DATE

 NAME

Info

CATEG.

WEB

4.9.26

 Still Circling This is a collaborative follow-up to our original post, developed jointly with Emmanuel C., a security researcher not affiliated with LevelBlue, who contributed additional infrastructure and tooling findings based on an analysis of the same GitHub staging account. OPERATION OPERATION

3.9.26

 BraZetsu Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets. MALWARE PYTHON

3.9.26

 FalconFlank FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique. EXPLOIT EXPLOIT

3.9.26

 Communicating Under
Pressure: Best Practices for
Service Providers		 Service outages impacting IT and operational technology (OT) systems can be damaging and disruptive for customers, network defenders, critical infrastructure
owners and operators, and the general public. During incidents that reach or exceed established thresholds, whether caused by malicious activity or a nonmalicious event, service providers must communicate effectively so end users can minimize operational impact. This guide outlines how to prepare for effective outage communications and key elements of clear, actionable messaging.		 Best Practices Best Practices

3.9.26

 Cisco IOS XR Software Security Hardening Release: September 2026 These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities At the time of publication, these vulnerabilities affected Cisco Secure Email devices if they were running Cisco AsyncOS Software Release 16.5.0 or earlier and had S/MIME configured for communication between email gateways. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Advance Notification for Publication of September 2, 2026, Security Advisories Under the Cisco risk-based disclosure process, hardening releases and other security advisories are scheduled to publish on the first and third Wednesday of each month. To help customers prepare, we provide this seven-day advance notice of upcoming security vulnerability disclosures. However, this schedule is not a final commitment of releases. If updates are delayed or unforeseen changes arise, specific products may be removed and rescheduled. Products may also be added when releases are ready ahead of schedule. The latest status is available in the Revision History section of this advance notice. VULNEREBILITY VULNEREBILITY

3.9.26

 Cisco Crosswork Security Hardening Release: August 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. VULNEREBILITY VULNEREBILITY

3.9.26

 CVE-2026-83548 (CVSS score: 10.0) - A server-side request forgery vulnerability in SonicWall SMA 1000 Appliances that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. KEV KEV

3.9.26

 CVE-2026-83549 (CVSS score: 7.8) - A post-authentication operating system command injection vulnerability in SonicWall SMA 1000 Appliances that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. KEV KEV

3.9.26

 CVE-2026-9586 (CVSS score: 9.3) - An SQL injection vulnerability in Sangoma Switchvox that could allow an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. KEV KEV

3.9.26

 CVE-2026-82329 (CVSS score: 9.8) - An improper authentication vulnerability in JFrog Artifactory that under default configuration could allow an unauthenticated attacker with network access to obtain administrative privileges. KEV KEV

3.9.26

 CVE-2026-48710 (CVSS score: 6.5) - An HTTP request/response smuggling vulnerability in Kludex Starlette that could allow attackers to inject paths into the host part, prepending the actual path, leading to issues such as authentication bypass when the authentication depends on the reconstructed URL's path. KEV KEV

3.9.26

 CVE-2026-49869 (CVSS score: 10.0) - An operating system command injection vulnerability in Kestra OSS that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. KEV KEV

3.9.26

 CVE-2026-59822 (CVSS score: 8.8) - An improper authentication vulnerability in Berri LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. KEV KEV

3.9.26

 CVE-2026-72718 Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor VULNEREBILITY VULNEREBILITY

2.9.26

 RevStealer malware impersonates legitimate software RevStealer is an infostealer variant found to be commonly distributed under the disguise of trojanized Electron desktop application. As reported by researchers from Morphisec, this malware strain is primarily spread through game-cheat websites and fake GitHub repositories. ALERTS VIRUS

2.9.26

 Fiasco Ransomware Symantec has collected and analyzed a ransomware binary that belongs to a likely new double-extortion ransomware actor who goes by the name of "Fiasco". They utilize a Rust-written Windows 64Bit PE to encrypt files and append a .secure extension. ALERTS RANSOM

2.9.26

 KryBit Ransomware KryBit is a cross-platform Ransomware-as-a-Service (RaaS) that targets endpoints, virtual machines, and network storage spanning Windows, Linux, and VMware ESXi environments. As per a recent report from Picus Security, the attackers behind this ransomware variant are employing a double-extortion model, and exfiltrating sensitive data before encrypting sensitive files, appending them with a .KRYBIT extension and leaving a ransom note in the form of a .txt file. ALERTS RANSOM

2.9.26

 Adware Sideloading Chain Deploys ValleyRAT Payload Kaspersky has published a report on a campaign distributing the ValleyRAT backdoor disguised as adware. The malware arrives through installer files that, depending on a naming variant, install a decoy application such as a collaboration tool or browser while covertly deploying a modified version of a legitimate Chinese wallpaper utility. They're using that utility for DLL sideloading, so the malicious library gets to run under cover of a signed process. ALERTS VIRUS

2.9.26

 Virtualizor INCIDENT BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access INCIDENT INCIDENT

2.9.26

 Mirax Mirax: a new Android RAT turning infected devices into potential residential proxy nodes MALWARE RAT

2.9.26

 StreamRat Uncovering StreamRat: From Meta Ads to Full Device Takeover MALWARE RAT

2.9.26

 CVE-2026-83548 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations. VULNEREBILITY VULNEREBILITY

2.9.26

 CVE-2026-83549 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. VULNEREBILITY VULNEREBILITY

2.9.26

 Hugging Face Transformers library writes remote code to disk prior to consent check A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library. ALERT ALERT

2.9.26

 Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing Since late 2025, malicious cyber actors have been targeting prominent victims, their family members, and personal acquaintances by directly messaging personal accounts with malicious links leveraging a technique known as "OAuth consent phishing." IC3 IC3

2.9.26

 CVE-2026-63219 Unauthenticated file upload via missing authorization on formatter upload endpoint VULNEREBILITY VULNEREBILITY

2.9.26

 CVE-2021-31886 A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) VULNEREBILITY VULNEREBILITY

2.9.26

 CVE-2026-9586 An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. VULNEREBILITY VULNEREBILITY

2.9.26

 Plump Spider's Operations New Details on Plump Spider's Operations in Pix Fraud Schemes OPERATION OPERATION

2.9.26

 CVE-2026-82329 JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. VULNEREBILITY VULNEREBILITY

1.9.26

 PrettyPrague GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability. Another zeroday in an antimalware provider, I'm not sure but I believe this vulnerability affect other GenDigital products as well (such as AVG, Norton...) EXPLOIT EXPLOIT

1.9.26

 CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability  VULNEREBILITY VULNEREBILITY

1.9.26

 CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability  VULNEREBILITY VULNEREBILITY

1.9.26

 CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability  KEV KEV

1.9.26

 CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability  KEV KEV

1.9.26

 CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user. VULNEREBILITY VULNEREBILITY

1.9.26

 CVE-2026-66066 aka KindaRails2Shell (CVSS score: 9.5) - A vulnerability that could allow an unauthenticated attacker to read arbitrary files from the server, leak Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens, ultimately leading to remote code execution. VULNEREBILITY VULNEREBILITY

4.9.26

 GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests OpenAI on Thursday officially unveiled GPT‑6 Astra , which it described as the "world's most intelligent and aligned model." The development comes days after the artificial intelligence (AI) company said the model had AI The Hacker News

4.9.26

 Recently patched PaperCut zero-days used in data theft attacks Two security vulnerabilities in the PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being abused in data theft attacks. Exploit BleepingComputer

4.9.26

 Cronos blockchain restarts after $74 million Tectonic exploit The Cronos blockchain network has resumed trading activity after a price-manipulation attack on the Tectonic cryptocurrency lending platform allowed an attacker to borrow $74 million. Cryptocurrency BleepingComputer

4.9.26

 Microsoft warns of TerminalFix attacks deploying reverse tunnels A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal. Security BleepingComputer

4.9.26

 Massive Microsoft 365 outage causes auth issues, service failures Microsoft is investigating a widespread service issue causing authentication issues, email delays and failures, and various other issues for Exchange Online customers. OS BleepingComputer

4.9.26

 OpenAI confirms ChatGPT outage as users report errors ChatGPT Work is experiencing a partial outage, and users across multiple subscription plans may be unable to start or continue tasks. AI BleepingComputer

3.9.26

 Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root, alongside an Vulnerebility The Hacker News

3.9.26

 BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts. Virus The Hacker News

3.9.26

 Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data Thomson Reuters disclosed on Wednesday that an unauthorized party obtained files from C-Track , the court case management platform sold by Security The Hacker News

3.9.26

 US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries An RMM phishing campaign initially associated with Canadian targeting due to its use of Canada Revenue Agency (CRA) tax forms as lures has Phishing The Hacker News

3.9.26

 Mini Shai-Hulud's Latest Wave: 280 New Places A new Mini Shai-Hulud wave hit keyv and 800+ npm packages. The malware now scans 469 secret locations, including AI agents, crypto wallets, and CI/CD tools. Cryptocurrency blog GITGUARDIAN

3.9.26

 Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia’s student protest movement was infected with Pegasus spyware. BigBrother blog CITIZENLAB

3.9.26

 Docker OIDC connections for GitHub Actions available for Docker Orgs TL;DR: Docker now supports OpenID Connect (OIDC) for GitHub Actions. Your workflows can authenticate with short-lived, per-run tokens instead of stored PATs or OATs. No secrets to rotate, no credentials to leak. Security blog DOCKER

3.9.26

 Node.js: Old Technique Makes a Comeback The trusted JavaScript runtime has featured in multiple attacks since February 2026, some linked to ransomware. In one case, attackers installed it from its official site to run an implant commanded via the Ethereum blockchain. Hacking blog SECURITY.COM

3.9.26

 EtherHiding: Blockchain Technology as a Cyber Weapon In the cybercrime world, a strange cat and mouse game is continuously taking place. Cybersecurity researchers tirelessly hunt attackers' infrastructures. As soon as some of their components are discovered and brougth to light, they quickly become obsolete because of their addition on IOC's lists that strengthen cybersecurity equipments. This is why attackers must be able to constantly adapt themselves. Hacking blog STORMSHIELD

3.9.26

 EtherHiding Exposed: What Security Leaders Need to Know Attackers have compromised the websites of at least 31 legitimate businesses, including e-commerce, professional services and retail logistics organizations. Visitors arriving to the compromised sites via search engine encounter a fake “Verify you’re human”. Hacking blog GUIDESECURITY

3.9.26

 FBI Investigates Nexus Claim of 153M+ ID Records A Dark Web service called Nexus has claimed to offer access to more than 153 million driver’s license records from the United States and Canada, along with millions of other identity documents. The FBI has reportedly opened an investigation into the exposure. Incident blog SOCRADAR

3.9.26

 Kali365 phishing kit abuses Microsoft authentication The Kali365 phishing kit epitomizes a major shift in phishing, from stealing passwords to abusing legitimate authentication processes. Phishing blog BARRACUDA

3.9.26

 The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action This blog provides a deep-dive into the phishing kit created by Chenlun known as the Outsider Phishing Kit. It is a well established kit in the Chinese community with over 267 ready-made phishing templates targeting over 54 countries worldwide. Phishing blog GROUP-IB

3.9.26

 eSentire Wins 5 G2 Badges in the Fall 2026 Grid® Report We are thrilled to share that eSentire has once again been recognized with multiple badges by G2 as part of their Fall 2026 Grid® Reports! The quarterly G2 Grid® Reports provide a high-level overview of the top leaders in any given product category, based on peer-to-peer feedback from real customers and market presence (based on market share, seller size, and social impact). Security blog ESENTIRE

3.9.26

 REVSTEALER ramps up: analysis of up-and-coming infostealer REVSTEALER's credential harvesting reaches 225 browser extensions and 51 crypto wallets, its gaming session theft needs no password, and its backup C2 address sits on the Polygon blockchain waiting for the primary server to fail. Malware blog ELASTIC

3.9.26

 Linux Detection Engineering - Fileless Execution We reproduced five Linux fileless execution patterns with FENIX, including memfd_create staging, interpreter one-liners, deleted binaries, and in-memory kernel module loads, then mapped each to the Elastic Defend rules that catch it. OS Blog ELASTIC

3.9.26

 Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity Huntress is observing the same anomalous pattern across unrelated endpoints in various organizations: rogue ScreenConnect clients repeatedly spawning wscript.exe to execute 1.vbs, 2.vbs, 3.vbs, and 4.vbs. Malware blog Huntress

3.9.26

 Release Notes: Faster TI Investigations & 650+ Threat Updates Security teams need threat intelligence that helps them move quickly from a suspicious indicator to the context, evidence, and next action. ANY.RUN’s August updates focus on making that process faster and more practical, while expanding detection coverage across host, file, and network activity. Security blog ANYRUN BLOG

3.9.26

 Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According Virus The Hacker News

3.9.26

 Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means In early August, GitGuardian researchers found that a recent Shai-Hulud infostealer worm variant had evolved to scan for credentials across 469 Hack The Hacker News

3.9.26

 Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone The iPhone belonging to a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware , according to new BigBrothers The Hacker News

3.9.26

 Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new Exploit The Hacker News

3.9.26

 CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited Exploit The Hacker News

3.9.26

 Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the AI The Hacker News

3.9.26

 Counterfeit installers to system compromise: Tracking a deceptive software download campaign Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. Cyber blog Microsoft blog

