Skip to content
Cybersecurity PSA logo
Cybersecurity PSAWhat happened. Why it matters. What to do next.
Complete Publication Archive

All Articles

Every published Cybersecurity PSA post lives here in reverse chronological order — Daily Briefings and Weekly Recaps together in one editorial stream.

Stable Channel Update for Desktop Top Cybersecurity News
NEWSVerified Cybersecurity PSA briefing
September 2, 2026·Top Cybersecurity News·1 min read

Stable Channel Update for Desktop

TL;DR

The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac and 152.0.7977.75 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note:…

What happened The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac and 152.0.7977.75 for Linux, which will roll out over the coming days/weeks. Reported by Google on 2026-06-10 [N/A][546260492] Critical CVE-2026-84352: Use…

Voice options

Voice names come from your browser and device.

Open article → Google Chrome Releases ↗

What happened

The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac and 152.0.7977.75 for Linux, which will roll out over the coming days/weeks.

Reported by Google on 2026-06-10 [N/A][546260492] Critical CVE-2026-84352: Use after free in WebGL.

What is verified

Reported by Google on 2026-08-14 [N/A][498839176] High CVE-2026-84354: Incorrect authorization in FileSystem.

Reported by Google on 2026-04-02 [N/A][514078656] High CVE-2026-84359: Information leak in Skia.

Reported by Google on 2026-05-17 [N/A][523208474] High CVE-2026-84357: Improper input validation in Omnibox.

Why it matters

A confirmed cyber incident can create secondary risk long after the initial intrusion. Stolen account data, contact information, or business records may be reused for phishing, credential attacks, identity fraud, or targeted social engineering. The source-backed facts above describe the incident; the downstream risk depends on what information was actually exposed.

What you should do

If you are notified that your information or account was affected, follow the organization’s incident instructions first. Change reused passwords, enable multifactor authentication, watch for targeted phishing, review security alerts and account sessions, and monitor financial or identity activity when sensitive personal information may have been involved.

Counterfeit installers to system compromise: Tracking a deceptive software download campaign Top Attack
ALERTVerified Cybersecurity PSA briefing
September 2, 2026·Top Attack·1 min read

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

TL;DR

In this article Attack chain overview Campaign scope and targeting Mitigation and protection guidance References Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has…

What happened The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users. Microsoft has observed…

Voice options

Voice names come from your browser and device.

Open article → Microsoft Security Blog ↗

What happened

The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users.

Microsoft has observed victims across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.

What is verified

Microsoft assesses with moderate confidence that this activity is consistent with the publicly reported Silver Fox (also known as Yinhu, 银狐) fake software campaign but has not attributed it to a nation-state actor.

Organizations should prioritize preventing downloads from untrusted software sources and ensure protections such as SmartScreen, network protection, tamper protection, and Microsoft Defender XDR are enabled to help identify, block, and respond to related activity.

Campaign scope and targeting Microsoft observed affected devices predominantly associated…

Why it matters

The practical risk is that convincing impersonation and social-engineering tactics can turn a single message, login prompt, or support interaction into account takeover or financial fraud. Consumers should treat urgency, requests for credentials, and unexpected payment instructions as signals to verify independently.

What you should do

Verify unusual requests through a trusted channel you initiate yourself. Do not use phone numbers or links supplied in a suspicious message. Use multifactor authentication where available, avoid password reuse, and review account activity after any interaction that may have exposed credentials or payment information.

FBI Probes Service Selling 153M+ Drivers Licenses Top Attack
ALERTVerified Cybersecurity PSA briefing
September 1, 2026·Top Attack·2 min read

FBI Probes Service Selling 153M+ Drivers Licenses

TL;DR

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase…

What happened A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on…

Voice options

Voice names come from your browser and device.

Open article → KrebsOnSecurity ↗

What happened

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada.

Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana.

What is verified

government officials whose drivers licenses can be found for sale.

The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.

The service, dubbed Nexus, claims to have more than 153 million drivers licenses for people in the United States and Canada, as well as more than 10 million identification cards; more than three million travel documents and/or international…

Why it matters

A security flaw matters when an attacker can use it to cross a trust boundary, gain access, run code, bypass authentication, or expose data. The exact risk depends on the affected product, vulnerable versions, exploit conditions, and whether exploitation has been observed. Those details should come from the cited source rather than assumption.

What you should do

Check the vendor or authoritative advisory for affected versions and remediation. Apply the recommended update or mitigation, restart devices or services when required, and prioritize internet-facing or privileged systems. If the source does not report active exploitation, do not treat exploitation as confirmed.

