Cyber threats aren't standing still. |
Today's headlines span AI-built exploits, Bing Image RCEs, evolving ransomware, privacy concerns, and a threat actor being sentenced.
Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
XBOW Uncovers Bing Images RCE Flaws |
Researchers disclosed three critical Microsoft RCE vulnerabilities, including two in Bing Images, after an AI-assisted investigation uncovered exploitable flaws. These flaws each carry a CVSS score of 9.8 and demonstrate how seemingly routine image-processing components can become high-impact attack vectors.
|
The research highlights how trusted backend services continue to provide attractive targets for attackers seeking remote code execution.
Audit image-processing workflows, restrict supported file formats and helper functions, sandbox image conversion services, and tightly control outbound network access to reduce the risk of command injection and server-side exploitation. |
Snapchat Hacker Targeted Over 750 Women |
An Illinois man was sentenced to more than six years in prison for using social engineering to hack hundreds of Snapchat accounts and steal private photos from more than 750 women.
Prosecutors said the attacker impersonated Snap representatives to steal authentication codes, compromise hundreds of accounts, lock out victims with two-factor authentication, and sell stolen images online. The case highlights how social engineering can bypass security controls by exploiting user trust.
Train users to never share one-time authentication codes, verify support requests through official channels, and monitor accounts for unexpected MFA changes that could indicate a takeover. |
Google Adds Selfie Video Recovery |
Google has added selfie video as an account recovery option for eligible users who lose access to traditional recovery methods. Users must enroll before an account lockout by recording a guided selfie video, which Google later verifies using liveness detection and anti-spoofing technology. The feature expands biometric account recovery but raises privacy considerations and is not available for all Google account types.
Enable multiple account recovery methods, including passkeys, recovery contacts, and recovery phone numbers, so a single lost device or credential doesn't prevent account access. |
|
|
|
AI Agent Builds Redis RCE in Minutes |
Researchers say Moonshot AI's Kimi K3 identified Redis vulnerabilities and built working RCE exploits in just 27 minutes. Redis has released patches for the underlying vulnerabilities, although the reported exploit timeline and additional zero-day claims have not been independently verified. |
The research highlights how quickly AI could shorten the window between vulnerability disclosure and exploitation.
Patch to the latest version, restrict access to high-risk commands such as RESTORE, and review authenticated users and exposed Redis instances for unnecessary access. |
Agentic Ransomware Changes the Game |
Agentic ransomware is moving beyond automation, adapting attacks and making decisions with minimal human involvement. Sysdig's JadePuffer research shows AI agents can autonomously perform reconnaissance, steal credentials, move laterally, and encrypt systems.
For security teams, the biggest challenge is not a new attack vector but a dramatically shorter response window as attacks unfold at machine speed. Strengthen credential governance, reduce internet-facing exposure, deploy behavioral detection, and pre-authorize containment actions. |
|
|
|
Customer expectations are changing as quickly as the threat landscape. Discover how MSPs and MSSPs can evaluate AI-driven security capabilities to strengthen customer protection and prepare their managed security services for what's next during Channel Insider's webinar with ESET on August 18 at 1:00 PM ET. |
|
|
|
How Protected Is Your Data? |
Sensitive data is distributed across cloud environments, on-premise infrastructure, and AI tools, expanding the attack surface organizations must defend. |
How to reduce data exposure: |
- Classify, encrypt, and control access to sensitive data by applying risk-based classifications, encrypting data at rest and in transit, and enforcing least-privilege access.
-
Deploy DLP and continuously monitor data activity to detect and prevent unauthorized data movement, unusual access patterns, privilege changes, and potential insider threats.
-
Maintain and regularly test secure backups to ensure critical data can be quickly recovered after ransomware, accidental deletion, or other disruptive incidents.
|
Reducing data exposure requires continuous visibility, strong governance, and resilient controls that adapt as your attack surface evolves. |
|
|
|
Security Tools You Can Use |
|
|
|
Do Big Tech companies truly put privacy and security first? |
|
|
|
Yesterday's Pulse Check Results |
What's the biggest obstacle to eliminating legacy vulnerabilities? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