3.9.26

 Clop Never Left: Inside the PTC Windchill Data Theft Campaign Patch CVE-2026-12569, but do not confuse patching with scoping. Hunt back to early June for hex-named JSP files in the Windchill codebase login directory, for flst.txt, and for the X-windchill-req header if you happen to log headers. Cyber blog SUCERONIX

3.9.26

 Langflow and Rails Exploitation Raises Credential Risks Attackers are exploiting two separate critical vulnerabilities affecting Langflow and Ruby on Rails. CVE-2026-0768 allows unauthenticated attackers to execute Python code on affected Langflow deployments, while CVE-2026-66066 can expose files and application secrets through Rails Active Storage. Vulnerebility blog SOCRADAR

3.9.26

 Kim Sooki again? This time, it was disguised as a request for seafood ingredients A request to review the purchase of seafood ingredients arrived. When the file is opened, a normal hwp document appears, but while the user is reviewing the contents, a malicious script runs in the background and even registers a scheduled task. Hacking blog AHNLAB

3.9.26

 “Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing People who initially seem fine but tend to subtly avoid others as the relationship deepens or when conflicts arise—and who disappear when pressured—are commonly referred to as “avoidant types.” By repeatedly pulling away only to reappear, they drain the other person’s emotions and energy, ultimately undermining the relationship. Malware blog AHNLAB

3.9.26

 BlueKit PhaaS in the Wild: BitM, Geofencing, and ScreenConnect Post-Exploitation The campaign did not stop at credential or session theft. After a BlueKit browser-in-the-middle flow, selected victims were moved into a fake document-viewer workflow that delivered a legitimate ScreenConnect client configured for an attacker-used ScreenConnect cloud instance. Phishing blog ZEROBEC BLOG

3.9.26

 Fake Software Installers Disable Windows Update and Weaken Microsoft Defender An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and Virus The Hacker News

3.9.26

 Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git AI The Hacker News

2.9.26

 Your Security Vendor May Not Be Telling You the Truth About Your MTTD – Here's Why That would be inaccurate. The robbery did not start when the security guard called 911. It started when the attacker entered the building. Those first 45 minutes matter. They are the difference between understanding the full incident and reporting only the moment it becomes visible. Security blog RELIAQUEST

2.9.26

 Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction That gap shows up in triage and response first. Teams spend too much time checking IOCs, switching between tools, rebuilding context, and escalating cases that could have been closed earlier. Across thousands of investigations, those extra minutes turn into slower response, more pressure on Tier 2, and higher delivery costs. Security blog ANYRUN BLOG

2.9.26

 Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk August’s attacks showed how quickly trusted business activity can turn into risk. Across the US and Europe, attackers abused Microsoft 365 sessions, legitimate remote-management tools, business-themed files, and even hiring processes to reach corporate systems. Hacking blog ANYRUN BLOG

2.9.26

 The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT Between late July and mid August 2026, multiple Huntress-protected organizations were hit by the same modular RAT, three of which were hit within an 85-minute window. Victims were tricked into downloading a JavaScript file that quietly pulled down an installer for a real, working Exodus crypto wallet, with the RAT hidden inside. Cryptocurrency blog Huntress

2.9.26

 Daisy-Chaining Trust: Investigating Faronics Deploy Abuse Threat actors are abusing Faronics Deploy, a legitimate endpoint management platform, to execute attacker-controlled PowerShell after phishing victims install the software. Hacking blog Huntress

2.9.26

 Proofpoint Sponsors the Insider Threat Matrix: Building a Common Language for Insider Risk Today, Proofpoint is proud to sponsor the Insider Threat MatrixTM, an open, community-driven framework designed to help organizations better understand, detect, and investigate insider risk—both human and synthetic. Cyber blog PROOFPOINT

2.9.26

 Beyond Device Code Phishing: Preparing for the Next Wave of AI-Powered Attacks Cybercriminals have always embraced new technologies to improve their effectiveness. Today, artificial intelligence has become another tool that can help threat actors operate faster and at greater scale. Phishing blog PROOFPOINT

2.9.26

 Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon A Chinese-speaking actor is now targeting Brazil. Check Point Research has uncovered a sustained campaign against Brazilian organizations, primarily government and educational institutions since mid-2025. APT blog CHECKPOINT

2.9.26

 Uncovering StreamRat: From Meta Ads to Full Device Takeover ThreatFabric researchers have uncovered StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service, with the campaign reaching approximately 570,000 potential victims. Malware blog THREATFABRIC

2.9.26

 Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and sports betting. APT The Hacker News

2.9.26

 BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access Virtualizor said hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic. The hackers then used the diverted update traffic Hack The Hacker News

2.9.26

 Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking Virus The Hacker News

2.9.26

 Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances Exploit The Hacker News

2.9.26

 Can AI Create PLC Attacks? Yes, But It’s Not That Easy Yet We used AI assistance to successfully port a remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) model to another. ICS blog FORESCOUT

2.9.26

 GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source Vulnerebility The Hacker News

2.9.26

 Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands The U.S. Department of Justice (DoJ) has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017. BigBrothers The Hacker News

2.9.26

 Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit from one Exploit The Hacker News

2.9.26

 Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated Exploit The Hacker News

2.9.26

 Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as Virus The Hacker News

2.9.26

 Chinese Fire Ant hackers turn Cisco routers into spying platforms The researchers discovered Fire Ant's new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history. APT BleepingComputer

2.9.26

 File servers are here to stay. Here’s how to manage them securely File servers remain a critical part of many IT environments, but managing access securely can become complex as permissions accumulate. tenfold Software outlines five best practices for simplifying file server administration and maintaining least-privilege access. Security BleepingComputer

2.9.26

 Berlin confirms data theft after Rhysida ransomware attack claims Berlin's city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site. Ransom BleepingComputer

2.9.26

 Microsoft says Windows 11 KB5120998 update resets mouse settings Microsoft has confirmed that mouse settings are being reverted on Windows 11 systems after installing the KB5120998 August 2026 non-security preview update. OS BleepingComputer

2.9.26

 Nigerians extradited to US for sextortion, deaths of two teens Two Nigerian men extradited to the U.S. on Thursday have been charged with involvement in sextortion schemes that resulted in the deaths of two minor victims in Mississippi and North Carolina. BigBrothers BleepingComputer

2.9.26

 Microsoft asks users to ignore 'Antivirus is turned off' errors Microsoft asked customers this week to ignore alerts that Defender Antivirus has been turned off after installing the latest Defender updates. OS BleepingComputer

2.9.26

 FulcrumSec claims Manchester Airports hack, theft of 86 GB of data FulcrumSec claims it stole 86 GB of data from Manchester Airports Group. BleepingComputer validated one traveller's record, while samples revealed detailed customer, booking, and travel information beyond what MAG initially disclosed. Incindent BleepingComputer

2.9.26

 Anthropic warns infostealer malware is hijacking Claude sessions to drain usage Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage. AI BleepingComputer

2.9.26

 Chrome Web Store extensions caught stealing crypto, browser data Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures. Cryptocurrency BleepingComputer

2.9.26

 Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr . The vulnerability in question is CVE-2026-82329 (CVSS Exploit The Hacker News

2.9.26

 Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze CyberCrime The Hacker News

1.9.26

 13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Cryptocurrency The Hacker News

1.9.26

 Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued Virus The Hacker News

1.9.26

 Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 METR (short for Model Evaluation and Threat Research and pronounced "Meter"), a research non-profit that evaluates frontier artificial intelligence AI The Hacker News

1.9.26

 Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that's been put to use by a Russia-aligned threat actor APT The Hacker News

1.9.26

 Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript. Virus SECURELIST

1.9.26

 Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: Exploit The Hacker News

1.9.26

 North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales Threat actors with ties to the Democratic People's Republic of Korea (aka DPRK or North Korea) have been observed seeking job opportunities APT The Hacker News

31.8.26

 Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack Recently, we've been interested in how AI is impacting the attack surface, so we started researching AI-assisted vulnerability discovery and AI-targeted technologies for our 1H-2026 State of Exploitation report. AI blog VULNCHECK

31.8.26

 45% of American Research Universities Expose Computing Infrastructure The standard story about higher education cybersecurity is that it’s target-rich and cyber-poor: a sprawling, underfunded sector where the weakest links are the community colleges and cash-strapped campuses without the budget for a real security program. This study finds the opposite pattern. Incident blog FLARE.IO

31.8.26

 Anthropic Links Claude Session Theft to Infostealer Malware An affected Claude user has shared a warning from Anthropic stating that infostealer malware can steal active Claude login sessions from infected computers. Attackers can reuse these sessions to access accounts and consume available usage without completing the normal sign-in process again. Malware blog

SOCRADAR

31.8.26

 Finnish Kennel Club, Shell Access, UK Iframe, Salt Mobile, and Brazil SERPRO Claims SOCRadar Dark Web Team identified several new underground posts, including an alleged Finnish Kennel Club and Showlink dog-show database leak, and a separate initial access listing offering shell and WordPress access to websites in Indonesia and Romania. CyberCrime blog

SOCRADAR

31.8.26

 ServiceNow Patches Multiple CVSS 10.0 Flaws ServiceNow disclosed four vulnerabilities affecting its AI Platform and related Now Platform components on August 27, 2026. Three received vendor-assigned CVSS v4.0 scores of 10.0, while a fourth was rated 8.7 High. Vulnerebility blog

SOCRADAR

31.8.26

 PaperCut RCE Chain: CVE-2026-82078 Exploited PaperCut disclosed two vulnerabilities in PaperCut NG and PaperCut MF that can be chained into a pre-authentication Remote Code Execution (RCE) path against vulnerable Application Servers. Vulnerebility blog SOCRADAR

31.8.26

 Introducing the Aur0ra Ransomware Group During a recent incident response engagement for an external organization, the BHIS ActiveSOC team investigated activity attributed to the Aur0ra ransomware group. In this incident, initial access was gained through vishing following aggressive email bombing. This foothold was followed up by the deployment of a unique C2 mechanism with noisy lateral movement & ransomware attempts. Ransom blog BLACKHILLS

31.8.26

 Carry-On Compromise: TA4922 Packs PackClient Proofpoint researchers recently discovered a RAT framework we named PackClient. PackClient is being used by at least one threat actor, Chinese-speaking TA4922, and appears to be actively sold on Telegram. PackClient is a full featured, modular command and control (C2) framework that supports data theft, surveillance, and downloading of additional plugins and payloads. APT blog PROOFPOINT

31.8.26

 Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets. Malware blog GROUP-IB

31.8.26

 Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation Gambit Security’s Threat Intelligence team investigates emerging attacker tradecraft and the evolving ways threat actors disrupt organizations. As part of this research, we track threat actors and their operations to identify new techniques, tooling, and approaches to disruption. Ransom blog GAMBIT SECURITY

31.8.26

 ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add Virus The Hacker News

31.8.26

 Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding Ransom The Hacker News

31.8.26

 ValleyRAT masquerading as adware Threat actors are distributing the ValleyRAT backdoor disguised as adware. We analyze the infection chain, from the malicious installer to the final payload. Virus SECURELIST

31.8.26

 China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System APT The Hacker News

31.8.26

 DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims The U.S. Department of Justice (DoJ) on Friday corrected a previously issued press statement that several of its agencies were victims of attacks BigBrothers The Hacker News

31.8.26

 BraZetsu Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets. MALWARE PYTHON

31.8.26

 Fire Ant Fire Ant Evolves: From Hypervisors to Trusted Infrastructure APT APT

31.8.26

 CVE-2026-60004 Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. VULNEREBILITY VULNEREBILITY

31.8.26

 CVE-2026-6876 ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. VULNEREBILITY VULNEREBILITY

31.8.26

 CVE-2026-74820 ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended. VULNEREBILITY VULNEREBILITY

31.8.26

 CVE-2026-18886 ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. VULNEREBILITY VULNEREBILITY

31.8.26

 CVE-2026-18885 ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended. VULNEREBILITY VULNEREBILITY

31.8.26

 OpenAI – Hugging Face Incident Technical Report In July 2026, during internal cybersecurity evaluations, OpenAI models in an internal evaluation environment circumvented controls intended to isolate them from the internet and performed computer network exploitation of OpenAI’s internal research infrastructure and Hugging Face systems. REPORT REPORT

30.8.26

 Anthropic is cutting Claude Code's current weekly limits by 17% Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds. AI BleepingComputer

30.8.26

 Brave browser adds email aliases to help users evade tracking The latest version of the Brave browser, 1.94, introduces a feature called 'Email Aliases' that allows users to generate disposable email addresses when signing up to a new service. Security BleepingComputer

30.8.26

 McKesson discloses breach after ShinyHunters claims patient data theft Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records. Incindent BleepingComputer

30.8.26

 PaperCut releases second emergency patch for exploited flaws PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes. Exploit BleepingComputer

30.8.26

 GiveWP WordPress donation plugin flaw lets hackers execute server commands A maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server. Vulnerebility BleepingComputer

30.8.26

 68-year-old imprisoned after making $1.3 million by pirating IPTV services A 68-year-old has been sentenced in the U.K. to more than six years in prison for operating an illegal IPTV (Internet Protocol Television) service that generated £980,812 ($1.3 million) over three years CyberCrime BleepingComputer