Top Attack
ALERTVerified Cybersecurity PSA briefing
September 1, 2026·Top Attack·1 min read

Cybersecurity IR Workshop: The workshop you shouldn’t miss

TL;DR

In this article What is the Cybersecurity Incident Response Readiness Workshop? Our approach: How we assess your maturity Learn more Cybersecurity incidents can unfold in hours, but response plans often fail at the point of execution: ownership is unclear, investigation findings is…

What happened In this article What is the Cybersecurity Incident Response Readiness Workshop? That is why incident response cannot be something your organization figures out in real time. What is verified The Detection and Response…

Voice options

Voice names come from your browser and device.

Open article → Microsoft Security Blog ↗

What happened

In this article What is the Cybersecurity Incident Response Readiness Workshop?

That is why incident response cannot be something your organization figures out in real time.

What is verified

The Detection and Response Team (DART) – the Microsoft team that delivers Defender Experts Cybersecurity Incident Response – has supported organizations across 54 countries and regions through some of their most challenging security moments; and while we sincerely…

That’s exactly what the Cybersecurity Incident Response Readiness Workshop is designed to do.

The Cybersecurity Incident Response Workshop is a collaborative, scenario driven workshop designed to evaluate your organization’s incident response (IR) plan against realistic, real-world security events, guided by DART researchers.

Why it matters

The security significance comes from the verified facts in the source: what changed, who or what is affected, and what consequence is actually supported. Cybersecurity PSA does not treat speculation, marketing language, or an unverified claim as evidence of compromise or exploitation.

What you should do

Use the original source and vendor or government guidance for product-specific actions. Keep software supported and updated, use multifactor authentication, avoid password reuse, and treat unexpected security messages or account changes as a reason to verify activity directly.

Scammers are spoofing car dealership websites: What you need to know Top Cybersecurity News
NEWSVerified Cybersecurity PSA briefing
September 1, 2026·Top Cybersecurity News·1 min read

Scammers are spoofing car dealership websites: What you need to know

TL;DR

By BCP Staff While the car-buying process can be stressful, whether you’re shopping online or in person, the thought of driving off the dealer’s lot with that sweet ride you’ve had your eyes on can be exhilarating. But imagine showing up at…

What happened But imagine showing up at the dealership and finding out the dealer has no record of your order or your payment. And that there’s no shiny car waiting for you! What is verified…

Voice options

Voice names come from your browser and device.

Open article → U.S. Federal Trade Commission Consumer Alerts ↗

What happened

But imagine showing up at the dealership and finding out the dealer has no record of your order or your payment.

And that there’s no shiny car waiting for you!

What is verified

That’s what’s happening to unwitting car buyers who’ve been duped by scammers impersonating a car dealership.

Why it matters

The practical risk is that convincing impersonation and social-engineering tactics can turn a single message, login prompt, or support interaction into account takeover or financial fraud. Consumers should treat urgency, requests for credentials, and unexpected payment instructions as signals to verify independently.

What you should do

Verify unusual requests through a trusted channel you initiate yourself. Do not use phone numbers or links supplied in a suspicious message. Use multifactor authentication where available, avoid password reuse, and review account activity after any interaction that may have exposed credentials or payment information.

Top Cybersecurity News
NEWSVerified Cybersecurity PSA briefing
September 1, 2026·Top Cybersecurity News·2 min read

Rockwell Automation FactoryTalk Activation Manager

TL;DR

View CSAF Summary The following versions of Rockwell Automation FactoryTalk Activation Manager are affected: FactoryTalk Activation Manager V5.02_and_below (CVE-2026-16675) CVSS Vendor Equipment Vulnerabilities v3 7.8 Rockwell Automation Rockwell Automation FactoryTalk Activation Manager Improper Restriction of Excessive Authentication Attempts Background Critical Infrastructure Sectors:…

What happened View CSAF Summary The following versions of Rockwell Automation FactoryTalk Activation Manager are affected: FactoryTalk Activation Manager V5.02_and_below (CVE-2026-16675) CVSS Vendor Equipment Vulnerabilities v3 7.8 Rockwell Automation Rockwell Automation FactoryTalk Activation Manager Improper…

Voice options

Voice names come from your browser and device.

Open article → CISA Cybersecurity Advisories & Alerts ↗

What happened

View CSAF Summary The following versions of Rockwell Automation FactoryTalk Activation Manager are affected: FactoryTalk Activation Manager V5.02_and_below (CVE-2026-16675) CVSS Vendor Equipment Vulnerabilities v3 7.8 Rockwell Automation Rockwell Automation FactoryTalk Activation Manager Improper Restriction of Excessive Authentication Attempts…

The vulnerability stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations.

What is verified

An authenticated attacker with Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt, allowing full access to all files, processes, and system resources.

View CVE Details Affected Products Rockwell Automation FactoryTalk Activation Manager Vendor: Rockwell Automation Product Version: Rockwell Automation FactoryTalk Activation Manager V5.02_and_below Product Status: known_affected Remediations Vendor fix Rockwell Automation recommends users update to software version V5.03.

Mitigation Customers using the affected software who are not able to upgrade to one of the corrected versions should use Rockwell Automation's security best practices.

Why it matters

A security flaw matters when an attacker can use it to cross a trust boundary, gain access, run code, bypass authentication, or expose data. The exact risk depends on the affected product, vulnerable versions, exploit conditions, and whether exploitation has been observed. Those details should come from the cited source rather than assumption.

What you should do

Check the vendor or authoritative advisory for affected versions and remediation. Apply the recommended update or mitigation, restart devices or services when required, and prioritize internet-facing or privileged systems. If the source does not report active exploitation, do not treat exploitation as confirmed.

Top Attack
ALERTVerified Cybersecurity PSA briefing
September 1, 2026·Top Attack·2 min read

Rockwell Automation Historian ME

TL;DR

View CSAF Summary Successful exploitation of these vulnerabilities could crash the device being accessed; an out-of-bounds write condition may allow remote code execution. The following versions of Rockwell Automation Historian ME are affected: Series B 5.202 (CVE-2025-12768, CVE-2026-12661) Series C 7.101 (CVE-2025-12768,…

What happened The following versions of Rockwell Automation Historian ME are affected: Series B 5.202 (CVE-2025-12768, CVE-2026-12661) Series C 7.101 (CVE-2025-12768, CVE-2026-12661) CVSS Vendor Equipment Vulnerabilities v3 8 Rockwell Automation Rockwell Automation Historian ME Out-of-bounds…

Voice options

Voice names come from your browser and device.

Open article → CISA Cybersecurity Advisories & Alerts ↗

What happened

The following versions of Rockwell Automation Historian ME are affected: Series B 5.202 (CVE-2025-12768, CVE-2026-12661) Series C 7.101 (CVE-2025-12768, CVE-2026-12661) CVSS Vendor Equipment Vulnerabilities v3 8 Rockwell Automation Rockwell Automation Historian ME Out-of-bounds Write, Stack-based Buffer Overflow Background…

An attacker with low-level authentication could exploit this vulnerability to achieveremote code execution on the affected device.

What is verified

View CVE Details Affected Products Rockwell Automation Historian ME Vendor: Rockwell Automation Product Version: Rockwell Automation Series B: 5.202, Rockwell Automation Series C: 7.101 Product Status: known_affected Remediations Mitigation Customers using the affected software, who are not able…

More information can be found at https://www.rockwellautomation.com/en-us/company/about-us/contact-us.html.

https://www.rockwellautomation.com/en-us/company/about-us/contact-us.html Mitigation If you have any questions regarding this disclosure, please contact PSIRT Email: [email protected] mailto:[email protected] Relevant CWE: CWE-787 Out-of-bounds Write Metrics CVSS Version Base Score Base Severity Vector String 3.1 8 HIGH CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.6 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N…

Why it matters

A security flaw matters when an attacker can use it to cross a trust boundary, gain access, run code, bypass authentication, or expose data. The exact risk depends on the affected product, vulnerable versions, exploit conditions, and whether exploitation has been observed. Those details should come from the cited source rather than assumption.

What you should do

Check the vendor or authoritative advisory for affected versions and remediation. Apply the recommended update or mitigation, restart devices or services when required, and prioritize internet-facing or privileged systems. If the source does not report active exploitation, do not treat exploitation as confirmed.

Create a high-quality editorial cybersecurity illustration in a dramatic split-screen composition showing “a tale of two security operations centers.” On the left, a dim, chaotic SOC overwhelmed by dense alert streams, red warning lights, unattended dashboards, and a subtle shadowy intrusion spreading from enterprise servers toward cloud systems and operational technology; analysts appear distracted by false positives and unable to contain the breach. On the right, a calm, well-organized SOC with focused defenders rapidly isolating compromised endpoints, segmented network zones, secured cloud infrastructure, and protected industrial control systems, while a contained red intrusion is stopped at the perimeter. Visually contrast disorder and delayed detection with disciplined monitoring, incident response, network segmentation, multifactor authentication, and resilience. Realistic cinematic lighting, sophisticated blue-and-red color palette, modern critical-infrastructure setting, subtle sense of urgency, professional magazine feature aesthetic, no readable text, no logos, no branding, no gore. Top Attack
ALERTVerified Cybersecurity PSA briefing
August 31, 2026·Top Attack·2 min read

A Tale of Two SOCs: Insights From Two Red Team Assessments

TL;DR

Advisory at a Glance Title A Tale of Two SOCs: Insights From Two Red Team Assessments Original Publication August 25, 2026 Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive…

What happened Advisory at a Glance Title A Tale of Two SOCs: Insights From Two Red Team Assessments Original Publication August 25, 2026 Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red…

Voice options

Voice names come from your browser and device.

