Feed aggregator

AI is rewriting the rules of cybersecurity, and this week, massive government and private sector moves show just how quickly the stakes are rising. Find out how regulators, attackers, and defenders are all scrambling to keep up as vulnerabilities surface at record speed.

• Europe warns their largest banks to prepare for AI attack.
• The EU launches an action plan for AI Cybersecurity.
• China considers keeping its budget AI to itself.
• The UK's NCSC & GCHQ announce their "Cyber Shield".
• CISA is using Mythos to audit U.S. government code.
• Microsoft warns of their upcoming patch flood.
• "RoguePlanet" receives an on-the-fly patch.
• An underused mode to kid-proof an iPhone.
• Listener feedback and three new AI attacks
• HalluSquatting, GhostApproval & GitLost

Show Notes - https://www.grc.com/sn/SN-1087-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

• blackhat.com/us-26 and use code TWIT
• arcticwolf.com/trends
• threatlocker.com/twit
• XBOW.com
• adaptivesecurity.com
• cohesity.com/Resilience

DUBLIN, Ohio (WCMH) -- As temperatures climb in central Ohio, high school sports teams are having to adjust their game plans. The U.S. Environmental Protection Agency said around 9,000 high school athletes are treated for heat-related illnesses each year. “We're on high alert for any heat issue,” said Rachel Reinhart, head athletic trainer at Dublin [...]

COLUMBUS, Ohio (WCMH) -- One Columbus police officer was shot by another while responding to a call Tuesday on the Northeast Side. The officer was taken to a hospital is expected to recover. According to Sgt. James Fuqua, just after 6 p.m., officers responded to the 2600 block of Divot Place on reports of a [...]

COLUMBUS, Ohio (WCMH) -- Republican gubernatorial candidate Vivek Ramaswamy got a boost in the Ohio governor's race with the official endorsement of the Ohio Chamber of Commerce Tuesday -- the largest network of businesses in the state. Polling has been unexpectedly tight -- so much so that several prediction sites now consider the race a [...]

COLUMBUS, Ohio (WCMH) -- Community members have been raising concerns about Columbus’ Flock camera license plate reader system and now city council said it wants to hear those concerns.  Tuesday, council members announced there will be a public hearing in August dedicated to talking about Flock data.  This hearing comes after an audit conducted by [...]

COLUMBUS, Ohio (WCMH) -- Data centers are flocking to Ohio, with over 150 verifiable locations mapped below. Data centers, or large facilities that store computing equipment, have been a central focus for Ohioans as dozens of new projects emerge around neighborhoods, farms and cities. Every Google search, show streamed or ChatGPT query relies on a [...]

FRANKLIN TOWNSHIP, Ohio (WCMH) — Recent data from a speed trailer in Franklin Township found less than 40% of drivers were obeying the speed limit near a busy west side intersection. Police departments are always working to keep the roads as safe as possible and use several tools to do so. The Franklin Township Police [...]

POWELL, Ohio (WCMH) -- The Columbus Zoo and Aquarium announced that Bert, a moose, died after four years in Ohio. Bert was rescued from Alaska in 2022, with his other fellow moose, Scarlet and Violet. Bert enjoyed towering over a crowd in the North America Trek habitat. Guests developed an appreciation for moose. This past [...]

Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.

Nearly 60 of the bugs quashed in July’s Patch Tuesday earned a “critical” severity rating, meaning miscreants or malware could use them to seize remote control over a Windows device with little or no help from the user. Microsoft also addressed three zero-day flaws that are already being exploited in the wild.

Two of the zero-day weaknesses allow an attacker to elevate their user rights on a Windows system, as do approximately 250 other elevation of privilege flaws fixed this month; they include CVE-2026-56155 — an Active Directory Federation Services bug — and CVE-2026-56164, a Microsoft Sharepoint vulnerability.

CVE-2026-50661 is a security feature bypass in Windows BitLocker that could allow attackers to gain access to encrypted data if they have physical access to the device. Microsoft said this bug has been detailed publicly, but that it is not aware of any active exploitation.

In a blog post on July 9, Microsoft Executive Vice President Pavan Davuluri wrote that Windows users will notice “a higher volume of security updates included in each security release” as a result of AI aiding in the discovery of vulnerabilities.

“The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis,” Davuluri wrote.

Jack Bicer, director of vulnerability research at Action1, called attention to CVE-2026-48561, a remote code execution flaw in Microsoft Copilot (with a 9.6 CVSS threat score) that allows an unauthorized attacker to execute code over the network. Microsoft says an attacker could exploit this bug by hosting a malicious website that causes Microsoft Edge for Android to automatically send crafted prompts to Copilot when a user visits the site.

