In today’s cybersecurity news…

House lawmakers move to extend two key cyber programs

US house lawmakers unveiled a short-term funding bill extending the 2015 Cybersecurity Information Sharing Act and the State and Local Cybersecurity Grant Program until November 21st, giving Congress more time to negotiate longer-term renewals. The programs are set to expire September 30th but provide legal protections for companies voluntarily sharing threat intelligence with the government. The House had proposed a ten-year extension. The Senate’s version offers a shorter term and reduces some private-sector safeguards. (The Record)

Apple 0-day likely used in spy attacks affected older devices

Apple issued a backported security update on Tuesday for older iPhones and iPads, including iPhone 8, 8 Plus, X, and early iPad Pro models, after the vulnerability may have been exploited in sophisticated attacks. The original patch for newer devices was released on August 20th. The flaw allowed malicious image files to execute code, and Apple confirmed it had been used against specific targeted individuals, highlighting ongoing risks to legacy devices. (The Register)

Reuters crafts phishing scam with AI chatbot help

A Reuters investigation shows a variety of AI chatbots can be coaxed into creating phishing emails, despite built-in safety measures. Researchers, including Harvard’s Fred Heiding, tested emails generated by Grok, ChatGPT, Meta AI, Claude, and DeepSeek on 108 senior volunteers. About 11% clicked the links. Bots could also advise on timing and tactics, revealing AI’s potential to scale fraud. (Reuters)

Google nukes 224 ad fraud Android malware apps 

Google removed 224 Android apps tied to a global ad fraud campaign called SlopAds, which generated 2.3 billion ad requests per day, according to HUMAN’s Satori Threat Intelligence team. The apps were downloaded more than 38 million times across 228 countries and used obfuscation and steganography to conceal a malicious “FatModule” APK. Then it collected device and browser data and served ads through fake domains to generate fraudulent revenue. Google Play Protect now warns users to uninstall any affected apps. HUMAN notes the attackers are likely to adapt their methods in future campaigns. (Bleeping Computer)

Huge thanks to our sponsor, Drata

Jaguar Land Rover says shutdown to last ‘at least’ another week

The Jaguar Land Rover cyberattack fallout marches on! The company announced it will keep its global operations offline until at least September 24th. This has sidelined thousands of employees and supply-chain workers, and is costing JLR about £72 million per day. The company confirmed internal data was compromised, leading to potential fines under British privacy law. (The Record)

Chaos Mesh critical GraphQL flaws enable RCE and full Kubernetes cluster takeover

In a report shared with Hacker News, JFrog researchers disclosed critical flaws in Chaos Mesh, an open-source chaos engineering platform, that could let attackers take over Kubernetes clusters by executing commands or steal tokens. According to JFrog, the vulnerabilities, called Chaotic Deputy, stem from weak authentication in the Chaos Controller Manager’s GraphQL server. They were responsibly disclosed on May 6th, and patched in version 2.7.3 on August 21st. Users are advised to update to the latest version. (The Hacker News)

Innovative FileFix phishing attack proves plenty potent

Acronis researchers say a global phishing campaign is weaponizing FileFix, a social engineering technique derived from a June 2025 proof of concept by researcher “mr. d0x.” The lure impersonates Facebook security and tricks victims into pasting PowerShell code into the File Explorer address bar, which executes a loader that then pulls an AI-generated JPG carrying a hidden script via steganography. That embedded script drops StealC, a commercial infostealer that harvests passwords, crypto wallets, and VPN credentials. The campaign, observed by Acronis and visible in VirusTotal uploads, has been translated into at least 16 languages. (Dark Reading)

Self-propagating supply chain attack hits 187 npm packages

A supply chain attack dubbed “Shai-Hulud” has compromised at least 187 npm packages, according to Socket and Aikido researchers. The worm-style malware injects a bundle.js script that uses TruffleHog to steal developer and CI credentials, create unauthorized GitHub workflows, and exfiltrate secrets. CrowdStrike confirmed some of its npm packages were affected but said its core platform is secure. (Bleeping Computer)