30.8.26

 AI Is Accelerating Vulnerability Discovery. Can Defenders Keep Up? AI is accelerating vulnerability discovery, putting pressure on systems built to enrich, prioritize, and remediate flaws at a slower pace. Action1 explains why defenders increasingly need to correlate multiple intelligence sources and turn vulnerability data into faster remediation. AI BleepingComputer

30.8.26

 Over 8,300 Gitea servers vulnerable to code execution attacks Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. Vulnerebility BleepingComputer

30.8.26

 Toy-making giant Hasbro disclose data breach affecting employees Hasbro, one of the world's largest toy and game companies, has disclosed that attackers have accessed the personal and financial information of an undisclosed number of employees. Incindent BleepingComputer

30.8.26

 ServiceNow warns of three max severity security vulnerabilities ServiceNow released security patches for three new maximum-severity AI Platform vulnerabilities that can be exploited in code injection, SQL injection, and privilege escalation attacks. Vulnerebility BleepingComputer

30.8.26

 Windows 11 KB5120998 update released with 35 changes and fixes Microsoft released the KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2, which comes with 35 changes, including improvements to the Start menu, taskbar, and Windows search. OS BleepingComputer

30.8.26

 Nearly 700 rogue AI agents coordinated in the Hugging Face attack New details about the July attack on Hugging Face reveal that hundreds of AI agents driven by OpenAI's internal IM1 model coordinated the compromise through an unauthorized message board. AI BleepingComputer

30.8.26

 PaperCut warns of NG, MF flaw exploited in zero-day attacks PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. Exploit BleepingComputer

30.8.26

 Manchester Airports Group says hackers stole travelers' data The Manchester Airports Group (MAG) disclosed that hackers breached its systems and stole customer data, including Wi-Fi sign-ups from Manchester, Stansted, and East Midlands airports. Incindent BleepingComputer

30.8.26

 How Threat Research and MDR Help SMBs Build a Defensive Edge Threat research gives security teams insight into how attackers operate, while MDR turns that intelligence into faster detection and response. ESET explains how combining threat intelligence, continuous monitoring, and human expertise can help SMBs strengthen their defenses. Security BleepingComputer

30.8.26

 Android 17 adds ECH support to make web browsing harder to track Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular vulnerabilities, and protect the privacy of users' home networks. OS BleepingComputer

30.8.26

 CVE-2026-76581 (CVSS score: 9.8) - An authentication bypass flaw in the WPMU DEV Dashboard plugin that could allow an unauthenticated attacker, on sites connected to WPMU DEV with Hub Single-Sign On (SSO) enabled and mapped to an administrator, to obtain administrator access and achieve site takeover. (Affects all versions up to, and including, 5.0.1) VULNEREBILITY VULNEREBILITY

30.8.26

 CVE-2026-18431 (CVSS score: 9.8) - An arbitrary file write flaw in the Avada theme for WordPress that makes it possible for an unauthenticated attacker to write attacker-controlled files to the server, which, in turn, can be exploited to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. (Affects all versions up to, and including, 7.16, when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16) VULNEREBILITY VULNEREBILITY

30.8.26

 CVE-2026-19632 (CVSS score: 9.8) - A sensitive information exposure flaw in the "TranslatePress – Translate Multilingual sites with AI Translation" plugin that could allow an unauthenticated attacker to extract the raw administrator password-reset URL, including the plaintext reset key and login parameters, and enable full administrator account takeover. (Affects all versions up to, and including, 3.3.1 only when automatic string saving is enabled and the target administrator's profile locale is set to a published secondary language) VULNEREBILITY VULNEREBILITY

30.8.26

 CVE-2026-19598 (CVSS score: 9.8) - A privilege escalation flaw in the "Pods – Custom Content Types and Fields" plugin that allows an unauthenticated attacker to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, resulting in complete site takeover. (Affects all versions up to, and including, 3.3.9) VULNEREBILITY VULNEREBILITY

30.8.26

 CVE-2026-82222 (CVSS score: 10.0) - A vulnerability in the GiveWP plugin that allows an attacker to execute arbitrary commands on the server of a GiveWP site that has one published donation form and one active payment gateway. (Affects all versions up to, and including, 4.16.7.1) VULNEREBILITY VULNEREBILITY

29.8.26

 CVE-2026-77554 A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device. VULNEREBILITY VULNEREBILITY

29.8.26

 CVE-2026-77550 A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances. VULNEREBILITY VULNEREBILITY

29.8.26

 CVE-2026-77537 A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device. VULNEREBILITY VULNEREBILITY

29.8.26

 CVE-2026-20896 Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled. VULNEREBILITY VULNEREBILITY

30.8.26

 TerminalFix campaign deploys a reverse tunnel through multistage intrusion Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake Cloudflare CAPTCHA verification overlay that tricks users into copying and executing a malicious PowerShell command. Malware blog Microsoft blog

30.8.26

 TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix , that aims to trick users into running a malicious command in Virus The Hacker News

30.8.26

 Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. Vulnerebility The Hacker News

30.8.26

 Android 17 adds ECH support to make web browsing harder to track Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular vulnerabilities, and protect the privacy of users' home networks. OS BleepingComputer

30.8.26

 Australia arrests alleged TeamPCP hackers behind supply-chain attacks Australian authorities have arrested and charged two young men accused of being part of the TeamPCP hacking group linked to a string of far-reaching developer supply chain attacks. BigBrothers BleepingComputer

30.8.26

 Microsoft rolls out fix for Windows 11 crashes, gaming issues Microsoft has started rolling out a permanent fix for a known issue that causes system crashes and gaming issues on Windows 11 devices. OS BleepingComputer

30.8.26

 Carhartt data breach exposes information of 12.9 million accounts The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retailer giant Carhartt earlier this month, according to data breach notification service Have I Been Pwned. Incindent BleepingComputer

30.8.26

 CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday CISA has ordered U.S. government agencies to patch their Citrix NetScaler appliances against an actively exploited remote code execution vulnerability by Saturday. Vulnerebility BleepingComputer

30.8.26

 ATF confirms “major incident” after recent Qilin breach claims ATF, the regulatory agency that enforces federal laws governing firearms and explosives in the United States, has confirmed that one of its systems was compromised after breach claims made by the Qilin ransomware gang. Incindent BleepingComputer

30.8.26

 Critical Avada WordPress theme flaw enables zero-click RCE A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary PHP code on the server. Exploit BleepingComputer

30.8.26

 New GPUThor attack defeats NVIDIA ECC protection for root access A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service (DoS) and root-level privilege escalation. Attack BleepingComputer

30.8.26

 Meta agrees to $18 billion settlement over teen social media harms Meta has reached a proposed settlement worth up to approximately $18 billion with a bipartisan coalition of 52 attorneys generals over allegations that Facebook and Instagram were deliberately designed to encourage compulsive use by children and teenagers. Social BleepingComputer

30.8.26

 Boston Scientific says cyberattack disrupted operations globally Medical technology company Boston Scientific has been targeted in a cyberattack that disrupted some of its IT systems, causing operational disruptions globally. Incindent BleepingComputer

30.8.26

 Hackers target Microsoft SharePoint RCE chain with PoC exploit Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused. Exploit BleepingComputer

30.8.26

 FBI disrupts proxy network enabling Chinese espionage operations The FBI has disrupted infrastructure associated with a technical "quartermaster" that provided reconnaissance, proxy management, and operational routing capabilities for Chinese cyber espionage activities. BigBrothers BleepingComputer

30.8.26

 Snowflake ends service-account passwords. Now comes the hard part Snowflake is ending password authentication for legacy service accounts, forcing organizations to migrate them to passwordless methods. Token Security explains why the harder challenge is identifying what uses each account, who owns it, and how much access it still needs. Hack BleepingComputer

29.8.26

 Ubiquiti patches three max severity security vulnerabilities Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges. Vulnerebility BleepingComputer

29.8.26

 Microsoft tests new privacy controls for Windows 11 desktop apps Microsoft has begun testing new privacy controls that will let Windows 11 users choose which desktop applications can access their camera, microphone, and precise location. OS BleepingComputer

29.8.26

 Hackers now exploit critical Gitea flaw in code injection attacks Attackers are now exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Exploit BleepingComputer

29.8.26

 LACMA data breach last year exposed social security and medical data The Los Angeles County Museum of Art (LACMA) has announced that a breach last year exposed customer and employee information. Incindent BleepingComputer

29.8.26

 Hackers abuse npm mirrors to host phishing redirect pages Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. Phishing BleepingComputer

29.8.26

 AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes A newly uncovered phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates the retrieval of codes used to unlock stolen Apple devices and disable the Activation Lock feature. Phishing BleepingComputer

29.8.26

 Massive DDoS attack disrupts Norway’s government digital services A large distributed denial-of-service (DDoS) attack has disrupted Norway's shared government digital infrastructure since Monday, affecting services used by the public sector. Attack BleepingComputer

29.8.26

 Hospital operator Nutex Health says data stolen in cyberattack Healthcare and services provider Nutex is investigating a data breach incident where an unauthorized third party exfiltrated information from company servers. Incindent BleepingComputer

29.8.26

 Microsoft PowerToys adds Alt+Tab-style switching for an app's windows Microsoft updated its Windows PowerToys toolset with a new utility dubbed "Window Hopper" that lets users switch between an app's windows more quickly. OS BleepingComputer

29.8.26

 WhatsApp adds stronger two-step verification, multiple passkeys WhatsApp has started rolling out several new account security features, including support for multiple passkeys and stronger two-step verification. Social BleepingComputer

29.8.26

 Hackers breached over 270 Zimbra servers in ongoing attacks Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability. Incindent BleepingComputer

29.8.26

 Police arrests dozens of suspects in global cybercrime crackdown Law enforcement agencies from 22 countries helped identify 263 suspects and arrested 58 individuals linked to cybercrime networks coordinated by African crime groups. BigBrothers BleepingComputer

29.8.26

 Unpatched Calix flaw lets hackers bypass NAT to expose internal devices An unpatched vulnerability in Calix GS7 XGS (GS5239XG) residential routers used by multiple U.S. broadband providers allows remote, unauthenticated attackers to create port-forwarding rules that can expose local network devices to the public internet. Vulnerebility BleepingComputer

29.8.26

 Hackers target WordPress sites in miniOrange auth bypass attacks Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators. Vulnerebility BleepingComputer

29.8.26

 Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands. The same Incindent The Hacker News

29.8.26

 Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable Cosmos Labs has warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. Cryptocurrency The Hacker News

29.8.26

 Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the Vulnerebility The Hacker News

29.8.26

ZeroTokens: Phishing Platform Gives Operators Real-Time Control of Attack Flow

ZeroTokens supports impersonation of 53 financial institution brands to collect credentials, identity data, payment details, and verification codes.

Phishing blog

ABNORMAL

29.8.26

CRPx0 ClickFix Ransomware Analysis

CRPx0 is a ClickFix-delivered ransomware-as-a-service operation whose lures impersonate Windows and macOS update prompts and reCAPTCHA checks to trick victims into running a copied command.

Ransom blog

RANSOM-ISAC

29.8.26

LLM security testing: how to pentest LLMs and MCP servers

LLM security testing for pentesters: map attacks to the OWASP LLM Top 10, break a vulnerable MCP server locally, and turn what you find into regression tests. Including solutions for enterprise scale.

AI blog

ESCAPE.TECH

29.8.26

August 2026 Security Release

The August 2026 security release is now available. Upgrade to 16.3.3 (Active LTS) or 15.5.24 (Maintenance LTS) now to address two Critical severity vulnerabilities.

Vulnerebility blog

NEXT.JS

29.8.26

Update: August Next.js Security Release

Next.js is moving the August security release forward to August 25, 2026.

Vulnerebility blog

NEXT.JS

29.8.26

The AI CVE exploitation evidence story: Headlines are scarier than reality

Expel's vulnerability intel team is currently monitoring 1,250+ CVEs related to 50 unique AI vendors; here's what we think you should know.

AI blog

Expel

29.8.26

Cymulate Launches MCP Server and Claude Plugin

Security teams have more data than ever before, but less time to act on it. Over the past several years, Cymulate has continued to evolve continuous exposure validation beyond attack simulation. We've expanded the platform to help organizations continuously validate their security controls, prioritize vulnerabilities to support continuous threat exposure management (CTEM), auto-mitigate with vendor-specific remediation and accelerate security operations with agentic AI.

AI blog

CYMULATE

29.8.26

When Monitored Content Strikes Back: Account Takeover in Microsoft Purview

Microsoft Purview is built to catch dangerous messages. But what happens when the message fights back? Cymulate Research Labs found that a single external Teams message, email or Copilot prompt could carry stored malicious code into a Purview reviewer’s authenticated browser - turning a routine compliance check into a path to token theft and account takeover.

OS Blog

CYMULATE

29.8.26

Post-Mythos Security: When Exploits Outpace the Patch Cycle

What is new is the speed at which AI can discover, test and help weaponize those vulnerabilities. Frontier cyber models such as Mythos mark a shift in attacker economics. The limiting factor is no longer only expertise. It is orchestration.

AI blog

CYMULATE

29.8.26

Cymulate Cowork: Engineering Cyber Defenses at Machine Speed

Security teams feel the squeeze of AI across threats, CVE discovery and weaponization. It’s time for AI to give cyber defenders an advantage by integrating validation into automated workflows that filter out the noise and build stronger defenses.