As AI advances the state of vulnerability discovery and remediation, it is also making it easier for attackers to quickly devise working exploits for known software flaws. Microsoft has long labeled security bugs using its “exploitability index,” which is Redmond’s best guess as to how likely it is that attackers will be able to figure out a reliable way to exploit a given vulnerability.

But Satnam Narang, senior staff research engineer at Tenable, argues that Microsoft’s exploitability index needs to do a better job of shifting with the machine speed of discovery. For example, Microsoft originally gave this month’s SharePoint zero-day an exploitability rating of “less likely,” although the flaw was added to CISA’s Known Exploited Vulnerabilities list on July 1.

“Anthropic’s Red Team’s own findings for known vulnerabilities (n-days) revealed how fragile this system has become, with its Mythos Preview model being able to produce proof-of-concept exploits for 13 of 14 vulnerabilities that were rated ‘Exploitation Less Likely’ or ‘Exploitation Unlikely,'” Narang said. “What this means is that our way of looking at Patch Tuesday has changed, because the exploitability index is centered around humans, not AI tools, and as these tools continue to improve, defense needs to improve alongside it.”

Chris Goettl at Ivanti observed that the record patch numbers from Microsoft come as a number of other major software makers are increasing their patch cadence, including Adobe which announced today it is moving to twice-monthly security bulletins published on the 2nd and 4th Tuesday of each month (Adobe also cited AI for accelerating their patch cycles). Cisco, Mozilla and Oracle also are shipping updates more frequently, while Google’s patch batches in June 2026 totaled more than 900 security fixes, Goettl noted.

Backing up your Windows system and/or data is always a good idea before applying operating system updates. Given the volume of patches addressed this month it may be wise for end users to wait a few days before applying these fixes. It’s not uncommon for security patches to introduce system stability issues, and those chances probably increase quite a bit with the gigantic patch count released today.

Further reading:

Action1’s Patch Tuesday blog

Automox’s rundown

COLUMBUS, Ohio (WCMH) -- Rally House’s Lane Avenue store, a stop for Ohio State game day shoppers near Ohio Stadium and the Schottenstein Center, could be demolished and rebuilt under plans filed with the city of Columbus.  Rally House has filed a site plan, submitted by the architect Galloway & Company, to demolish the store [...]

McARTHUR, Ohio (WCMH) — A gag order was approved Tuesday in the case of one of the four adults accused of raising 16 children in “horrific” conditions in a southern Ohio home. Court records show that attorney R. Lee Roberts Jr. requested the gag order Tuesday morning to stop future statements made to media outlets [...]

COLUMBUS, Ohio (WCMH) -- One person is dead following a shooting on Columbus's far southeast side Monday night. Police officers arrived to the 2700 block of Brandy Dr. on reports of a shooting at 11:42 p.m., where they located Aubra Groom, 43, suffering from a gunshot wound. Groom was transported to a local hospital where [...]

DELAWARE, Ohio (WCMH) – A copper producer plans to invest more than $13 million to expand its manufacturing facility in Delaware, a project expected to create 30 full-time jobs and increase the plant's production capacity. Sam Dong Ohio will install new copper casting equipment at its facility at 801 Pittsburgh Drive, allowing it to more [...]

NEW LEXINGTON, Ohio (WCMH) -- A former police officer, who was never charged after being fired for allegedly trying to solicit sex with a child, has been indicted on rape, kidnapping and gross sexual imposition charges relating to the alleged abuse of a 10-year-old. Justin Lally, 44, was indicted on one count of rape, two [...]

The Hocking Hills Mountain Coaster, a first-of-its-kind attraction in Ohio, is set to open in 2027 and will feature a 3,640-foot track winding through the Hocking Hills landscape, with riders controlling individual carts that can reach speeds of up to 26 mph.

COLUMBUS, Ohio (WCMH) -- Thomas Stolly, the attorney representing the mother of 16 children who were rescued from a Vinton County home on June 30, knows the public has questions. Stolly said he and his client do, too. "She is exhausted. She is asking about the kids. And I think she is wanting some of [...]

COLUMBUS, Ohio (WCMH) — With tensions on the rise in the conflict between the United States and Iran, gas prices across the country, including in central Ohio, followed suit. According to According to GasBuddy’s survey of 500 stations in and around Columbus, Ohio, gas prices jumped by 26.5 cents per gallon last week, to average [...]