NEW: I spoke to several offensive cybersecurity researchers, including zero-day developers, about how the guardrails imposed by OpenAI and Anthropic on their AI models are getting in the way of their work.

Most complained that the guardrails are inconsistent and too strict, which pushes them to use open source models instead. 

https://techcrunch.com/2026/07/23/how-ai-guardrails-are-impeding-the-work-of-offensive-cybersecurity-researchers/

Zero-day startup Paradigm Shift took down the blog post and corresponding Proof-of-Concept code for the iPhone flaw they dubbed Usbliter8.

Takedown comes following a judge order in the lawsuit filed by Magnet Forensics, which alleges a former employee now at the startup stole the flaw.

NEW: OpenAI said it built a “highly isolated” environment to test a model that then went rogue and autonomously hacked Hugging Face.

According to cybersecurity experts, the company made a human mistake—one expert called "a massive control failure"— that led to the unprecedented AI-enabled attack.

“This should never have happened,” said another expert. “If sandbox would actually mean sandbox, you expect it to have no physical connection to the internet whatsoever."

https://techcrunch.com/2026/07/22/how-an-openais-human-mistake-led-to-the-ai-powered-hack-on-hugging-face/

NEW: Hackers are currently exploiting two critical WordPress flaws, which were patched on Friday, to remotely hack and take over websites, according to several cybersecurity firms.

Around 90 million websites could still be vulnerable, according to an estimate by a security researcher.

https://techcrunch.com/2026/07/20/hackers-are-exploiting-recently-patched-wordpress-bugs-putting-millions-of-websites-at-risk/

NEW: The FBI arrested a 21-year-old student accused of uploaing malware-laden video games on Steam, infecting thousands of victims, and then stealing $220,000 in crypto from some of them.

The man, Zyaire Wilkins, worked with unnamed co-conspirators to publish at least five malware-embedded games.

https://techcrunch.com/2026/07/17/fbi-arrests-man-accused-of-using-steam-games-to-drain-victims-crypto-wallets/

Very interesting detial in NSO Group's training materials for customers:

"Pegasus training material describes situations where it may not be possible to attack a target directly, for example if they do not use a smartphone or are highly security conscious in how they use their device. In those circumstances, NSO Group suggests expanding to 'close-circle infection,' targeting others connected to the target, potentially including colleagues, friends or family members of the primary target in order to gather information about them indirectly."

There have been several documented cases of this happening, including to people close to murdered Saudi journalist Jamal Khashoggi.

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

NEW: Cops say the arrest of two members of the infamous Scattered Spider hacking group have halted the gang’s activities. 

On Thursday, two members of Scattered Spider were sentenced to five years and a half in prison for hacking London’s transportation system in 2024. 

https://techcrunch.com/2026/07/16/uk-cops-say-arrest-of-two-young-hackers-disrupted-the-operations-of-an-infamous-hacking-group/

NEW: A security vulnerability in the remastered version of the classic 25-year-old war strategy game Age of Empires II allowed hackers to take over victims' computers with just a malicious game invite.

https://techcrunch.com/2026/07/15/microsoft-patches-bug-in-video-game-age-of-empires-ii/

NEW: The Iranian government abused well-known flaws in the global telecoms infrastructure — specifically SS7 — to locate U.S. military personnel in the Middle East at the beginning of the war.

https://techcrunch.com/2026/07/14/iran-abused-mobile-networks-vulnerabilities-to-locate-u-s-military-in-the-middle-east-report-says/

NEW: In a major privacy win, the U.S. Supreme Court has ruled that authorities need to get a search warrant when requesting historical "geofence" cellphone location data.

Feds will need to show probable cause when requesting these type warrants, the court ruled, as "an individual has a reasonable expectation of privacy in his cell-phone location information.”

The Supreme Court ruled that historical cellphone location data, even if collected by a third party such as Google, is protected by the 4th Amendment.

https://techcrunch.com/2026/06/29/in-major-privacy-win-supreme-court-rules-geofence-warrants-are-protected-by-privacy-rights/

NEW: Investigators have reportedly concluded that Russian hackers were behind the damaging, disrupting, and costly cyberattack against Jaguar Land Rover last year.

https://techcrunch.com/2026/06/26/russian-hackers-were-behind-2-5-billion-hack-of-jaguar-land-rover-report/