Cyber blog

CYMULATE

29.8.26

Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More

TrendAI™ Research tracked three campaigns that ship completely different decoy applications and unrelated payloads, all riding one shared toolkit. This analysis covers the full chain, from the pixel data that hides the first stage, through a flexible shared loader to deliver multiple payloads, revealing how adversaries are standardizing their delivery mechanisms.

APT blog

Trend Micro

29.8.26

TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure

The new threat hunting component of the TrendAI™ agentic exploit-remediation engine, code name AESIR, extends visibility beyond vulnerability disclosure. Its first published

AI blog

Trend Micro

29.8.26

Ranked First on CyberGym: TrendAI™ Agentic Exploit-Remediation Engine Scores 97% on the Top Exploit Benchmark

The TrendAI™ agentic exploit-remediation engine, code name AESIR, ranks first on CyberGym at 97% — more than 12 points ahead of both GPT-5.6 Sol and Claude Mythos 5.

AI blog

Trend Micro

29.8.26

nside 90 days of attacks on AI infrastructure

Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft.

AI blog

WIZ.IO

29.8.26

Mobile Fraud in 2026: Malware is Actively Targeting Mobile Banking Apps in LATAM

Our most recent malware threat research from Zimperium’s zLabs research team revealed 34 malware families targeting 1,243 mobile banking and fintech apps across 90 countries globally.

Malware blog

ZIMPERIUM

29.8.26

Video Call Exploit Chain Exposes Android Devices to Kernel-Level Access

In a story recently reported by Dark Reading, researchers demonstrated how two vulnerabilities in Unisoc T612 modem firmware can be chained to gain privileged access to the Android kernel. The attack involves delivering a malicious payload to the modem and placing a video call that, if answered, triggers the exploit, highlighting how cellular modems can provide a remotely reachable attack surface for mobile devices.

OS Blog

ZIMPERIUM

29.8.26

WindRelay Combines NFC Relay Malware and Remote Access for Mobile Fraud

A recent analysis reveals WindRelay, a new Android NFC relay malware deployed alongside the SpyNote remote access trojan to enable sophisticated mobile fraud. Attackers use live social engineering calls to convince victims to install a personalized RAT, then remotely deploy WindRelay without additional user interaction.

Malware blog

ZIMPERIUM

29.8.26

The AI Productivity Paradox: More Code, Not More Delivery

That's becoming increasingly important as AI coding assistants and agents accelerate development. More code can move into review, testing, security, integration, and deployment faster than those processes can absorb it, leading to more output but not necessarily more delivery.

AI blog

SONATYPE

29.8.26

A Reported Log4j RCE Is More Complicated Than It Looks

A recently circulated Log4j finding demonstrates a reproducible bypass of a defense-in-depth deserialization control involving FilteredObjectInputStream.

Vulnerebility blog

SONATYPE

29.8.26

Cambodia-focused cluster uses multistage infection chain with localized lures

Acronis’ Threat Research Unit (TRU) identified a recent campaign focused on Cambodia. The analyzed archives, discovered while hunting for related activity, use several lure themes, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers.

BigBrother blog

ACRONIS

29.8.26

Caught in 4K: The Aurora Files

The first in CloudSEK's "Caught in 4K" series, where we pull ransomware operations out of the shadows and show exactly how they work. A misconfigured server opened a window straight into an Aurora ransomware operator's playbook: attacker tools, AI-assisted planning, and a look inside the actual negotiation panel where a victims and the operator settled on payment.

Ransom blog

CloudSEK

29.8.26

Hunting Abuse: Detecting Privilege Escalation Through the ADCS Database

Active Directory Certificate Services (ADCS) has emerged as one of the most significant and under-monitored attack surfaces in enterprise Windows environments, as documented by SpecterOps. After observing certificate-based privilege escalation techniques being actively exploited in several cases that the GuidePoint

Hacking blog

GUIDESECURITY

29.8.26

Making AI/ML-driven Active Cyber Defense Work in OT Environments

You already have the data. That’s not the problem. Yet unified visibility implementations often fail before they even get off the ground. Before reaching for AI/ML-driven Active Cyber Defense to solve Operational Technology (OT) visibility and monitoring challenges, it’s critical to pause and make sure you’re not repeating the mistakes of the past.

AI blog

GUIDESECURITY

29.8.26

How Play Achieves Encryption

TL;DR – Play (aka PlayCrypt) is a successful threat actor that employs double extortion techniques against its victims in North and South America and Europe. Understand what it does and why its techniques have been successful thus far.

Cyber blog

GUIDESECURITY

29.8.26

PaperCut NG/MF Critical Zero-Day Exploited in the Wild

On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency.

Vulnerebility blog

RAPID7

29.8.26

Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

Despite modern verification controls, identity theft remains one of the most pervasive threats to both individuals and enterprise organizations. U.S. Federal Trade Commission statistics show over 1 million identity theft reports annually, with related fraud and imposter scams accounting for billions in financial losses each year.

CyberCrime blog

RAPID7

29.8.26

Mapping the AI Attack Surface Before You Touch It

In part 1 of this series, on discovering and mapping Copilot Studio agents in the wild, we took a close look at how active discovery and capability mapping for agents could play out.

AI blog

LABS ZENITY

29.8.26

It's Always DNS in Claude’s Sandbox: From Data Exfiltration to a Bidirectional DNS Shell

In this blog, we’ll showcase how we were able to exploit a DNS functionality in Claude’s sandbox to create both a data exfiltration channel, and bidirectional shell. This whole attack chain rests on the overlooked DNS channel: although HTTP and HTTPS traffic are correctly blocked by egress filters, DNS resolution happens before those filters can intervene.

AI blog

LABS ZENITY

29.8.26

Indirect prompt injection: How attackers manipulate AI agents through untrusted data

An employee asks an AI agent to analyze a document. Hidden inside that content is an instruction written for the agent rather than the user.

AI blog

THREATLOCKER

29.8.26

How Nokian Tyres found a cybersecurity partner it could trust

Learn how Nokian Tyres improved email security, gained threat visibility and built a trusted cybersecurity partnership with Barracuda.

Cyber blog

BARRACUDA

29.8.26

SOC Threat Radar — August 2026

Barracuda Research highlights recent SOC findings on GlobalProtect scanning, credential harvesting, firewall misconfigurations, and abuse of trusted remote access software.

Cyber blog

BARRACUDA

29.8.26

Leak sites: a field guide

Ransomware leak sites have become a prominent feature of modern cyber extortion campaigns, publishing claims about breached organizations and stolen data. This article explains how leak sites work and how to use them to assess risk, monitor threat activity and make better-informed security decisions.

Ransom blog

BARRACUDA

29.8.26

TeamPCP Arrests: Two Charged in Australia Over the Supply Chain Campaign That Hit 1,000+ Organizations

On 26 August 2026, the Australian Federal Police charged two West Australian men over their alleged roles in a cybercrime syndicate that inserted malicious code into open-source software used by thousands of organizations worldwide. Both men appeared in Perth Magistrates Court the following day.

CyberCrime blog

SOCRADAR

29.8.26

OpenAI Urges Cyber Defense Against AI Threats

OpenAI is calling for a global surge in cyber defense as AI-enabled attacks become more widespread and sophisticated. The call to action raises a practical question for defenders: if attackers gain more capable AI, how can organizations, governments, security providers, and frontier AI companies make sure defensive tools, verified fixes, and threat intelligence reach the teams that need them most?

AI blog

SOCRADAR

29.8.26

WhatsApp Says One Billion Users Are Now Protected by Passkeys

The milestone signals that phishing-resistant authentication has moved into the consumer mainstream, while new controls target registration code theft and scam calls.

Social blog

SOCRADAR

29.8.26

The GTA VI Leak by CyberLeek Explained

GTA VI has been slipping out from behind Rockstar’s usually airtight walls in daily doses. An anonymous figure calling itself CyberLeek has been releasing gameplay clips, map images, and increasingly bold demands, turning what should have been a tightly controlled marketing rollout into one of the messiest leak sagas gaming has seen in years.

Incident blog

SOCRADAR

29.8.26

Critical Avada WordPress Flaw (CVE-2026-18431) Enables RCE

A critical vulnerability chain tracked as CVE-2026-18431 affects the Avada WordPress theme and its required Fusion Builder plugin, now branded as Avada Builder. The flaw carries a CVSS score of 9.8 and can allow an unauthenticated attacker to write and execute arbitrary PHP files, potentially leading to complete site compromise.

Vulnerebility blog

SOCRADAR

29.8.26

Qilin Claims ATF Breach as Agency Confirms “Major Incident”

The Qilin Ransomware group listed the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) on its Dark Web leak site on August 26, 2026, the same day the agency publicly confirmed a cybersecurity “major incident” affecting a standalone system.

Incident blog

SOCRADAR

29.8.26

TeamPCP Arrests: Two Charged in Australia Over the Supply Chain Campaign That Hit 1,000+ Organizations

On 26 August 2026, the Australian Federal Police charged two West Australian men over their alleged roles in a cybercrime syndicate that inserted malicious code into open-source software used by thousands of organizations worldwide. Both men appeared in Perth Magistrates Court the following day.

CyberCrime blog

SOCRADAR

29.8.26

Imobiliare.ro, Klark.ai, Fortinet VPN, E-Commerce Skimming, and Solimut SQLi

SOCRadar Dark Web Team identified several new underground posts involving alleged database leaks, exposed remote access, and access-for-sale activity. The findings include an alleged Imobiliare.ro user database sale, administrative Fortinet SSL-VPN access tied to a UAE hotel reservation firm, an alleged Klark.ai data leak, a U.S. e-commerce iframe skimming operation, and alleged SQL injection access affecting Solimut Mutuelle de France.

CyberCrime blog

SOCRADAR

29.8.26

Cisco Crosswork, Secure Workload CVEs Patched

Cisco released security updates for Cisco Crosswork and Cisco Secure Workload, addressing nine vulnerabilities across the two product families.

Vulnerebility blog

SOCRADAR

29.8.26

CVE-2026-19478: GitLab GraphQL Flaw Exploited

GitLab has patched CVE-2026-19478, a critical code injection vulnerability affecting self-managed Community Edition (CE) and Enterprise Edition (EE) instances. Under certain conditions, an unauthenticated remote attacker could leverage a GraphQL directive to modify or delete public projects and user data.

Vulnerebility blog

SOCRADAR

29.8.26

CVE-2026-69836: Microsoft Entra ID RCE Fixed

Microsoft recently disclosed CVE-2026-69836, a critical Remote Code Execution (RCE) vulnerability in Microsoft Entra ID (formerly Azure Active Directory). Because this issue affected a Microsoft-hosted cloud service, remediation was applied on the backend rather than through a traditional customer patch.

Vulnerebility blog

SOCRADAR

29.8.26

ShinyHunters Claims ReliaQuest Breach

A ShinyHunters-associated leak site listed ReliaQuest on August 23, 2026, raising questions about a potential data extortion attempt against the cybersecurity provider.

CyberCrime blog

SOCRADAR

29.8.26

Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain

The SOCRadar Threat Research Unit (STRU) has conducted an “inside-out” analysis of AnonyMousKIT, an AI-powered Phishing-as-a-Service (PhaaS) ecosystem specifically engineered to disable Apple’s Activation Lock on stolen devices. 

Phishing blog

SOCRADAR

29.8.26

How to build an exposure management program the business trusts: Lessons from Tenable’s CSO

Discover how Tenable’s shift to an AI-driven exposure management program helped Tenable’s CSO, Robert Huber, overcome tool sprawl, unify data silos, mitigate the risk of rapid AI adoption, and shift from presenting granular, technical metrics to communicating business risk that the C-suite and the board can understand.

AI blog

TENABLE

29.8.26

Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter

A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication.

CyberCrime blog

TENABLE

29.8.26

Chinese Implants in the Supply Chain

The implant beacons hit the sinkhole as soon as we stood it up. Hundreds of routers, almost all in China, beaconing home to a forgotten domain. We found the domain obfuscated in the firmware of a router we bought on Amazon from a small company in New York. Now, we own the domain. We own the implants.

APT blog

VULNCHECK

29.8.26

What CISA's FY2024-2025 Vulnerability Review Means for Runtime Security

CISA's new Vulnerability Review for Fiscal Years 2024 and 2025 opens by correcting a widely held assumption. Cybersecurity conversations naturally gravitate toward nation-state adversaries and novel zero-days, but most compromises have not relied on advanced techniques.

Vulnerebility blog

OLIGO

29.8.26

What the ERMAC Source Leak Says About HookBot

ERMAC and HookBot are two branches of one Android banking trojan sold as a service. They forked from a shared code base and each evolved in the direction its developers took it, but the core they run is close enough that a single constant in the source decides which name the panel shows.

BotNet blog

CENSYS

29.8.26

Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption

A misconfigured open directory on 86.53.111[.]212:8080 exposed critical details of active cybercrime operator, including Moobot botnet source code, other denial of service (DOS) tools with attack records, and a fraudulent identity verification service – providing a rare view of a malicious operation in progress.

BotNet blog

CENSYS

29.8.26

Unmasking TeamPCP, King of Software Supply Chain Attacks

For five days in March 2026, a single stolen token let one group poison five software ecosystems including a package downloaded 95 million times a month. The attack started with a misconfigured GitHub Actions workflow, and ended with backdoored code sitting inside CI/CD pipelines around the world.

