This Week In Security: It's Patch Tuesday Again, TVs Spying, Supply Chain Worms Return, Prolonged Hack Impacts, Stolen IDs Hackaday Why this month's Microsoft patch release is a doozy Ars Technica Microsoft Plugs Nearly ...
Several times this summer, Microsoft's Patch Tuesday, the monthly roundup of major security patches for Microsoft products, has included record-breaking numbers of security fixes. The August 2026 patch set actually seemed to catch up. Was this a sign of the bug apocalypse lessening? Ha, nope!
Brian Krebs at Krebs On Security once again brings his excellent roundup of Patch Tuesday events, with this months patch set absolutely crushing previous numbers with nearly 1,000 security fixes.
Two of the fixes are for zero-day vulnerabilities under active exploitation in the wild, both allowing privilege escalation on Windows. Privilege escalation bugs turn general vulnerabilities in applications and games into full administrator access to gain persistence and deploy ransomware, and generally make any vulnerability significantly worse.
Krebs also calls out a CVSS 9.8 (so close to a perfect 10!) vulnerability that allows remote code execution in the Windows shell with no user interaction and no authentication, a remotely exploitable DNS bug present since Windows Server 2012 and Windows 10 which will likely see exploitation in the wild soon, and over a hundred other bugs are ranked "Critical".
How the sheer volume of vulnerabilities in this patch will fit with recent Microsoft recommendations that companies should apply the patches immediately remains to be seen. (Likely: not very well, depending on what new behavior and issues the fixes cause!)
Gamers Nexus continues their trend of high-quality investigation, and they have posted another tremendous multi-hour investigatory video. This time Gamers Nexus focuses on the ecosystem of LG televisions and monitors.
It shouldn't likely surprise many here that "smart" devices are usually more to the benefit of advertisers than consumers. Similarly, it shouldn't be a surprise that a "smart" device harvests user data to sell to advertises. What may be surprising is the degree to which LG devices appear to collect data, how much data is sent even when collection is turned off, and how overt executives at the company are, with multiple executives making statements in pitches to advertisers that LG "owns the glass", "owns the living room", and is designed to correlate devices, inhabitants of the environment, and viewing habits so that ads can be served to the TV and mobile devices in the same room simultaneously.
Gamers Nexus makes the point that while the invasive ad tech is gross, it's mostly limited if the user does not agree to the end-user license agreement - but the infrastructure required to enable it is riddled with security flaws, both discovered and likely additional undiscovered issues. A smart TV is basically a computer, usually running either some flavor of Android or Linux, with the attendant flexibility, power, and problems. A vulnerability in the TV operating system or its apps can provide a route into your internal network. (Not that this required an exploit: LG was called out earlier this summer because 42% of apps on the official app store contained residential proxy systems to sell your home Internet connection.) But it can also access any of the attached hardware, like the microphone.
Gamers Nexus demonstrates that a LG TV can be exploited to gain local root, and from there, it can record audio from attached devices - even when the primary microphone is muted. Gamers Nexus also discovered that muting the microphone on some models does not disconnect or disable the microphone, it simply sets the gain levels extremely low; recording is still possible, and with amplification, audio is still recoverable.
Spy tech and ad tech goes hand in hand; it will be interesting to see if LG responds by at least hardening the security on the devices, or if another company finds traction in selling modern televisions and monitors without the "smart" advertising.
Aikido.dev reports that after 111 days, the Shai-Halud worm returned to the NPM repository.
Shai-Halud was one of several worms hitting package repositories in the Spring of 2026, installing backdoors, stealing cryptocurrency wallets, and taking every login credential and authentication token it could find before infecting every package the tokens linked to. Since then, infections have remained quiet, and repositories like NPM have stated that they now scan every package as it is uploaded.
Charlie Erkisen at Aikido.dev observed that on September 7, 2026, four additional packages uploaded to NPM were infected with Shai-Halud; not a variant of the worm, but the original code, matching the known public signatures. Whatever scanning is in place in the NPM repository didn't filter them, and if an exact match for a known, major worm isn't caught by the infrastructure, it's unclear how a new threat would be.
The apparent ransomware attack against Boston Scientific continues to have impacts, with Boston Scientific filing a report with the SEC that the attack is expected to have an impact on the company earnings.
Boston Scientific makes medical devices, like pacemakers, stents, and monitoring equipment. It has not yet been publicly disclosed what happened, or if customer data was compromised, but the SEC filing confirms that unauthorized access on "certain systems" causing an outage. After several weeks of outages, the company reports that it is able to ship almost at capacity, and that the sterilization facilities for medical devices are online. While there is no estimate provided for full recovery, efforts are ongoing.
Reporting synthesized and verified under Nexvoro.tech editorial guidelines. Full primary records referenced via Google News US Technology.
As Prime Minister enters his first parliamentary session, his administration faces a defining crisis over Palantir's sprawling £670m public sector contracts. Westminster insiders warn that deciding the fate of the US tech firm's NHS data agreements requires an immediate, high-stakes executive choice.
Major US television networks and print publications have suspended pooled coverage of President Donald Trump following the exclusion of CNN, Politico, and MS NOW. The affected media organisations have filed a federal lawsuit against the administration, while the White House defends its actions and launches an independent streaming initiative.
Once confident about expanding their Senate majority, Republican strategists are now scrambling to protect traditional strongholds as economic pressures mount across the Midwest. President Donald Trump's economic agenda faces intense scrutiny from voters, altering the trajectory of key legislative races.
