The National Institute of Standards and Technology has released updated Internet of Things security guidelines for public comment through August 24th. The revised guidance, called SP 800-213 Revision 1, focuses on helping federal agencies and organizations securely incorporate IoT products into their systems by establishing cybersecurity requirements and addressing current security challenges that have emerged over the past five years. NIST emphasizes that the updated guidelines shift focus from individual IoT devices to complete IoT products, recognizing that organizations must account for all product components in their risk management processes.

The open source data transfer tool curl has patched 18 vulnerabilities this week, including a 25-year-old flaw that dates back to March 2001. The most notable issue, discovered by AI platform Mythos from Aisle, is a medium-severity authentication bypass vulnerability that could allow an attacker to reuse connections after client certificate settings had changed. While curl is used by over 30 billion devices worldwide, including servers, phones, and cars, there have been no public reports of these vulnerabilities being exploited in the wild.

GitLab has released security updates fixing 13 vulnerabilities, including three high-severity flaws that could allow attackers to execute malicious code or access sensitive information. The most serious issues include cross-site scripting vulnerabilities in the Analytics dashboard and Web IDE that could let attackers run code in users' browser sessions, plus a flaw in Duo Workflows that could expose confidential project data. Users are strongly urged to upgrade immediately to patched versions, with GitLab noting that its own cloud service is already running the secure version.

CISA has added a Lantronix serial-to-IP converter vulnerability to its list of actively exploited flaws, warning federal agencies to patch immediately. The vulnerability, CVE-2025-67038, affects Lantronix EDS5000 device servers and allows unauthenticated attackers to inject commands with root privileges, potentially compromising industrial, healthcare, and other operational technology systems. The flaw was among 20 vulnerabilities disclosed in April that researchers showed could be exploited to manipulate sensor readings in critical environments or serve as a gateway for deeper network intrusion.

California Water Service has found no evidence that hackers accessed its operational technology systems after the Iranian hacker group Handala claimed they could have disrupted the water supply but chose not to. An investigation by cybersecurity firm Mandiant revealed that the hackers only gained unauthorized access to a small number of user accounts within two third-party service provider platforms, including one customer's online account using stolen credentials. The incident highlights the continued vulnerability of the water sector, which remains a prime target for cyber attacks due to its reliance on legacy systems and often inadequate security measures.

New York-based Runlayer has raised 30 million dollars in Series A funding, bringing its total funding to 42 million dollars for a platform that acts as a secure control layer for AI tools in enterprise environments. Founded just this year in 2025, the company has already attracted Fortune 500 clients with its solution that monitors AI access, manages agent deployment, and blocks threats like prompt injections and data exfiltration. The funding round was led by Felicis with participation from Khosla Ventures, and will be used to expand engineering and go-to-market teams.

Cybersecurity researchers have identified a new backdoor called Mistic that's connected to the KongTuke threat actor group, which has been deploying it in campaigns involving ClickFix and ModeloRAT malware. The discovery adds another tool to the arsenal of this threat group, expanding their ability to compromise systems and maintain persistent access to infected networks. Security teams are being urged to update their defenses against these evolving threats.

Security researchers have discovered a new macOS malware called Gaslight that uses an innovative defense technique: prompt injection to interfere with AI-powered security analysis tools. The malware is designed to manipulate AI assistants that security professionals might use to analyze suspicious code, potentially causing them to misidentify the threat or overlook malicious behavior. This represents an emerging trend where attackers are specifically crafting malware to evade AI-based detection systems by exploiting how large language models process and interpret code.

Richard Bejtlich makes the case for Network Detection and Response, or NDR, as organizations navigate what he calls the "Mythos Era" of cybersecurity. Bejtlich argues that NDR remains crucial for detecting threats and understanding network activity, even as organizations adopt modern security frameworks like zero trust. The discussion highlights how visibility into network traffic continues to be essential for security teams despite evolving architectures and attack methods.

Security researchers have uncovered a range of new threats including proxyware being installed on smart TVs and a 24-year-old bug discovered in the widely-used curl software tool. The bulletin also highlights concerns about AI-powered crime forums emerging as new platforms for cybercriminal activity, while security experts emphasize the growing importance of AI in discovering software vulnerabilities and the need for organizations to transition from traditional VPN setups to zero-trust network access models.