Hacking blog

FLARE.IO
29.8.26 July 2026 Threat Trend Report on APT Attacks (South Korea) Overview AhnLab monitored APT (Advanced Persistent Threat) attacks targeting entities in Korea using its own infrastructure. This report summarizes the classification, statistics, and functional characteristics for each type of domestic APT attacks identified during the month of July 2026. APT blog Zscaler
29.8.26 Gryxa: The AI-Built Toolkit That Watches How You Remove It ReliaQuest has identified a new toolkit, dubbed “Gryxa,” used by a financially motivated threat actor across 324 listed hosts. We assess that substantial portions were almost certainly built with a commercial AI coding agent, which appears as co-author on most commits in the actor's public repository. This marks the first time ReliaQuest has observed a threat actor use AI to help build and execute an entire operation to this extent. Malware blog RELIAQUEST
29.8.26 Insights into Suspected DPRK Workers: Red Flags to Look Out For North Korean (DPRK) remote IT workers (sometimes referred to as FAMOUS CHOMILLA) continue to pose a prolific threat to global organisations. DPRK-aligned operatives use fake or stolen identities to get hired at companies before sending their wages back to North Korea's regime, stealing data, or planting malware. APT blog Huntress
29.8.26 The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms As more people use AI models such as Claude, ChatGPT, Grok, and Gemini, threat actors are abusing trusted AI platforms in a variety of ways to trick users into downloading malware. AI blog Huntress
29.8.26 BlueDelta Targets Defense and Diplomacy with HOOKEDGE Insikt Group has identified a series of BlueDelta initial access campaigns conducted between late September 2025 and early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye. APT blog Recorded Futures
29.8.26 Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 30 days of past cases. Analysts now clear most alerts with a single click in Slack. AI blog ELASTIC
29.8.26 Not another Log4Shell: inside the Log4j 2 deserialization allowlist bypass We reproduced this java deserialization vulnerability against official Log4j 2.26.1 JARs. Getting to command execution took two more things that Log4j itself does not ship. Here is how the bypass works, which versions carry it, and what to hunt for. Vulnerebility blog ELASTIC
29.8.26 Carry-On Compromise: TA4922 Packs PackClient Proofpoint researchers recently discovered a RAT framework we named PackClient. PackClient is being used by at least one threat actor, Chinese-speaking TA4922, and appears to be actively sold on Telegram. PackClient is a full featured, modular command and control (C2) framework that supports data theft, surveillance, and downloading of additional plugins and payloads. APT blog PROOFPOINT
29.8.26 TA488 Targets Zimbra Mailservers with Half-Click Exploits Proofpoint uncovered that Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) was exploiting a previously unknown vulnerability against Zimbra mailservers for at least five months during 2025, until the issue was patched with CVE-2025-66376. APT blog PROOFPOINT
29.8.26 Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458 The Russia-aligned threat actor TA458, the group behind Operation RoundPress, continues to focus on webmail targeting using half-click exploits as a way to steal highly sensitive email data. APT blog PROOFPOINT
29.8.26 From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO Learn how cyber risk quantification helps CFOs measure financial exposure, assess business impact, and prioritize security investments. Cyber blog Cyble
29.8.26 9Router Tailscale Install Endpoint Unauthenticated OS Command Injection SonicWall Capture Labs threat research team became aware of the threat CVE-2026-59800, assessed its impact, and developed mitigation measures. The flaw, also known as the 9Router Tailscale Install Endpoint Unauthenticated OS Command Injection, is a critical vulnerability affecting the 9Router AI request proxy (decolua/ Hacking blog SonicWall
29.8.26 Efimer Brings Its Own Tools to the Job This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of Efimer malware. This is a Python-based executable compiled with PyInstaller and protected with PyArmor to obfuscate the many libraries and payloads that are packed within. Malware blog SonicWall
29.8.26 The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution To assess the impact of AI-enabled malware, we collected and analyzed over 400 malware samples that integrate AI in some capacity, from brand impersonation and large language model (LLM)-generated code to agentic execution loops. Our central finding was that the AI malware space is currently overwhelmingly composed of proof-of-concept code, security validation testing and researcher submissions that have never reached a production environment. AI blog Palo Alto
29.8.26 The safety penalty: Reclaiming operational sovereignty in the age of AI As frontier AI models become increasingly restrictive, security teams are facing a "safety penalty" that hampers real-time incident response. Discover how organizations can move toward operational sovereignty to ensure their defensive AI keeps pace with unconstrained adversaries. AI blog CISCO TALOS
29.8.26 “Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend In his first Threat Source newsletter, David Bianco explores the critical need for operational sovereignty in customizing AI guardrails to maintain the defender’s advantage. Hacking blog CISCO TALOS
29.8.26 JavaScript obfuscation: From party trick to phishing kit Learn the basics of what obfuscation is, why a researcher would try to reverse it, and several ways to approach the problem. Phishing blog CISCO TALOS
29.8.26 Choose your fighter: Balancing competing requirements to select models for your AI SOC Selecting a model for your security operations center (SOC) and digital forensics and incident response (DFIR) tasks is important, but selecting the best one is more involved than you might think. Here's how to choose. AI blog CISCO TALOS
29.8.26 AI-driven OSINT in the wrong hands – and why everyone could be a target for fraud It’s getting cheaper and easier for cybercriminals to research potential victims. Here’s what’s still in your control. AI blog Eset
29.8.26 No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations This blog will walk through the complete kill chain: an attacker enumerates domain-wide SPNs, identifies a vulnerable user account, and silently requests a Kerberos Ticket Granting Service (TGS) ticket encrypted with the weak RC4-HMAC algorithm. Hacking blog TRELLIX
28.8.26 HookEdge backdoor distributed by the BlueDelta threat group Latest report from the Insikt Group researchers discusses recent malicious campaigns conducted by threat group BlueDelta (aka Forest Blizzard, or Fancy Bear) that have been targeting government, diplomatic, and defense manufacturing bodies in Romania, Spain, and Turkey. ALERTS APT
28.8.26 Unauthenticated RCE vulnerability in Apache Log4j2 (Issue 4255) A newly disclosed vulnerability in Apache Log4j's FilteredObjectInputStream component enables unauthenticated remote code execution against services that receive serialized log events over a network connection. The unpatched flaw affects log4j-core 2.8.0 through 2.26.1 and log4j-api 2.11.0 through 2.26.1, and is limited to applications using Log4j's serialized log-event network receivers rather than to all Log4j deployments. ALERTS VULNEREBILITY
28.8.26 WeedHack Malware via SEO Poisoning McAfee Labs has published a report on a campaign distributing WeedHack, a Malware-as-a-Service infostealer and remote access tool targeting Minecraft players. The attackers use SEO poisoning and YouTube videos to push malicious clone sites above official repositories on search engines, tricking gamers searching for popular clients and modifications like Xenon or Radium. ALERTS VIRUS
28.8.26 GoCaracal and Bandook Malware Target Communications Sector Arctic Wolf has published a report on a new modular malware framework called GoCaracal, deployed by the cyberespionage group Dark Caracal. The threat actors have been observed targeting the communications sector in Venezuela and other parts of Latin America. The attack begins with financial-themed phishing emails containing weaponized SVG attachments, which initiate a sequence to download a lightweight GoCaracal executable to establish initial system access. ALERTS VIRUS
28.8.26 TwoStroke backdoor distributed by the Tortoiseshell threat group Group-IB’s threat research into the IRGC-affiliated Iranian actor Tortoiseshell (aka Mirage Kitten, Nimbus Manticore) indicates broadened cyber campaigns extending across Europe and the Middle East. Tortoiseshell typically breaches defense, aerospace, military, and technology organizations using watering-hole attacks, supply-chain exploits, and fraudulent recruitment portals. ALERTS VIRUS
28.8.26 SparkRAT malware targets Cambodia in a recent campaign Acronis’ researchers reported on a recent cyber campaign targeting entities across Cambodia using varied decoy materials, such as official state advisories, medical records or commercial promotions. The attack sequence initiates through an Inno Setup installer that triggers a legitimate Tencent binary, and performs DLL side-loading. The malicious loader subsequently retrieves and decrypts hidden shellcode embedded within PNG images. ALERTS VIRUS
28.8.26 CVE-2026-18885 (CVSS score: 10.0) - A code injection vulnerability in the GraphQL Composite Data API that could enable an unauthenticated user to execute arbitrary code and gain access to, or modify, instance data VULNEREBILITY VULNEREBILITY
28.8.26 CVE-2026-18886 (CVSS score: 10.0) - An improper access control vulnerability in the system configuration image upload processor that could enable an unauthenticated user to create or modify instance data, resulting in privilege escalation VULNEREBILITY VULNEREBILITY
28.8.26 CVE-2026-74820 (CVSS score: 10.0) - A SQL injection vulnerability reached through a dynamic schema ORDER BY clause that could enable an unauthenticated user to execute arbitrary SQL statements against the instance's underlying database VULNEREBILITY VULNEREBILITY
28.8.26 CVE-2026-6876 ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended. VULNEREBILITY VULNEREBILITY
28.8.26 Zbtlink MQWrt infosrvd Command Injection Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, VULNEREBILITY VULNEREBILITY
28.8.26 Zbtlink MQWrt yunmgrd Cloud C2 Implant Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, VULNEREBILITY VULNEREBILITY
28.8.26 CVE-2023-49105 ownCloud Improper Authentication Vulnerability KEV KEV
28.8.26 CVE-2026-53362 Linux Kernel Unspecified Vulnerability KEV KEV
28.8.26 CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability KEV KEV
28.8.26 CVE-2026-65643 Security: CVE-2026-65643 Vulnerability in cPanel’s Domain Parking Functionality - August 27, 2026 VULNEREBILITY VULNEREBILITY
28.8.26 BlueDelta Targets Defense and
Diplomacy with HOOKEDGE		 Insikt Group identified Russian statesponsored group BlueDelta (APT28) targeting government, diplomatic, anddefense organizations in Romania, Spain, and Türkiye between September 2025 and April 2026 REPORT REPORT
28.8.26 BlueDelta BlueDelta Targets Defense and Diplomacy with HOOKEDGE GROUP GROUP
28.8.26 CISA Vulnerability Review Fiscal Years 2024 and 2025 Cybersecurity conversations often focus on high-profile incidents involving nation-state adversaries, ransomware groups, and other sophisticated threat actors. However, most compromises have not relied on advanced techniques. They exploited simple, known software vulnerabilities that remain widespread and persistent in publicly exposed assets. Increasingly, cyber threat actors are using artificial intelligence (AI) to automate all the steps necessary to exploit these vulnerabilities. REPORT REPORT
28.8.26 CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability: JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. ECV ECV
28.8.26 CVE-2026-53362 Linux Kernel Unspecified Vulnerability: Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. ECV ECV
28.8.26 CVE-2023-49105 ownCloud Improper Authentication Vulnerability: ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. ECV ECV
28.8.26 CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability: Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. ECV ECV
28.8.26 CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability: Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. ECV ECV
28.8.26 CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability: Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system. ECV ECV
28.8.26 CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability: Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. ECV ECV
28.8.26 CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability: Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. ECV ECV
28.8.26 CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability: Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. ECV ECV
28.8.26 CVE-2026-60004 Gitea Code Injection Vulnerability: Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. ECV ECV
28.8.26 CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. ECV ECV
28.8.26 Threat landscape for  industrial automation  systems. Q2 2026 In this section, we examine the most significant changes to indicators over the quarter, broken down by region and industry. Further diagrams can be found in the relevant chapters of the “Statistics across all threats” section. REPORT REPORT
28.8.26 CVE-2026-35603 CVE-2026-35603: One Writable Folder, Every User Compromised: Exploiting Configuration Trust in AI Coding Tools VULNEREBILITY VULNEREBILITY
28.8.26 CVE-2026-75604 Unauthenticated Remote Code Execution on windows-hosted servers VULNEREBILITY VULNEREBILITY
28.8.26 Drive-By Agent Hijacking Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning HACKING AI
28.8.26 Power Leak Power Leak: Amazon Kiro IDE Prompt Injection Enables Data Exfiltration HACKING AI
28.8.26 Spark RAT Cambodia-focused cluster uses multistage infection chain with localized lures MALWARE RAT
