Latest cybersecurity reporting from selected sources.

As age verification laws expand worldwide, organizations face growing pressure to protect users' privacy while meeting regulatory requirements. Incode explains how on-device age estimation verifies age without transmitting or storing facial images, reducing biometric privacy risks while supporting compliance. [...]

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities (KEV) catalog. This week, Microsoft’s July 2026 Patch Tuesday addressed the SharePoint remote code execution bug […]

Open-Weight Model Reopens Debate Over US AI Pricing PowerMoonshot AI's Kimi K3 pushed semiconductor stocks into a bear market and revived debate over whether U.S. labs still lead China on AI, even as benchmarks, weights and true costs are still being analyzed.

Labs Use AI to Speed Testing as Experts Explore Broader Public Health PotentialIt's been the most explosive U.S. public health crisis so far this summer: An outbreak of extreme intestinal illness caused by Cyclospora is sickening thousands of people across dozens of states. Experts say AI is playing a role in the investigation could potentially help head off future outbreaks.

Ernst & Young (EY) disclosed a data breach after attackers compromised a third-party IT support system containing client documents and tax information. Ernst & Young (EY) is disclosed a data breach linked to a compromised third-party support ticket system used by its IT teams. The platform stored support requests that may have included documents containing […]

Persistent AI Coding Model Prompted Safeguard Changes After Rare File LossOpenAI is tightening safeguards after some GPT-5.6 users reported that Codex accidentally deleted local files while operating in full access mode. The company said the incidents were rare but acknowledged the model's persistence led it to take unintended actions without seeking user confirmation.

Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it

Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data. [...]

Agencies Have Until Sunday to Patch Two Critical Command Injection FlawsCISA added two critical FortiSandbox command injection vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of active attacks. Experts warn that unauthenticated remote code execution could let attackers compromise malware analysis systems and pivot deeper into enterprise networks.

Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts

When chained together, the two vulnerabilities allow threat actors to gain root-level capabilities on SonicWall's mobile access appliances.

Infosecurity 2026: What Security Leaders Agree on as AI Reshapes Enterprise RiskAI has broken the speed of attack, but not the fundamentals of defense. Drawing on interviews with security leaders at Infosecurity Europe 2026, ISMG's Pulse Report explores the collapse of the vulnerability window, rise of AI agents, erosion of digital trust and disciplines that matter most.

Also: Potential Fallout From HIPAA Rule Delay, AI Identity Governance ChallengesIn this week's panel, four ISMG editors discussed the rise of artificial intelligence-powered phishing toolkits, potential fallout from the U.S. government's decision to delay a major overhaul of the HIPAA Security Rule and what security leaders see as the defining AI security challenges of 2026.

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack

A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes. [...]

A cyberattack hit one of Japan’s largest food companies, Nichirei, disrupting logistics and shipments. The company is gradually restoring operations. Nichirei is one of Japan’s largest food companies, best known for its frozen food business. Founded in 1942 and headquartered in Tokyo, it operates globally through dozens of subsidiaries. The food giant confirmed that the […]

CISA Lauded for Fast Response, Transparency and Detailing Security RecommendationsSecure developers' use of public code repositories, monitor them for secrets and if they get exposed, have a well-tested incident response playbook at the ready. The U.S. Cybersecurity and Infrastructure Security Agency has shared these and other lessons learned after suffering a data leak.

A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys

AI models left to both interpret and execute commands eliminate critical cybersecurity oversight.

Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine