Stay updated with the latest cybersecurity news. This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches from the past few days so you can stay informed and secure in a fast-moving digital landscape.
1. 153 Million Driver’s License Scans Tied to IDScan Probe and Lawsuits
Published: 2026-09-04
A dark-web service called Nexus advertised scans of more than 153 million U.S. and Canadian driver’s licenses, plus millions of ID cards, travel documents, and medical cards. Researcher Brian Krebs traced timestamps to scans taken at rental counters and other verification points, pointing to Louisiana identity-verification firm IDScan.net. The FBI’s New Orleans field office is investigating. IDScan has not publicly confirmed a full breach; Nexus has since gone offline. Multiple class-action lawsuits have already been filed, and the alleged cache reportedly included high-profile IDs.
2. Google Patches Sixth Chrome Zero-Day of 2026
Published: 2026-09-04
Google released Chrome 152 security updates fixing 12 vulnerabilities, including an actively exploited high-severity V8 type-confusion bug tracked as CVE-2026-85046 (CVSS 8.8). A crafted webpage can execute code inside the sandbox. This is Google’s sixth in-the-wild Chrome zero-day of 2026. Users should update to 152.0.7977.82/.83 (Windows/macOS) or 152.0.7977.82 (Linux). Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi need vendor patches as they land.
3. Thomson Reuters C-Track Breach Hits U.S. and Canadian Courts
Published: 2026-09-03
Thomson Reuters disclosed unauthorized access to its C-Track court case-management platform. Attackers obtained files in March 2026; the company detected the activity on June 30. Affected systems include appellate courts in at least 12 U.S. jurisdictions, the U.S. Virgin Islands, and Ontario courts. Exposed records may include names, Social Security numbers, driver’s license numbers, dates of birth, medical and insurance data, and in some cases confidential or sealed filings. Courts say their own networks were not the entry point and C-Track stayed online.
4. Microsoft Warns of “ASCII Smuggling” Phishing at Mass Scale
Published: 2026-09-04
Microsoft is tracking a high-volume phishing campaign that hides lure words with invisible Unicode tag characters (U+E0000–U+E007F). To a human, “funding” still looks normal; to filters that drop or mishandle those tags, the keyword never matches. The technique—often discussed as an AI prompt-injection trick—is now being used to slip financial phishing past email security. Activity ramped through early 2026 with a weekday cadence. Defenders should normalize Unicode in mail pipelines and treat invisible-tag content as hostile.
5. 440,000+ Exploit Attempts Hit WordPress Super Forms and Elementor Pro
Published: 2026-09-04
Wordfence reports mass exploitation of critical flaws in two widely used WordPress plugins: Super Forms (including CVE-2026-14894, CVSS 9.8, unauthenticated arbitrary file upload) and Elementor Pro remote code execution. More than 440,000 exploit attempts have already been logged. Sites running outdated Super Forms or Elementor Pro should patch immediately, review recently uploaded files, and rotate credentials if compromise is possible.
6. Sality Botnet Disrupted After More Than Two Decades
Published: 2026-09-02
U.S., Bulgarian, Hungarian, and Romanian authorities, working with CrowdStrike and the Shadowserver Foundation, disrupted the Sality peer-to-peer botnet first seen in 2003. Operators sinkholed super-peers, seized payload-hosting domains, and isolated infected machines from the operator. At its peak Sality reached huge infection counts; in recent years it mainly pushed clipjacking malware such as EggJagger. Infected hosts now beacon to sinkholes instead of receiving new payloads.
7. 12-Year-Old PostgreSQL Flaw Can Turn Replication Access Into Server Takeover
Published: 2026-09-04
PostgreSQL patched CVE-2026-6471 (CVSS 7.2), a logical-decoding issue present since version 9.4 (2014). An account with the REPLICATION attribute can execute code as the OS user running the database, leading to superuser privileges and a persistent backdoor. Affected branches include versions before 18.6, 17.11, 16.15, 15.19, and 14.24. Restrict replication roles and apply vendor updates promptly.
8. HPE Patches Critical RCE in ArubaOS-CX Switches
Published: 2026-09-04
HPE issued updates for ArubaOS-CX (AOS-CX) covering a large batch of flaws, including a critical remote code execution issue tracked collectively around CVE-2026-73749 (CVSS 9.8). Reports put the total near two dozen to 35 issues. Network teams should treat internet-facing or poorly segmented switches as high priority and move to the patched AOS-CX releases.
Also on the radar
- Pegasus zero-click infections reported against Serbian students and politicians, described as the largest documented surveillance wave in Serbia to date.
- Dropbox said about 5,000 accounts were compromised via a legacy Lenovo ID integration that lacked 2FA.
- OpenAI pledged $1 billion through its Daybreak initiative to put frontier AI tools in the hands of critical-infrastructure defenders.
- Plex urged immediate updates after patching multiple flaws; hundreds of thousands of media servers remain exposed online.
- Prominent U.S. law firms Quinn Emanuel and McDermott disclosed recent data breaches.
Stay Vigilant
This week’s pattern is familiar and getting faster: identity data sitting at third-party scanners, court records in a vendor cloud, WordPress plugins under automated attack, and phishing that now abuses Unicode tricks first built for AI prompt injection.
Practical moves for the next 48 hours:
- Update Chrome (and other Chromium browsers) today.
- Patch WordPress Super Forms and Elementor Pro; scan for unexpected uploads.
- Patch PostgreSQL and HPE AOS-CX if you run them.
- Treat any “funding / invoice / wire” email as suspect even if it looks clean—filters may have missed smuggled characters.
- If you rented a car, used a dispensary kiosk, or otherwise had a license scanned in North America, watch for identity-theft and account-opening fraud; freeze credit where available.
Subscribe for the next daily drop. Stay safe online.