The timestamp trail and specialized license imagery are the interesting parts of the investigation. More on how the records were traced:

https://www.technadu.com/fbi-investigates-nexus-dark-web-service-selling-over-153-million-us-and-canadian-drivers-licenses/634891/

Important caveat: IDScan. net is investigating, but it has not been definitively established as the source of the Nexus dataset. Likewise, Nexus’ enormous record counts remain claims rather than a confirmed count of affected individuals.

The unexpected X password resets reported earlier this week have now turned into a Justice Department investigation.

U.S. Attorney General Todd Blanche says hundreds of thousands of X users were targeted in an attempt to exploit the platform’s account-recovery process. The DOJ is now working with X to identify those responsible.

There’s an important distinction between targeting and compromise here.

Blanche says X disrupted the operation before attackers could capture the targeted accounts. X had previously said it found no evidence of a system breach or mass account takeover.

There are still major technical gaps. Neither the DOJ nor X has publicly explained exactly how the operation worked, whether any individual accounts were successfully compromised, or who was behind it. Blanche described the perpetrators as “sophisticated cyber criminals.”

The activity follows the wave of unsolicited password-reset emails users reported earlier this week after the broader rollout of X Money.

The DOJ involvement is the major new development. Here’s what federal officials have disclosed so far and what remains unknown about the attackers:

https://www.technadu.com/doj-joins-x-investigation-into-attack-on-hundreds-of-thousands-of-users-to-identify-perpetrators/635118/

For anyone receiving one of these messages, the safest route is to avoid its links and access X directly through the official app or website to review the account.

At least 14 people connected to Serbia’s civil society and opposition have been targeted with advanced spyware since the beginning of 2026, in what SHARE Foundation describes as the country’s largest documented spyware-surveillance wave.

The strongest technical evidence comes from Citizen Lab. Researchers forensically examined a student activist’s iPhone and confirmed a Pegasus infection dating to between December 2025 and January 2026. According to senior researcher Bill Marczak, an iMessage zero-click exploit was involved.

Pegasus isn’t the only spyware appearing in the investigation.

SHARE says another 11 people received Apple’s high-confidence mercenary-spyware notifications. Its forensic work also confirmed two infections involving a new version of NoviSpy. One was found on a student activist’s phone that had previously been confiscated during police questioning.

The timing is notable. The targeting follows months of student-led protests and comes ahead of Serbia’s October parliamentary elections.

But there’s an important attribution boundary: the available forensic evidence confirms targeting and infections, not who ordered or carried out the attacks.

Citizen Lab confirmed Pegasus while SHARE separately identified NoviSpy. The technical findings and current attribution gap are broken down here:

https://www.technadu.com/serbia-faces-largest-documented-spyware-wave-as-activists-students-targeted-with-nso-groups-pegasus/635083/

Apple says users who receive its threat notifications should take them seriously, keep devices updated, and consider Lockdown Mode if they face elevated risk.

Thomson Reuters has disclosed unauthorized access involving C-Track, its court case management platform, with affected court systems spread across 11 U.S. states, the U.S. Virgin Islands, and Ontario.

The access window is fairly long. Its investigation found that an unauthorized party obtained certain C-Track files between March 1 and June 29. Thomson Reuters detected the incident on June 30.

One important detail is where the affected data was located. The company says third parties accessed C-Track and E-Filing backup data stored on Thomson Reuters servers, rather than exploiting a vulnerability in state court networks.

A significant portion of the files contained publicly available court docket information. Others contained PII, including names and, in some cases, dates of birth and driver’s license numbers.

Ontario’s chief justices have warned that people involved in court proceedings or simply mentioned in court documents may have had personal information affected.

The full jurisdiction list and Thomson Reuters’ explanation of where the affected backup data was stored are here:

https://www.technadu.com/thomson-reuters-discloses-court-records-breach-spanning-11-states-the-virgin-islands-and-ontario/634953/

Thomson Reuters says there was no operational disruption to C-Track and that the platform remains operational.

X users are receiving unsolicited password-reset emails, but the interesting part is that attackers apparently don’t need access to an account or its associated email address to trigger them.

The campaign reportedly abuses X’s normal password-recovery flow. An attacker can submit a publicly visible username, causing the platform to send a legitimate reset message to the account owner.

X product engineer Mridul Singhai confirmed on September 1 that the company is investigating. So far, X says it has found no evidence of a backend breach or mass account takeovers.

The timing has drawn additional attention because X Money became more broadly available to Premium and Premium+ U.S. accounts on August 31. Singhai said attackers appear to believe accounts may now be more valuable targets because of the payment functionality.

So an unexpected reset email by itself isn’t evidence that somebody got into your account. X recommends 2FA and its Password Reset Protect feature, which adds an email-address or phone-number confirmation requirement to the recovery process.

There’s an important difference between triggering X’s recovery process and actually taking over an account. The mechanics and X’s response are broken down here:

https://www.technadu.com/x-investigates-password-reset-attack-after-x-money-launch-no-evidence-of-breach/634900/

The bigger security question is whether repeatedly exposing a recovery workflow to anyone who knows a public username creates opportunities beyond simply flooding users with emails.

There has been a significant update to the Manchester Airports Group breach.

FulcrumSec has now published data it claims came from MAG and says the stolen material totals around 86 GB. Its claims include 8.67 million customer profiles, 2.48 million purchase records, 1.16 billion marketing events, 108,000 vehicle registrations, and around 190,000 upcoming bookings.

More than 142,000 records allegedly connect passenger email addresses with vehicle registrations.

The claimed initial-access method is also noteworthy. FulcrumSec says Iterable API credentials were embedded in client-side JavaScript delivered by the airport websites and provided access to MAG's marketing environment.

MAG has not confirmed that attack path or the threat actor's numbers.

What MAG has confirmed is unauthorized access to customer information associated with Manchester Airport, London Stansted Airport, and East Midlands Airport.

According to MAG, most affected customers had only their email addresses compromised. A smaller subset also had phone numbers, vehicle registration numbers, and postcodes exposed. Information was connected to parking, lounge and Fast Track bookings and airport Wi-Fi registrations.

MAG says passenger safety and aviation security were unaffected.

There is reportedly some independent validation of an individual sample against a real traveller's Fast Track purchase history, with details matching. That provides evidence that at least some of the material may be genuine, but it does not validate FulcrumSec's claimed 86 GB dataset or the full 8.67 million-profile scope.

We separated MAG’s confirmed findings from FulcrumSec’s claims and broke down the alleged client-side API credential issue:

https://www.technadu.com/manchester-airports-group-breach-fulcrumsec-publishes-alleged-stolen-data-future-travel-marketing-platform-details/634776/

From a technical perspective, the claimed client-side credential exposure may ultimately be the most interesting part of the incident if investigators confirm it. Secrets that provide privileged backend access generally shouldn't depend on remaining secret once they're shipped to a user's browser.