Security teams have plenty to keep an eye on today. |
Today’s news covers a $400M TikTok privacy settlement, an Apollo breach, actively exploited TrueConf flaws, and a Google Pixel update. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
TikTok Hit With $400M Privacy Settlement |
TikTok and ByteDance agreed to pay up to $400 million to settle allegations of improperly collecting and retaining children’s personal data. The DOJ alleged TikTok allowed children under 13 to create accounts without parental consent and failed to adequately identify and remove underage users.
|
My Take: Age gates are only useful if they actually work, and this case shows why companies need to test whether children can bypass them and what happens to their data when they do. Organizations subject to COPPA should test age controls, limit unnecessary data collection, verify parental consent, and make sure deletion requests are handled quickly. |
Apollo Breached in Social Engineering Attack |
Apollo Global Management confirmed attackers stole sensitive data after breaching its cloud platforms through social engineering. The breach exposed names, addresses, dates of birth, and Social Security numbers amid a broader social engineering campaign targeting financial firms. My Take: You should test Layer 8 (human) defenses and account recovery processes against convincing impersonation attempts.
Organizations should use secondary verification, phishing-resistant MFA, restrict cloud account privileges, and monitor for suspicious activity involving credentials. |
CISA Orders Agencies to Patch Exploited TrueConf Flaws |
CISA ordered federal agencies to patch two actively exploited TrueConf Server flaws used to compromise systems and spread malware.
The flaws can enable unauthenticated code execution and sandbox escapes, with attackers also using compromised TrueConf servers to distribute trojanized installers carrying the PhantomCore backdoor. My Take: You should assume exposed TrueConf servers may be compromised and investigate for IOCs even after patching.
Apply the patches, restrict TCP port 4307, check installers for tampering, and investigate exposed systems for signs of compromise. |
|
|
|
Anthropic Expands Mythos 5 for AI-Assisted Security Audits |
Anthropic is expanding Mythos 5 access, allowing eligible Claude Enterprise customers to find and fix vulnerabilities in authorized code repositories.
Mythos 5 can identify and prioritize potential vulnerabilities and suggest patches, but human expertise is still needed to validate the findings and approve the fixes. |
My Take: AI tools can help you find potential issues, but you need to apply context to determine what’s an actual risk to the business to determine if it’s worth fixing. Use AI-assisted audits to supplement existing code reviews, and require human validation of vulnerabilities and proposed patches before remediation. |
Google Pixel Update Fixes Privilege Escalation Flaw |
Google’s August Pixel update includes a fix for CVE-2026-0163, a high-severity privilege escalation vulnerability. The flaw affects the Pixel Video Processing Unit, although Google has not disclosed specific technical details or reported exploitation in the wild.
My Take: Instead of panicking and patching every possible vulnerability, security teams need to assess their actual business risk. Pixel owners should install the August update, while organizations should use MDM or UEM to verify patch compliance and restrict access from devices that remain unpatched. |
|
|
|
AI is helping uncover vulnerabilities faster, making risk-based prioritization and management important as patch queues grow. |
How to strengthen risk management: |
- Prioritize the highest-risk threats based on context, potential business impact, active exploitation, and threat intelligence.
-
Use risk management tools to track vulnerabilities, exposures, third-party risk, and remediation progress.
- Assign clear risk ownership and measure whether remediation efforts are actually reducing risk over time.
|
Proper risk management helps teams focus resources on the most pressing risks while giving leadership a clearer view of the organization’s security posture. |
|
|
|
Security Tools You Can Use |
-
Build hands-on AI security skills for less — save 30% on TryHackMe with code TECHADVICE30.
- Build your skills — earn your CompTIA CSIE with CySA+, CASP, Security+, and Pentest+ training for 74% off.
- Protect your business from threats — get 30% off Bitdefender’s powerful cloud and on-premise protection today.
|
|
|
|
Kids’ Privacy Check: Are social platforms doing enough? |
|
|
|
Yesterday's Pulse Check Results |
Could a leaked cloud key expose your environment? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