Open article → CISA Cybersecurity Advisories & Alerts ↗
Create a high-quality editorial cybersecurity illustration in a dramatic split-screen composition showing “a tale of two security operations centers.” On the left, a dim, chaotic SOC overwhelmed by dense alert streams, red warning lights, unattended dashboards, and a subtle shadowy intrusion spreading from enterprise servers toward cloud systems and operational technology; analysts appear distracted by false positives and unable to contain the breach. On the right, a calm, well-organized SOC with focused defenders rapidly isolating compromised endpoints, segmented network zones, secured cloud infrastructure, and protected industrial control systems, while a contained red intrusion is stopped at the perimeter. Visually contrast disorder and delayed detection with disciplined monitoring, incident response, network segmentation, multifactor authentication, and resilience. Realistic cinematic lighting, sophisticated blue-and-red color palette, modern critical-infrastructure setting, subtle sense of urgency, professional magazine feature aesthetic, no readable text, no logos, no branding, no gore.

What happened

Advisory at a Glance Title A Tale of Two SOCs: Insights From Two Red Team Assessments Original Publication August 25, 2026 Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations…

In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources.

What is verified

Organization A failed to detect or contain the activity, but Organization B rapidly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model.

This advisory details the red team’s activity and organizations’ defensive actions, offering lessons learned and mitigations to help critical infrastructure organizations strengthen detection, response, and protections in IT, cloud, and operational technology (OT) environments.

Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm network defenders.

Why it matters

A confirmed cyber incident can create secondary risk long after the initial intrusion. Stolen account data, contact information, or business records may be reused for phishing, credential attacks, identity fraud, or targeted social engineering. The source-backed facts above describe the incident; the downstream risk depends on what information was actually exposed.

What you should do

If you are notified that your information or account was affected, follow the organization’s incident instructions first. Change reused passwords, enable multifactor authentication, watch for targeted phishing, review security alerts and account sessions, and monitor financial or identity activity when sensitive personal information may have been involved.

CISA adds CVE-2026-82078 affecting PaperCut NG/MF to its Known Exploited Vulnerabilities catalog Top CISA CVE
CVE-2026-82078PaperCut NG/MF · CISA KEV
August 31, 2026·Top CISA CVE·2 min read

CISA adds CVE-2026-82078 affecting PaperCut NG/MF to its Known Exploited Vulnerabilities catalog

TL;DR

CISA added CVE-2026-82078 affecting PaperCut NG/MF to its Known Exploited Vulnerabilities catalog on August 31, 2026, which means CISA has evidence the vulnerability has been exploited in the wild. CISA’s required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What happened CISA added CVE-2026-82078 affecting PaperCut NG/MF to its Known Exploited Vulnerabilities catalog on August 31, 2026. CISA vulnerability name: PaperCut NG/MF Unsafe Reflection Vulnerability PaperCut NG/MF contains an unsafe reflection vulnerability that allows…

Voice options

Voice names come from your browser and device.

Open article → CISA Known Exploited Vulnerabilities ↗

What happened

CISA added CVE-2026-82078 affecting PaperCut NG/MF to its Known Exploited Vulnerabilities catalog on August 31, 2026.

CISA vulnerability name: PaperCut NG/MF Unsafe Reflection Vulnerability

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.

Why it matters

Inclusion in CISA’s KEV catalog means the vulnerability has met CISA’s criteria for known exploitation in the wild. That makes it a higher-priority remediation signal than a vulnerability that is only theoretically exploitable.

CWE: CWE-470

What you should do

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA remediation due date for federal civilian agencies: September 14, 2026.

Additional CISA notes

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82078

Top Attack
ALERTVerified Cybersecurity PSA briefing
August 31, 2026·Top Attack·1 min read

CISA Adds Two Known Exploited Vulnerabilities to Catalog

TL;DR

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability These types of vulnerabilities are a frequent attack…

What happened CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to…

Voice options

Voice names come from your browser and device.

Open article → CISA Cybersecurity Advisories & Alerts ↗

What happened

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets…

What is verified

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog?

Why it matters

A confirmed cyber incident can create secondary risk long after the initial intrusion. Stolen account data, contact information, or business records may be reused for phishing, credential attacks, identity fraud, or targeted social engineering. The source-backed facts above describe the incident; the downstream risk depends on what information was actually exposed.

What you should do

If you are notified that your information or account was affected, follow the organization’s incident instructions first. Change reused passwords, enable multifactor authentication, watch for targeted phishing, review security alerts and account sessions, and monitor financial or identity activity when sensitive personal information may have been involved.