Serbian spyware, court breach, seven KEV adds

Pegasus spyware hits Serbian student activists via zero-click iMessage exploit

<cite index="42-5,42-6">Citizen Lab confirmed that a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware via an iMessage zero-click exploit</cite>, <cite index="42-7">with high-confidence indicators of infection from December 2025 through January 2026</cite>. <cite index="44-9,44-10">The SHARE Foundation said 14 people were targeted in total, including a member of parliament and a local councilor, while Amnesty International confirmed two devices infected with a new NoviSpy spyware variant</cite>. <cite index="44-5">The timing coincided with local elections held on March 29, 2026</cite>. <cite index="45-7">Amnesty's Security Lab said Serbian students continue to be targeted with Android spyware installed while detained by authorities</cite>. [1]

Thomson Reuters breach exposes court records across 12 U.S. states and Canada

<cite index="52-1,52-2">Thomson Reuters disclosed a breach affecting C-Track, its court case management platform, exposing court records and sensitive personal information across courts in at least 12 U.S. states, the U.S. Virgin Islands, and Canada</cite>. <cite index="52-3,52-4">The company discovered unauthorized activity on June 30, 2026, but determined that an unauthorized third party obtained files in March 2026</cite>. <cite index="52-9">Affected records may have contained names, Social Security numbers, driver's license numbers, medical information, dates of birth, and health insurance information</cite>. <cite index="52-10">Confidential, redacted, or sealed court information may also have been affected at some courts</cite>. [2]

CISA adds seven exploited vulnerabilities to catalog, including Switchvox RCE

<cite index="60-1">CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2, including CVE-2026-9586, a Sangoma Switchvox SQL injection flaw; CVE-2026-82329, a JFrog Artifactory authentication bypass; and CVE-2026-83548 and CVE-2026-83549, SonicWall SMA1000 vulnerabilities</cite>. <cite index="61-6">Unknown threat actors have been observed weaponizing the Switchvox and Artifactory flaws to deploy reverse shells and create admin tokens</cite>. <cite index="65-4,65-5">CISA set a September 5, 2026 remediation deadline for federal agencies, while Horizon3 reported valid exploitation attempts beginning August 30</cite>. [3]

Pentagon cyber strategy expected next week after months of development

<cite index="10-1,10-2">The Defense Department is expected to release its anticipated cyber strategy early next week, with one source predicting a Tuesday release</cite>. <cite index="10-4,10-5">The strategy has been under development for months by the office of Katie Sutton, assistant secretary of defense for cyber policy, and will be the department's first overarching cyber framework since 2023</cite>. <cite index="11-8">Sutton told lawmakers in April the strategy would seek to build the most capable, lethal and agile cyber force in the world</cite>. Officials initially said it would be completed during summer 2026. [4]