🕵️ RESEARCH & DEEP DIVES
Bruce Schneier's DEF CON 34 talk on AI hacking posted online, tops 100K YouTube views
Bruce Schneier's DEF CON 34 talk on what happens when AIs become hackers is now online and has surpassed 100,000 YouTube views.- Applies to the security community and anyone following AI risk; the talk was delivered by Bruce Schneier at DEF CON 34 in the Hacking AI track.
- The talk covers AI hacking — what happens when AI models engage in hacking behavior — combining ideas from his 2022 book A Hacker's Mind with lessons from current AI models.
- The talk video gained over 100K views on YouTube within days of being posted; an AI Village interview with Schneier is also online.
- Talk video: youtube.com/watch?v=eEBv0STiYhI; AI Village fireside chat: youtube.com/watch?v=7-sMBqPV3XU.
Florida DMV's DAVID database breached using stolen police credentials
Florida's DMV confirmed its DAVID driver database was breached using a police employee's stolen credentials.- Applies to Florida drivers whose records are held in the FLHSMV DAVID driver and vehicle database.
- ShinyHunters claims it stole more than 200,000 driver records and shared a screenshot of Jeffrey Epstein's DAVID record as proof; FLHSMV has not confirmed the number of records taken.
- FLHSMV says the attacker used compromised credentials belonging to a single Plant City Police Department employee that were improperly stored on the employee's personal electronic device.
- ShinyHunters claims a different access method: exploiting a password reset flaw to access multiple DAVID accounts, including DMV employees and an FBI agent, then iterating through record IDs to download records and images starting September 3.
- FLHSMV learned of the breach on September 4, 2026, says it was quickly mitigated, and has notified the Florida Attorney General while working with the Florida Digital Service and FDLE.
Passkey-themed phishing attacks lead to Microsoft 365 data theft — BleepingComputer
Phishing Research Challenges Conventional Security Awareness Testing — SecurityWeek
GitLab’s critical flaw is already drawing internet-wide probes — CyberScoop
CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate — Dark Reading
Why AI Is So Good at Scamming Humans — Dark Reading
AI Governance Can't Wait — Dark Reading
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure — The Hacker News
Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks — The Hacker News
Behind the Blog: How to Talk About AI Doom — 404 Media
Device-mapper-multipath: local denial of service via blocking ipc send operat... — CVE ThreatInt
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to att... — CVE ThreatInt
WordPress ElasticPress plugin through 5.3.4 - Sensitive Data Exposure vulnerabilit... — CVE ThreatInt
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection ... — CVE ThreatInt
WordPress Master Addons for Elementor plugin through 3.2.2 - Broken Access Control... — CVE ThreatInt
WordPress Site Kit by Google plugin through 1.186.0 - Cross Site Request Forgery (... — CVE ThreatInt
WordPress Visual Composer Website Builder plugin through 45.16.1 - Cross Site Scri... — CVE ThreatInt
WordPress bbPress plugin through 2.6.14 - Sensitive Data Exposure vulnerabilityUna... — CVE ThreatInt
WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce pl... — CVE ThreatInt
WordPress Starter Templates plugin through 4.7.5 - Insecure Direct Object Referenc... — CVE ThreatInt
WordPress RTMKit plugin through 2.1.5 - Cross Site Request Forgery (CSRF) vulnerab... — CVE ThreatInt
WordPress Amelia plugin through 2.4.9 - SQL Injection vulnerabilityEditor SQL Inje... — CVE ThreatInt
WordPress Bold Page Builder plugin through 5.9.9 - Cross Site Scripting (XSS) vuln... — CVE ThreatInt
KEV: CVE-2026-84869 — ConnectWise ScreenConnect — ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability — CISA KEV