28.8.26 Dark Caracal During a targeted intrusion investigation, Arctic Wolf uncovered GoCaracal, a previously undocumented, modular framework written in Go. Its long-term development offers new insight into the evolution of Dark Caracal’s capabilities, operations, and tradecraft. MALWARE GO
27.8.26 GPUThor: Amplifying  Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs GDDR memory in GPUs is vulnerable to Rowhammer attacks, where rapid memory accesses induce bit flips in adjacent cells,enabling data tampering and privilege escalation. However, prior GPU Rowhammer attacks trigger only tens to hundreds of bit flips,orders of magnitude fewer than CPU attacks, severely limiting their practical impact. This gap stems from the reliance of existingGPU Rowhammer attacks on uniform hammering patterns that activate aggressor and dummy rows equally, which results in low hammering intensity for aggressor rows. PAPERS PAPERS
27.8.26 CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability KEV KEV
27.8.26 CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability KEV KEV
27.8.26 CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability KEV KEV
27.8.26 CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability KEV KEV
27.8.26 CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability KEV KEV
27.8.26 CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV KEV
27.8.26 USPS Smishing Kit The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data PHISHING KIT
27.8.26 Tortoiseshell Tortoiseshell: New Toolset and Operational Infrastructure Exposed OPERATION OPERATION
27.8.26 China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems The Federal Bureau of Investigation, National Security Agency, and Cyber National Mission Force are releasing this joint cybersecurity advisory to alert organizations concerning China-linked cyber threat actors, who use the acronyms QTFY, QT, and QTCYBER for themselves and their tools and have developed malicious distributed platforms to compromise the networks of US and foreign organizations. REPORT REPORT
27.8.26 DOUBLOON DREDGER DOUBLOON DREDGER token harvesting: Notion abuse, EvilTokens, and a side of Tycoon2FA PHISHING KIT
27.8.26 Matrix Introducing Matrix: A Microsoft 365 AiTM Platform Overlapping the Sneaky2FA Lineage PHISHING KIT
27.8.26 iAuthFlow v2 iAuthFlow v2 Enrolls Google Passkeys That Survive Password Resets PHISHING KIT
27.8.26 ARToken ARToken: The Device Code Phishing Platform Built for Full Microsoft 365 Takeover PHISHING KIT
27.8.26 LinXcoded (Mirage2FA) LinXcoded (Mirage2FA): Microsoft 365 Phishing Platform Uses HTML Attachments to Steal Post-MFA Sessions PHISHING KIT
27.8.26 Blacksite Blacksite: New AiTM Phishing Kit Evades URL Scanners via Cloaked.gg PHISHING KIT
27.8.26 ZeroTokens ZeroTokens: Phishing Platform Gives Operators Real-Time Control of Attack Flow PHISHING KIT
27.8.26 Meet Bluekit Meet Bluekit: The AI-Powered All-in-One Phishing Kit PHISHING KIT
27.8.26 NovaCookies NovaCookies at scale: Inside the $320 Phishing Service Targeting Hundreds of Organizations PHISHING KIT
26.8.26 Vercel-hosted RMM attacks As ANY.RUN analysis shows, a campaign that initially appears to target Canadians with fake Canada Revenue Agency (CRA) T4 tax documents is actually part of a much broader remote-access campaign spanning 46 countries, with 45% of observed activity associated with the United States. CAMPAIGN CAMPAIGN
26.8.26 Balonx Sistema Group-IB exposes a Mexican PhaaS operation targeting over 20 financial institutions with live phishing, AI vishing, and mobile RAT capabilities. PHISHING PHaaS
26.8.26 A Tale of Two SOCs: Insights From Two Red Team
Assessments		 The Cybersecurity and Infrastructure Security Agency’s (CISA’s) red team simulates real‑world maliciouscyber operations to assess an organization’s ability to detect, investigate, and respond to malicious cyberactivity. Emulating cyber threat actor tradecraft, the red team attempts to gain and maintain persistentaccess to an organization’s network and sensitive business systems (SBSs) while avoiding detection. REPORT REPORT
26.8.26 SynkLoader Distributed via Teams Researchers at Expel recently reported a new malware family dubbed SynkLoader, which utilizes a modular architecture bridging multiple programming languages to evade detection. Threat actors initiate the compromise via Microsoft Teams phishing, masquerading as internal IT personnel to persuade victims to download a malicious MSI installer hosted on an Azure endpoint. ALERTS VIRUS
26.8.26 PavinLoader Emerges as Loader-as-a-Service Delivering Information Stealers A new campaign documented by Malwarebytes details the widespread deployment of PavinLoader across ClickFix social engineering lures, trojanized game releases, and fake software downloads. Operating as a potential Loader-as-a-Service, PavinLoader uses initial vector lures such as fake CAPTCHA prompts or Dropbox-hosted installers to execute malicious scripts or batch files on victim systems. ALERTS VIRUS
26.8.26 RedC2 AI-Powered Linux Implant TrendAI identified a supply-chain campaign where deceptive npm packages masquerade as legitimate date and calendar utilities. Simply importing one of these compromised dependencies triggers an embedded Linux ELF binary to execute as an independent background process. The embedded payload, known as RedShell, functions as a Linux beacon for the commercial RedC2 4.0 command-and-control framework. ALERTS AI
26.8.26 Vidar infostealer distributed under the disguise of a Gemini installer Darktrace recently analyzed an incident where users seeking a desktop version of Google Gemini installer could inadvertently download the Vidar infostealer variant instead. The attack leveraged search-driven discovery, leading the user to a Google Colab notebook that served a fraudulent executable. Once launched, this Go-based variant of Vidar would begin harvesting sensitive data from the compromised endpoint and attempt outbound communication with Telegram-based command-and-control infrastructure controlled by the attackers. ALERTS VIRUS
26.8.26 Kynx Stealer A new malware family documented by SOCRadar reveals the growing intersection of artificial intelligence and credential theft. Dubbed Kynx, this C++-based Malware-as-a-Service is believed to be distributed through cracked software or fake update lures, displaying a deceptive system update progress bar upon initial execution. ALERTS VIRUS
26.8.26 Manic Android Threat Observed in Ukraine ThreatFabric has recently identified a new Android malware family dubbed Manic that functions as a hybrid banking trojan and surveillance tool. The malware primarily targets financial institutions, government identity services, and messaging applications in Ukraine, with secondary victims across Europe and Russia. ALERTS VIRUS
26.8.26 ToxicPanda 2.0 Refines Overlay Attacks and Abuse of Accessibility Services Researchers at Zimperium recently reported on ToxicPanda 2.0, an upgraded version of the Android banking Trojan with a significantly expanded global operational footprint. The threat targets over 340 banking, cryptocurrency, and e-wallet applications across 16 countries, abusing Android Accessibility Services to automate malicious actions and steal sensitive credentials. ALERTS VIRUS
26.8.26 RubyGems Supply Chain Attack Deploys Stealer A campaign documented by OpenSourceMalware exposes a RubyGems supply chain attack dubbed StubMaker, targeting Windows developer environments. The actor published typosquats of high-traffic dependencies, weaponizing extconf.rb to execute code at install time while writing fake compiler stubs so the native extension phase reports a clean build. ALERTS HACKING
26.8.26 Core Werewolf Deploys Custom CoreRAT Malware According to BI.ZONE, a previously undocumented RAT dubbed CoreRAT is being deployed by the Core Werewolf espionage actor against Russia's public sector and defense industry, observed June–July 2026 and traced back to at least March 2026. Initial access comes via phishing messages on Telegram delivering 7zSFX or Rust droppers named after military and government paperwork. ALERTS VIRUS
26.8.26 Disrupting a new covert influence campaign from Russia Our mission is to ensure that artificial general intelligence benefits all of humanity. We advance this mission by deploying our innovations to build AI tools that help people solve hard problems. This includes building tools that enable us to detect, investigate, disrupt and expose covert influence operations (IO): deceptive attempts to manipulate public opinion or influence political outcomes without revealing the true identity or intentions of the actors behind them. CAMPAIGN CAMPAIGN
26.8.26 CVE-2026-19912 Unauthenticated RCE via PHP object injection + path traversal VULNEREBILITY VULNEREBILITY
26.8.26 CVE-2026-19913 Unauthenticated arbitrary file read. VULNEREBILITY VULNEREBILITY
26.8.26 Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident A companion technical writeup to our incident disclosure. This post walks through how the intrusion actually worked: the two initial-access vectors, how the agent pivoted and moved laterally, representative examples of the commands that were run and how we investigated with GLM 5.2 (an open-source model). Live credentials, internal hostnames, and specific indicators have been redacted or genericized, while the techniques are described exactly as observed by Hugging Face. INCIDENT INCIDENT
26.8.26 Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers The Kaltura HTML5 Player Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable mwEmbedLoader.php endpoint. Until a vendor patch is available, users are advised to restrict access to the affected endpoint or disable it entirely. ALERT ALERT
26.8.26 CVE-2026-60004 Gitea Code Injection Vulnerability KEV KEV
26.8.26 CVE-2026-60004 Gitea Code Injection Vulnerability VULNEREBILITY VULNEREBILITY
26.8.26 p1bot Inside p1bot: A Vishing Platform Weaponizing ElevenLabs PHISHING VISHING
26.8.26 AnonyMousKIT Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain PHISHING PHaaS
26.8.26 SLEEPWALKER SLEEPWALKER: A Passive Backdoor With Its Own Command Language MALWARE BACKDOOR
25.8.26 Early Cascade Injection: From Windows Process Creation to Stealthy Injection In this blog post we introduce a novel process injection technique named Early Cascade Injection, explore Windows process creation, and identify how several Endpoint Detection and Response systems (EDRs) initialize their in-process detection capabilities. HACKING WINDOWS
25.8.26 CVE-2026-75149 marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. VULNEREBILITY VULNEREBILITY
25.8.26 EarlyBird Technique: An Advanced Malware Evasion Strategy As of recent advancements, malware authors are leveraging artificial intelligence (AI) and machine learning (ML) to dynamically alter their evasion techniques. This means that malware can now adapt in real-time to changes in security environments, such as modifications in antivirus software or intrusion detection systems, making traditional static signature-based defences increasingly ineffective. HACKING MALWARE
25.8.26 CVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation vulnerability stemming from signature algorithm confusion (Fixed in version 17.0.5 for the Standard edition) VULNEREBILITY VULNEREBILITY
25.8.26 CVE-2026-15981 (CVSS score: 9.8) - An authentication bypass vulnerability stemming from accepting malformed signatures as valid (Fixed in version 17.0.6 for the Standard edition) VULNEREBILITY VULNEREBILITY
25.8.26 CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability KEV KEV
25.8.26 CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability VULNEREBILITY VULNEREBILITY
24.8.26 Konami's Metal Gear Online 3 contains a heap-based buffer overflow Konami's Metal Gear Online 3 video game contains a heap-based buffer overflow that can be triggered by an input‑validation vulnerability that allows match hosts to remotely execute arbitrary code on lobby members' machines through specially crafted data. ALERT ALERT
24.8.26 CVE-2026-13757 A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. VULNEREBILITY VULNEREBILITY
24.8.26 CVE-2026-17048 A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. VULNEREBILITY VULNEREBILITY
24.8.26 CVE-2026-15571 A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. VULNEREBILITY VULNEREBILITY
24.8.26 Enterprise AI Usage Risk Report 2026 When the State of the Internet/Security report first analyzed the emerging artificial intelligence (AI) landscape in early 2025, enterprise adoption was largely characterized by caution and curiosity; today, it is a structural mandate. What began as sporadic experimentations with ChatGPT has evolved into a sprawling ecosystem of AI assistants, AI browsers, AI agents, AI extensions, and autonomous workflows that touch every aspect of enterprise work. REPORT REPORT
24.8.26 CVE-2026-14613 A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. VULNEREBILITY VULNEREBILITY
24.8.26 CVE-2026-9796 A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. VULNEREBILITY VULNEREBILITY
24.8.26 CVE-2026-18963 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. VULNEREBILITY VULNEREBILITY
24.8.26  WordlistLoader  WordlistLoader Delivering Amatera via ClearFake Campaigns MALWARE LOADER
24.8.26 ClearFake ClearFake gets more evasive with new living off the land (LOTL) techniques CAMPAIGN CAMPAIGN
24.8.26 Amatera Stealer 4.0.2 Amatera Stealer 4.0.2 Beta: What's New in This Variant MALWARE STEALER
24.8.26 Heaven's Gate Heaven’s Gate is a malware technique that hides dangerous 64-bit code inside seemingly harmless 32-bit processes. This clever trick makes it much harder for security tools to catch malware in action, giving attackers a major advantage in the cyber cat-and-mouse game HACKING MALWARE
24.8.26 UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities GROUP GROUP
24.8.26 UAT-10147 Chinese-speaking adversary integrates agentic AI into post-compromise operations GROUP GROUP
23.8.26 CVE-2025-55241 Azure Entra ID Elevation of Privilege Vulnerability VULNEREBILITY VULNEREBILITY

