AI Risks, Zero-Days, and Data Breaches Dominate Cybersecurity News

This daily summary highlights significant cybersecurity developments, including OpenAI's pause of its Astra AI project due to potential autonomous cyberattack capabilities. A critical zero-day vulnerability in Metabase (CVSS 10.0) is being actively exploited, allowing unauthenticated attackers to gain administrator access and exfiltrate data. American Addiction Centers disclosed a data breach within its Salesforce environment, exposing sensitive personal and health information. New CSS-based attacks have emerged that can bypass webmail defenses to steal credentials and tokens without JavaScript. Atlassian has patched a critical 'RovoBlast' flaw in its Rovo AI assistant that enabled one-click data exfiltration.

Updates include CISA adding the N-able N-central authentication bypass flaw (CVE-2026-18577) to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing continued risk from an incomplete patch. CISA has also added a critical command injection vulnerability in Progress Kemp LoadMaster (CVE-2026-8037) to the KEV catalog following observed exploitation. Levi Strauss & Co. reported a data breach resulting from a social engineering attack targeting employees, though consumer data was reportedly unaffected.

In policy news, NIST has published the final Cybersecurity Framework Profile for the Transit Sector, offering guidance for IT/OT risk management. The U.S. Senate confirmed Adam Cassady as the Ambassador-at-Large for Cyberspace and Digital Policy, a key role in international cyber diplomacy.