TikTok's $400M Fine, Defender Turned Against Itself & 9,300 Leaked Cloud Keys
Sunday, August 23, 2026 · 5-minute read
The U.S. Department of Justice announced Friday that TikTok will pay $400 million to settle a 2024 lawsuit over how it handled children's data. The government accused the app of knowingly letting kids under 13 create accounts and collecting their data even in so-called "Kids Mode" — without properly honoring parents' requests to delete that information. It's one of the largest child-privacy penalties ever paid by a tech company in the United States.
↗ The Hacker NewsToronto's Hospital for Sick Children disclosed a data breach caused by a flaw in third-party software. Personal information belonging to current and former employees, as well as job applicants, was exposed. The good news: clinical systems and patient medical records were not affected.
↗ BleepingComputerResearchers found more than 9,300 AWS access keys that were accidentally made public at some point between 2022 and 2026 — and are still working. Anyone holding one of these keys could potentially control the corporate cloud accounts they belong to. Many of the leaks came from developers who accidentally posted credentials to public code repositories.
↗ BleepingComputerAttackers are sending fake Microsoft Teams messages that push a new piece of malware called SynkLoader. Once it runs, it shows victims a fake lock screen that looks like a real Windows login prompt — then captures whatever password they type in. This kind of attack is especially dangerous because Teams is widely trusted inside organizations, so people are less suspicious of messages that arrive there.
Kaspersky researchers discovered the first documented case of malware spreading through Android-based car head units — the central touchscreen dashboards in many vehicles. The malware, tied to a Chinese group called MoYu, sneaks in through the car's own built-in software updater. Once installed, it quietly enrolls your car's system in a botnet and uses it to commit advertising fraud.
Microsoft patched a maximum-severity flaw in Entra ID, its cloud identity platform used by millions of businesses worldwide. The bug allowed attackers to execute malicious code and escalate their privileges — meaning they could potentially take over accounts and systems across an entire organization. Microsoft confirmed the vulnerability was already being exploited in real attacks before the patch was released.
Status: Patch available — update via Microsoft's August 2026 patch release immediately.
A critical bug in Elementor Pro — one of the most popular WordPress plugins, used on millions of websites — lets attackers upload malicious files and run their own code on vulnerable sites. If your site uses Elementor Pro and hasn't been updated, an attacker could completely take it over.
Status: Patch available — update Elementor Pro to the latest version through your WordPress dashboard right away.
CISA ordered U.S. federal agencies to urgently patch two flaws in TrueConf Server, a self-hosted video conferencing platform. Attackers are already actively using these vulnerabilities in the wild. Organizations running TrueConf on their own servers are most at risk — self-hosted setups don't get automatic updates the way cloud services do.
Status: Patch available — apply vendor updates immediately. Federal agencies face a mandatory deadline under CISA's order.
A new free service called DecryptAds (decryptads.com) lets anyone look up which advertising companies and data brokers are active on any given website or app. Researchers built it because this data technically exists in public files, but it's nearly impossible to make sense of without cross-referencing dozens of sources at once. For example, a search for espn.com reveals 143 ad partners and 19 data broker domains — including some based in Russia, China, and the UAE. The tool also flags geo-risk adtech partners with a warning, making it easy to spot when a familiar website is quietly funneling your data to companies in adversarial nations. It was created by security researcher Zach Edwards and his team at Infoblox.
Researchers at Check Point presented a finding at this year's Black Hat conference in Las Vegas that sounds almost absurd: a built-in component of Windows Defender — the security software that's supposed to protect your PC — can be turned against your machine to delete other security tools before Windows even finishes starting up.
The component in question is called BTR.sys (Boot Time Removal Tool). It's a kernel driver that Microsoft ships as part of Defender to clean up malware during the boot process. Researcher Jiří Vinopal discovered that this driver can be repurposed by someone with local access to perform arbitrary file and registry deletions at the deepest level of the operating system — affecting every version of Windows from Windows 7 all the way through the latest Windows 11 release. The kicker: because BTR.sys is a required, legitimately signed Windows component, Microsoft can't simply block it without breaking Defender itself.
No software flaw is being exploited here — the driver is working exactly as designed. That's what makes this tricky. Think of it like a master key that a locksmith gave you to enter your own house: it works perfectly, but if someone else gets hold of it, they can use it just as easily. Check Point says there's no evidence this technique has been used in real attacks yet, but the proof-of-concept tool is now public, which means that window won't stay open forever.
For everyday users, the immediate risk is low — an attacker would need to already have some access to your machine to pull this off. But for IT teams and organizations, this is a reminder to watch for unusual boot-time activity and keep an eye out for Microsoft's response. Redmond has been notified and will need to find a creative fix that doesn't require pulling the driver entirely. Watch for guidance in upcoming Windows security updates.