23.8.26

 CVE-2026-65770 Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network. VULNEREBILITY VULNEREBILITY
23.8.26 CVE-2026-65801 Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network. VULNEREBILITY VULNEREBILITY

23.8.26

 CVE-2026-69555 Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. VULNEREBILITY VULNEREBILITY
23.8.26 SynkLoader SynkLoader: when you throw in everything but the kitchen sink MALWARE LOADER

23.8.26

 CVE-2026-65816 Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network. VULNEREBILITY VULNEREBILITY
23.8.26 SmartApeSG ClickFix campaign leads to two RATs Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC
28.8.26 Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), Vulnerebility The Hacker News
28.8.26 PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF Exploit The Hacker News
28.8.26 APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye APT The Hacker News
28.8.26 SOUPS 2026 Twenty-Second Symposium on Usable Privacy and Security (SOUPS 2026) CONFERENCE BLOG SOUPS
28.8.26 Threat landscape for industrial automation systems. Q2 2026 The report contains statistics on industrial threats for Q2 2026, including ransomware, miners, spyware and other threats that were detected and blocked on industrial control systems. ICS SECURELIST
28.8.26 OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face OpenAI on Wednesday revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last AI The Hacker News
28.8.26 Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE Credit: Hacktron Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow Vulnerebility The Hacker News
28.8.26 Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers. Hack The Hacker News
28.8.26 Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks The Australian Federal Police (AFP) has charged two Western Australian men with a combined total of 14 offences over their alleged role in Hack The Hacker News
28.8.26 Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT . "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. Virus The Hacker News
28.8.26 GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware Virus The Hacker News
27.8.26 ASIC Sounded the Alarm. Mobile is Where the Attack Starts. On May 8, Commissioner Simone Constant of the Australian Security Investments Commission (ASIC) sent an open letter directly to every bank, superannuation fund, insurer, and financial services licensee in Australia. Not a report. Not a consultation. A direct instruction to boards and risk committees demanding urgent action on AI and cyber risk. Here's the full threat picture every CISO needs to add to that conversation. Security blog ZIMPERIUM
27.8.26 Mobile Banking Fraud 2026: Malware is Actively Targeting Mobile Banking Apps in Europe, Middle East & Africa Our most recent malware threat research from Zimperium’s zLabs research team revealed 34 malware families targeting 1,243 mobile banking and fintech apps across 90 countries globally. Malware blog ZIMPERIUM
27.8.26 TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure The new threat hunting component of the TrendAI™ agentic exploit-remediation engine, code name AESIR, extends visibility beyond vulnerability disclosure. Its first published investigation links over a year of honeypot data to the LF3 loader framework. Exploit blog Trend Micro
27.8.26 Mapping AI detections to MITRE ATLAS: How Expel does it AI-related detections in Expel Workbench™ carry MITRE ATLAS tactic and technique labels alongside the ATT&CK labels our analysts already use. AI blog Expel
27.8.26 Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident Chinese cybercrime group, GoldenEyeDog, has been regularly updating their malware and tactics since 2015. We’ve observed them regularly leveraging code-signing certificates to bypass Windows’s SmartScreen since 2024. APT blog Expel
27.8.26 Inside China-nexus cyber espionage infrastructure Black Lotus Labs and the FBI uncovered China-nexus infrastructure used to hide cyber espionage, showing how early detection helps protect customers. APT blog LUMEN
27.8.26 LLM security testing: how to pentest LLMs and MCP servers LLM security testing for pentesters: map attacks to the OWASP LLM Top 10, break a vulnerable MCP server locally, and turn what you find into regression tests. Including solutions for enterprise scale. AI blog ESCAPE.TECH
27.8.26 Cambodia-focused cluster uses multistage infection chain with localized lures Acronis’ Threat Research Unit (TRU) identified a recent campaign focused on Cambodia. The analyzed archives, discovered while hunting for related activity, use several lure themes, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers. Hacking blog ACRONIS
27.8.26 Making AI/ML-driven Active Cyber Defense Work in OT Environments You already have the data. That’s not the problem. Yet unified visibility implementations often fail before they even get off the ground. Before reaching for AI/ML-driven Active Cyber Defense to solve Operational Technology (OT) visibility and monitoring challenges, it’s critical to pause and make sure you’re not repeating the mistakes of the past. AI blog GUIDESECURITY
27.8.26 The roqueue-tools DevFlow campaign: 2 fake project-flow extensions that fetch JavaScript from a DuckDNS host and run it Two project-flow extensions sit quietly for five minutes after you open your editor. The Kanban board renders, the webview loads, everything looks like a normal project-management tool. Then, once the IDE has settled and the developer has moved on to something else, a setTimeout fires. The extension reaches out to a free DuckDNS subdomain over plain HTTP, grabs a JavaScript file, and runs it with new Function. Hacking blog YEETH SECURITY
27.8.26 How Play Achieves Encryption GuidePoint Security analysts are often called to support and consult on Digital Forensics and Incident Response (DFIR) efforts in remediation, recovery and forensic analysis of ransomware events. Play (also tracked as PlayCrypt) is a ransomware group that has been active since June 2022. Thus far, Play has claimed hundreds of victims across North America, South America and Europe. Ransom blog GUIDESECURITY
27.8.26 Exploiting SMTP with Unicode Bidi Override Spoofing: The Gap Between Auth & Render Security Joes researchers, led by Red Team Lead Anna Breeva, discovered a new email spoofing technique that abuses Unicode bidirectional (Bidi) controls together with SMTPUTF8 to make an attacker-controlled email address visually appear to belong to a trusted domain. Exploit blog Security Joes
27.8.26 Why Financial Services Is the Canary in the Code Mine Organizations have long known that attackers publish malicious packages to public open source registries. The more consequential question is if those packages are actually reaching enterprise development environments. Security blog SONATYPE
27.8.26 Email Bombing and Quick Assist: A New Ransomware Playbook The email bomb was not just noise. It was the setup. The attacker manufactured the problem, waited for the frustration to become impossible to ignore, and then arrived as the person who could "fix" it. Ransom blog ZEROBEC BLOG
27.8.26 Lookalike Domains Are an Identity Problem Powerful brands elicit a feeling of trust, a promise of service delivered, and an expectation of what you will get. Adversaries take advantage of that powerful connection as a means to collect username and password pairs for account takeover and payment card information for financial fraud. With AI and pre-built phishing kits, little technical skill is needed, which compresses the time between registering a lookalike domain and launching it as an active impersonation of your legitimate one. AI blog FLARE.IO
27.8.26 NHI Security: Is an Agent Just a Bot with PR? I’ve recently spent time at identity-focused conferences and couldn’t miss all the messaging about agentic solutions. It got me thinking: agents are just bots with a better PR team. For over a decade, “bot” has been a dirty word. Botnets. Credential-stuffing bots. Bot traffic you pay to filter out. There is an entire security category designed to mitigate the impact of bots. And now, bot traffic now outnumbers human traffic. Security blog FLARE.IO
27.8.26 What the ERMAC Source Leak Says About HookBot One code base, two names, and the panel artifacts that outlast a rebrand Spam blog CENSYS
27.8.26 Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE Chain VulnCheck’s Initial Access Intelligence team shipped an exploit last week chaining two recently disclosed Microsoft SharePoint CVEs that, when used together, allow a remote unauthenticated adversary to bypass authentication and execute code on vulnerable target SharePoint servers. Vulnerebility blog VULNCHECK
27.8.26 Tenable & SentinelOne: 93 CVEs Expose Edge Risk A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication. Vulnerebility blog TENABLE
27.8.26 Response Orchestration: Automated Action on Your Terms The security industry has spent years working on better detection. Threat intelligence is richer than it has ever been. Signals are correlated faster. AI is solving the discovery problem in a way that doesn't require hours from senior analysts to deliver insight. Detection has genuinely improved. AI blog ESENTIRE
27.8.26 Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities Disclosure note: Hunt.io disclosed these findings to CERT-PH under TLP:AMBER and, following responsible disclosure, held publication until August 25, 2026. CERT-PH coordinated notification to the affected organizations. APT blog HUNT.IO
27.8.26 Agentic SOC alert triage: 60% to 92% AI accuracy Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 30 days of past cases. Analysts now clear most alerts with a single click in Slack. Security blog ELASTIC
27.8.26 Tortoiseshell: New Toolset and Operational Infrastructure Exposed Group-IB Threat Intelligence performed enrichment and APT hunting based on recent public data about the Tortoiseshell APT group, leading to the discovery of new samples sharing similarities with known Tortoiseshell malware and additional operational infrastructure. APT blog GROUP-IB
26.8.26 A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign As ANY.RUN analysis shows, a campaign that initially appears to target Canadians with fake Canada Revenue Agency (CRA) T4 tax documents is actually part of a much broader remote-access campaign spanning 46 countries, with 45% of observed activity associated with the United States. CyberCrime ANYRUN BLOG
26.8.26 US Finance Under Phishing Pressure: What the SOC Data Reveals? With modern campaigns such as Vercel-hosted RMM attacks, the scale and security impact of phishing in US finance should not be understated. As threats get increasingly harder to detect, the phishing challenge raises the stakes in the industry. Phishing ANYRUN BLOG
26.8.26 How a Google Search for Claude Led to MacSync Picture this: You've just unboxed a shiny new Macbook, and now you're downloading all of your favorite apps. You type "How to install Claude Code on a Mac" in Google and click on the first link at the top of the page. AI ANYRUN BLOG
26.8.26 Response Orchestration: Automated Action on Your Terms The security industry has spent years working on better detection. Threat intelligence is richer than it has ever been. Signals are correlated faster. AI is solving the discovery problem in a way that doesn't require hours from senior analysts to deliver insight. Detection has genuinely improved. Cyber ESENTIRE
26.8.26 TA488 Targets Zimbra Mailservers with Half-Click Exploits Proofpoint uncovered that Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) was exploiting a previously unknown vulnerability against Zimbra mailservers for at least five months during 2025, until the issue was patched with CVE-2025-66376. APT PROOFPOINT
26.8.26 Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking Group-IB exposes a Mexican PhaaS operation targeting over 20 financial institutions with live phishing, AI vishing, and mobile RAT capabilities. Phishing GROUP-IB
26.8.26 UK Power Facility Cyberattack Shutdown: What Critical-Infrastructure Operators and Defenders Need to Know A reported cyberattack on a UK power-generation facility in July 2026 shows that even disruptions at a single site can raise broader questions about critical infrastructure resilience. BigBrother blog Trend Micro
26.8.26 The Architecture Behind $1B: How Customers Run TrendAI Vision One™ on AWS, and Secure Their AI Workloads TrendAI™ has surpassed $1 billion in AWS Marketplace sales, one of a select group of AWS independent software vendors (ISVs) ever to cross that line. Behind that number are more than 2,900 private offers, and thousands of security teams who closed real gaps faster because buying never slowed them down: AI blog Trend Micro
26.8.26 Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant TrendAI™ Research provides a comprehensive analysis of the RedC2 Linux Implant, a sophisticated threat recently discovered in the npm open-source ecosystem.  AI blog Trend Micro
27.8.26 New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access Academic researchers have disclosed a Rowhammer attack impacting NVIDIA workstation GPUs with GDDR6 memory that defeats error correction codes (ECC), the mitigation NVIDIA recommends against GPU Rowhammer, and enables denial-of-service (DoS) and privilege escalation to a root shell. Attack The Hacker News
27.8.26 CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation. Exploit The Hacker News
27.8.26 TikTok reaches $400M settlement with US over COPPA violations The U.S. Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated companies over allegations that they violated the Children's Online Privacy Protection Act (COPPA). Social BleepingComputer
27.8.26 ReliaQuest confirms failed data-theft attack after ShinyHunters breach Cybersecurity company ReliaQuest has confirmed that one of its employees was targeted in a social engineering attack after hackers impersonated a member of the security team. Incindent BleepingComputer
27.8.26 Microsoft Teams now lets admins block external bots from meetings Microsoft is rolling out a new Teams meeting protection policy that allows administrators to automatically block all identified external bots from joining Teams meetings. OS BleepingComputer
27.8.26 South Korean startup platform breach exposes key management failures A breach at South Korea's government-backed startup platform exposed encrypted personal data after an encryption key was included in an API. Penta Security explains why encryption keys must be securely managed and kept separate from the data they protect. Incindent BleepingComputer
27.8.26 Microsoft: August updates break printing, PDF export in WPF apps Microsoft has confirmed that .NET Framework updates released as part of the August 2026 Patch Tuesday are breaking printing and PDF export in WPF applications. OS BleepingComputer
27.8.26 CISA orders urgent patching of actively exploited Zimbra flaw The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies to patch an actively exploited vulnerability in Zimbra Collaboration Suite (ZCS) within three days. Exploit BleepingComputer
27.8.26 Microsoft shares temporary fix for Windows 11 gaming issues Microsoft has shared a temporary fix for ongoing gaming issues caused by Windows 11 updates released during the August 2026 Patch Tuesday. OS BleepingComputer
27.8.26 ToxicPanda Android malware uses VPN permissions to block Google Play The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands. Virus BleepingComputer
27.8.26 Tortoiseshell: New Toolset and Operational Infrastructure Exposed Group-IB Threat Intelligence performed enrichment and APT hunting based on recent public data about the Tortoiseshell APT group, leading to the discovery of new samples sharing similarities with known Tortoiseshell malware and additional operational infrastructure. APT blog GROUP-IB
27.8.26 FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations The U.S. Department of Justice (DoJ) on Wednesday announced the disruption of two hacking platforms named QScan and QTRouter operated by Chinese threat actors to target critical infrastructure and other sensitive networks in the country. The activity has been attributed to a Chinese state-sponsored group known as QTFY, employed by Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司). BigBrothers The Hacker News
27.8.26 Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore , an Virus The Hacker News
27.8.26 NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions Cybersecurity researchers have disclosed details of a new adversary-in-the-middle ( AitM ) phishing toolkit called NovaCookies that's used as a proxy to redirect Microsoft 365 sign-ins, while capturing authenticated sessions in the process. Hack The Hacker News
