La Direction générale des finances publiques (DGFiP) a confirmé qu’une intrusion a entraîné la fuite d’un fichier de 678 000 entrées concernant des particuliers et des professionnels. Amélie Verdier, directrice générale des finances publiques, a indiqué le 14 août que les données comprenaient notamment les noms, prénoms, quotient familial, revenu fiscal de référence et taux de prélèvement à la source. FrenchBreaches a relevé dans l’échantillon revendiqué par le pirate des adresses, numéros de téléphone, courriels et nombres de personnes à charge. La DGFiP avait interrompu l’accès fin juin, sans détecter alors l’exfiltration, qui n’a été identifiée qu’après la mise en vente des données le 12 août. Le même pirate a revendiqué une seconde attaque contre un serveur professionnel de données cadastrales, menée fin juillet et confirmée par l’administration. Il affirme avoir obtenu 252 149 lignes représentant plus de deux millions de personnes et avoir contourné l’authentification multifacteur; ces détails n’ont pas tous été confirmés publiquement. La DGFiP affirme que le site impots.gouv.fr et les espaces des usagers n’ont pas été compromis et avoir désactivé les comptes concernés ainsi que d’autres accès sensibles par précaution. L’incident s’inscrit dans une série de compromissions d’administrations françaises. La France n’avait toujours pas transposé la directive européenne NIS2 en août 2026, alors que son échéance était fixée à octobre 2024 et que la Commission européenne l’a renvoyée devant la Cour de justice de l’Union européenne en juillet 2026.

A phishing campaign impersonated a real company to send software engineers a TypeScript coding challenge through LinkedIn recruitment messages. The company named in the outreach was not involved and had publicly warned about the impersonation. Warning signs included a recruiter unaffiliated with the company, no introductory call, a personal Gmail address, an unexpected programming language, and code hosted on Bitbucket. The roughly 180-file project ran a loader when candidates used commands such as npm run dev or npm start. It contacted api.jsonbin.io to retrieve obfuscated JavaScript, which then contacted a command-and-control server at 147.189.174.138. The delivered modules included a remote-access trojan with shell access, SSH pivoting, screenshot capture, clipboard monitoring, and synthetic mouse and keyboard controls; a browser credential and cryptocurrency-wallet stealer; and a file grabber. The malware targeted environment variables, SSH and cloud credentials, .env files, private keys, browser profiles, wallet extensions, and user documents. It could access these files without administrator privileges because they are normally owned by the logged-in user. The malware also checked whether it was running in a virtual machine. Running untrusted coding tests in an isolated VM and restoring a snapshot afterward can limit exposure, although malware can still steal data accessible within that VM. Suspected victims should rotate credentials and keys, assess exposed secrets, and reinstall their operating system.

HackerOne, once the largest bug bounty platform, has faced significant challenges leading to a decline in its prominence. Factors contributing to this fall include increasing competition, changes in the cybersecurity landscape, and internal management issues.

Recent phishing attacks often impersonate parcel delivery services, such as FedEx, using messages that create urgency and fear of missing out. Users can avoid falling for these scams by identifying warning signs, including unusual URLs and the overall tone of the messages.

Thousands of repositories on GitHub are currently distributing malware, accessible through the standard search function without special knowledge. Despite having a substantial budget, a dedicated security team, and AI resources, GitHub has not resolved this issue over the past two years.

Token fraud is a significant issue in the relay market, impacting companies that lose millions of dollars daily due to abuses such as free-credit exploitation and support chatbot manipulation. Software engineers working on AI gateways are increasingly addressing these challenges as token resellers exploit vulnerabilities.

Cybersecurity professionals express concerns over the implications of Claude Mythos Preview, viewing it as a potential game changer that raises significant fears and uncertainties. Despite these concerns, many believe that existing cybersecurity practices remain effective and require little change.

Nightmare Eclipse has publicly shared proof of concept exploits for security vulnerabilities in Microsoft products, claiming to have attempted to report them. The ongoing dispute highlights criticisms of Microsoft's handling of zero-day exploits and the quality of its products.