Top Security Breaches 2026-09-01

Auto-generated 2026-09-01T09:00:37.386737+00:00 (UTC)

1. Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

   Source: The Hacker News | Published: 2026-08-31T11:47:24+00:00 | Score: 17.135
   

   Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX’s artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security.

   The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its

   Original: https://thehackernews.com/2026/08/aurora-ransomware-operators-use-cursor.html

2. Berlin confirms data theft after Rhysida ransomware attack claims

   Source: BleepingComputer | Published: 2026-08-31T13:30:01+00:00 | Score: 16.583
   

   Berlin’s city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site. […]

   Original: https://www.bleepingcomputer.com/news/security/berlin-confirms-data-theft-after-rhysida-ransomware-attack-claims/

3. OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face

   Source: The Hacker News | Published: 2026-08-27T18:36:19+00:00 | Score: 13.32
   

   OpenAI on Wednesday revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May.

   The incident, the company said, took place during cybersecurity evaluations of several OpenAI models, and that it was mainly fueled by what it described as a “highly capable

   Original: https://thehackernews.com/2026/08/openai-says-reward-hacking-drove-ai.html

4. Berlin Refuses to Pay Hackers Who Stole Data From the City’s State Network

   Source: The Hacker News | Published: 2026-08-28T21:30:52+00:00 | Score: 13.296
   

   Berlin’s state government has confirmed that it is the target of an extortion attempt following the August compromise of the city’s state administrative network, and said it will not meet the extortionists’ demands.

   The same statement disclosed that forensic work had found further data outflows in the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment

   Original: https://thehackernews.com/2026/08/berlin-refuses-to-pay-hackers-who-stole.html

5. U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

   Source: The Hacker News | Published: 2026-08-25T18:17:17+00:00 | Score: 12.716
   

   The U.S. Department of the Treasury has announced fresh sanctions on Iranian cyber actors as part of what it called an “unprecedented, whole-of-government, economic campaign” against the nation and its enablers.

   “We are launching an economic onslaught against Iran’s financial connections around the globe. Our objective is to sever every economic lifeline that sustains this tyrannical regime

   Original: https://thehackernews.com/2026/08/us-sanctions-iran-linked-hackers-behind.html

6. ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More

   Source: The Hacker News | Published: 2026-08-31T13:50:00+00:00 | Score: 12.66
   

   The boring parts caused most of the trouble.

   A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional.

   Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept

   Original: https://thehackernews.com/2026/08/weekly-recap-chinese-spy-proxy-ai.html

7. China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

   Source: The Hacker News | Published: 2026-08-31T09:04:55+00:00 | Score: 12.241
   

   A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks.

   Sygnia, the incident response firm that investigated the intrusion, said the actor

   Original: https://thehackernews.com/2026/08/china-linked-fire-ant-hijacks-cisco.html

8. Morocco not to blame for Ceuta border breach, says Spanish PM

   Source: World news | The Guardian | Published: 2026-08-31T10:21:56+00:00 | Score: 12.064
   

   Pedro Sánchez says two countries cooperating and accuses Israel and Russia of spreading fake news about migration Spain’s prime minister, Pedro Sánchez, has said there is no evidence to suggest the Moroccan government was behind last month’s massive border crossing into Ceuta but accused Israel and Russia of spreading disinformation. As many as 141 people are thought to have died trying to enter the Spanish enclave at the end of July. The influx of about 70,000 men, women and children unleashed a political crisis, a humanitarian emergency and reignited tensions within the EU over immigration . Continue reading…

   Original: https://www.theguardian.com/world/2026/aug/31/morocco-ceuta-border-breach-spanish-pm-migration-pedro-sanchez

End of report.