27.8.26 CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published the results of two red team assessments it conducted ICS The Hacker News
26.8.26 A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign As ANY.RUN analysis shows, a campaign that initially appears to target Canadians with fake Canada Revenue Agency (CRA) T4 tax documents is actually part of a much broader remote-access campaign spanning 46 countries, with 45% of observed activity associated with the United States. CyberCrime ANYRUN BLOG
26.8.26 US Finance Under Phishing Pressure: What the SOC Data Reveals? With modern campaigns such as Vercel-hosted RMM attacks, the scale and security impact of phishing in US finance should not be understated. As threats get increasingly harder to detect, the phishing challenge raises the stakes in the industry. Phishing ANYRUN BLOG
26.8.26 How a Google Search for Claude Led to MacSync Picture this: You've just unboxed a shiny new Macbook, and now you're downloading all of your favorite apps. You type "How to install Claude Code on a Mac" in Google and click on the first link at the top of the page. AI ANYRUN BLOG
26.8.26 Response Orchestration: Automated Action on Your Terms The security industry has spent years working on better detection. Threat intelligence is richer than it has ever been. Signals are correlated faster. AI is solving the discovery problem in a way that doesn't require hours from senior analysts to deliver insight. Detection has genuinely improved. Cyber ESENTIRE
26.8.26 TA488 Targets Zimbra Mailservers with Half-Click Exploits Proofpoint uncovered that Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) was exploiting a previously unknown vulnerability against Zimbra mailservers for at least five months during 2025, until the issue was patched with CVE-2025-66376. APT PROOFPOINT
26.8.26 Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking Group-IB exposes a Mexican PhaaS operation targeting over 20 financial institutions with live phishing, AI vishing, and mobile RAT capabilities. Phishing GROUP-IB
26.8.26 UK Power Facility Cyberattack Shutdown: What Critical-Infrastructure Operators and Defenders Need to Know A reported cyberattack on a UK power-generation facility in July 2026 shows that even disruptions at a single site can raise broader questions about critical infrastructure resilience. BigBrother blog Trend Micro
26.8.26 The Architecture Behind $1B: How Customers Run TrendAI Vision One™ on AWS, and Secure Their AI Workloads TrendAI™ has surpassed $1 billion in AWS Marketplace sales, one of a select group of AWS independent software vendors (ISVs) ever to cross that line. Behind that number are more than 2,900 private offers, and thousands of security teams who closed real gaps faster because buying never slowed them down: AI blog Trend Micro
26.8.26 Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant TrendAI™ Research provides a comprehensive analysis of the RedC2 Linux Implant, a sophisticated threat recently discovered in the npm open-source ecosystem.  AI blog Trend Micro
26.8.26 Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. Vulnerebility The Hacker News
26.8.26 Exploits and vulnerabilities in Q2 2026 This report covers statistics on vulnerabilities, exploits, and C2 frameworks in Q2 2026. For the first time ever, we aggregate data on vulnerabilities in open-source AI agents and AI frameworks. Exploit SECURELIST
26.8.26 Imagine the SOC Without a Queue: From Alert Backlog to AI Hypothesis Engine The SOC we've always known was built around a model that guarantees most of the alert queue will never receive analyst review. There's never AI The Hacker News
26.8.26 Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests Aikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, AI The Hacker News
26.8.26 OpenAI Bans Russian ChatGPT Accounts Used to Run Influence Operation OpenAI on Tuesday said it banned a cluster of Russian ChatGPT accounts that used VPNs to bypass access restrictions and run an influence AI The Hacker News
26.8.26 INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown An eight-month INTERPOL operation targeting West African organized crime groups has led to arrests of 58 people and the identification of 263 BigBrothers The Hacker News
26.8.26 Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER , that stays inert in Virus The Hacker News
26.8.26 Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched Exploit The Hacker News
26.8.26 Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes Cybersecurity researchers have disclosed details of a phishing-as-a-service (PhaaS) platform built to strip Apple's Activation Lock from stolen devices, using rented AI voice agents that call theft victims posing as Apple Support and ask for their device passcode. AI The Hacker News
26.8.26 U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches The U.S. Department of the Treasury has announced fresh sanctions on Iranian cyber actors as part of what it called an "unprecedented, whole-of- ICS The Hacker News
25.8.26 A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the AI The Hacker News
25.8.26 WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android Meta on Tuesday announced a set of WhatsApp account security features, including support for multiple passkeys to a single account to help users Social The Hacker News
25.8.26 Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Vulnerebility The Hacker News
25.8.26 Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Phishing The Hacker News
25.8.26 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for CyberCrime The Hacker News
25.8.26 E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers ( DDRs ) to deliver two Virus The Hacker News
25.8.26 Escape found the same XSS in two AI chatboxes. The vulnerability was in the Markdown renderer. Weeks apart, at two unrelated companies, Escape's AI pentesting agent found the same stored XSS. Both had shipped a customer-facing chat where the model emits Markdown and the frontend renders it with raw HTML enabled and no sanitizer, so anything the model can be made to say executes in the browser of whoever reads the transcript next. AI ESCAPE
25.8.26 Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE Chain VulnCheck’s Initial Access Intelligence team shipped an exploit last week chaining two recently disclosed Microsoft SharePoint CVEs that, when used together, allow a remote unauthenticated adversary to bypass authentication and execute code on vulnerable target SharePoint servers: Exploit VULNCHECK
25.8.26 What is EvilTokens?: The PhaaS Platform That Tells Attackers What to Do After They Get In As competition in the underground phishing market increases, so does the quality of the products and services offerings, particularly among the Phishing as a Service (PhaaS) category. EvilTokens is completely reshaping how PhaaS affiliate programs operate: rather than offering initial access alone, it also provides malicious analytics services informed by operator experience and AI-driven insights. Phishing FLARE.IO
25.8.26 Extended Rapid Response: Zimperium Identifies RecruitTrap Recruit Scams are Targeting Enterprise Credentials on Mobile The recent research on The Growing Threat of Browser-in-the-Browser (BitB) Recruitment Scams highlights an escalating trend in social engineering: threat actors impersonate real HR personnel across multiple well-known companies to execute highly convincing, interview-themed phishing attacks. By scraping public profile data, attackers craft hyper-realistic scheduling flows designed to bypass traditional user skepticism. Spam ZIMPERIUM
25.8.26 PSD3, PSR and the Rise of Privacy-Preserving Behavioural Analytics Fraud has changed. Controls for a world of stolen credentials, compromised accounts, and unauthorised transactions need to be revisited, because today's reality is different. Customers are manipulated into authorising payments themselves through scams, social engineering, remote access tools (RATs), malware, and impersonation attacks. CyberCrime THREATFABRIC
25.8.26 VEEAM UNDER FIRE: Understanding CVE-2026–44963 & Ransomware Group Exploit Claims NOTE: This research originated from an interaction with the Lynx Ransomware Group, which enabled me to thoroughly explore the Veeam CVE Exploit history. As a result, I discovered a previous exploit that predates the latest Veeam vulnerability. I have also made a quick ATTACK TTP MATRIX dedicated for Veeam Backup & Replication Vulnerebility THEREVENFILE
25.8.26 The roqueue-tools DevFlow campaign: 2 fake project-flow extensions that fetch JavaScript from a DuckDNS host and run it Two project-flow extensions sit quietly for five minutes after you open your editor. The Kanban board renders, the webview loads, everything looks like a normal project-management tool. Then, once the IDE has settled and the developer has moved on to something else, a setTimeout fires. The extension reaches out to a free DuckDNS subdomain over plain HTTP, grabs a JavaScript file, and runs it with new Function. Hack YEETH SECURITY
25.8.26 Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign Vulnerebility The Hacker News
25.8.26 Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Exploit The Hacker News
25.8.26 Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by Virus The Hacker News
24.8.26 Imobiliare.ro, Klark.ai, Fortinet VPN, E-Commerce Skimming, and Solimut SQLi SOCRadar Dark Web Team identified several new underground posts involving alleged database leaks, exposed remote access, and access-for-sale activity. The findings include an alleged Imobiliare.ro user database sale, administrative Fortinet SSL-VPN access tied to a UAE hotel reservation firm, an alleged Klark.ai data leak, a U.S. e-commerce iframe skimming operation, and alleged SQL injection access affecting Solimut Mutuelle de France. CyberCrime SOCRADAR
24.8.26 Cisco Crosswork, Secure Workload CVEs Patched Cisco released security updates for Cisco Crosswork and Cisco Secure Workload, addressing nine vulnerabilities across the two product families. Vulnerebility SOCRADAR
24.8.26 CVE-2026-19478: GitLab GraphQL Flaw Exploited GitLab has patched CVE-2026-19478, a critical code injection vulnerability affecting self-managed Community Edition (CE) and Enterprise Edition (EE) instances. Under certain conditions, an unauthenticated remote attacker could leverage a GraphQL directive to modify or delete public projects and user data. Vulnerebility SOCRADAR
24.8.26 CVE-2026-69836: Microsoft Entra ID RCE Fixed Microsoft recently disclosed CVE-2026-69836, a critical Remote Code Execution (RCE) vulnerability in Microsoft Entra ID (formerly Azure Active Directory). Because this issue affected a Microsoft-hosted cloud service, remediation was applied on the backend rather than through a traditional customer patch. Vulnerebility SOCRADAR
24.8.26 ShinyHunters Claims ReliaQuest Breach A ShinyHunters-associated leak site listed ReliaQuest on August 23, 2026, raising questions about a potential data extortion attempt against the cybersecurity provider. Incindent SOCRADAR
24.8.26 Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain The SOCRadar Threat Research Unit (STRU) has conducted an “inside-out” analysis of AnonyMousKIT, an AI-powered Phishing-as-a-Service (PhaaS) ecosystem specifically engineered to disable Apple’s Activation Lock on stolen devices.  Phishing SOCRADAR
24.8.26 Inside the Ecosystem & Operations: LockBit 5.0 Ransomware Group LockBit began operating independently under the name ABCD ransomware in September 2019, and from the end of December 2019, it established the current LockBit brand by using the .lockbit extension. Ransom S2W
24.8.26 Frequently asked questions about the active threat to Siemens S7 Series PLCs A joint cybersecurity advisory released by multiple U.S. government agencies warns that threat actors are using AI-generated exploitation scripts to target exposed Siemens S7 Series PLCs across critical infrastructure sectors. AI TANABLE
24.8.26 1 in 20 Stealer Log Victims are Threat Actors When analysts examine stealer logs, the underlying assumption is that each infected device belongs to a victim. However, cybercriminals are not immune to the same operational mistakes as everyone else. CyberCrime FLARE.IO
24.8.26 The Age of Autonomous Attacks is Here In July 2026, Hugging Face was breached by an autonomous agent swarm that had broken out of an OpenAI Sandbox and was attempting to succeed at ExploitGym, a cyber benchmark. AI FLARE.IO
24.8.26 July 2026 Threat Trend Report on Ransomware The July 2026 Threat Trend Report on Ransomware summarizes major Korean & global ransomware issues based on statistics regarding the quantity of new ransomware samples, the number of compromised systems, and statistics on targeted businesses. Ransom AHNLAB
24.8.26 WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Virus The Hacker News
24.8.26 Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management Vulnerebility The Hacker News
24.8.26 Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed CyberCrime The Hacker News
24.8.26 The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk Big security risks come in small packages. While enterprise security teams focus on policing the proliferation of employees using ChatGPT and AI The Hacker News
24.8.26 A Social Engineering Attempt Against ReliaQuest: What We Found ReliaQuest was the target of a social engineering attack. While unsuccessful beyond temporarily exposing one identity, the attempt was an important reminder of the persistent tactics of threat actor groups and what all organizations can do to guard against them. We are sharing the full details of this attempt for transparency and so others can learn from this playbook. Social RELIAQUEST
24.8.26 UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux APT The Hacker News
23.8.26 SmartApeSG ClickFix campaign leads to two RATs Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC
23.8.26 Hackers infect Android car head units with proxy botnet malware A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. Virus BleepingComputer
23.8.26 Named Pipes Under Attack: Securing Windows Interprocess Communication Windows named pipes provide fast interprocess communication, but weak access controls can expose privileged services to untrusted processes. ThreatLocker explains how endpoint verification, command authorization, strict input validation, and narrowly scoped privileges can help secure named-pipe communication. Hack BleepingComputer
23.8.26 New SynkLoader malware pushed in Microsoft Teams phishing campaign A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. Virus BleepingComputer
23.8.26 Hundreds of leaked AWS keys give full control over corporate accounts More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid. Hack BleepingComputer
23.8.26 Microsoft blames Windows gaming issues on RGB lighting devices Microsoft says ongoing issues causing games to crash or fail to launch after installing the August 2026 Windows updates may be caused by peripherals with RGB lighting. OS BleepingComputer
23.8.26 Is Online Privacy Possible? How Digital Identities Can Help Using the same email, phone number, payment method, and other identifiers makes it easier for data brokers and attackers to profile your activity. Anonyome Labs explains how separate digital personas can reduce correlation and limit the impact of breaches, spam, and identity theft. Security BleepingComputer
23.8.26 Microsoft rolls out Classic Outlook theme for New Outlook users Microsoft has started rolling out a Classic Outlook theme for users of Outlook on the web and the New Outlook for Windows. OS BleepingComputer
23.8.26 CISA orders feds to patch actively exploited TrueConf Server flaws The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. Exploit BleepingComputer
23.8.26 Microsoft patches max severity code execution, privilege escalation flaws Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks. OS BleepingComputer
23.8.26 Hackers abuse FTP server banners to deliver new Windows malware Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. Virus BleepingComputer
23.8.26 SickKids data breach exposes employee and job applicant info Toronto's Hospital for Sick Children (SickKids) says a cybersecurity incident exposed the personal information of some current and former employees and job applicants, stemming from a flaw in third-party software. Clinical systems and patient records were not affected. (264) Incindent BleepingComputer
23.8.26 Hackers poison arrayref Rust crate to push infostealer malware Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers' systems during compilation. Virus BleepingComputer
23.8.26 Critical Elementor Pro bug exposes WordPress sites to RCE attacks A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server. Vulnerebility BleepingComputer
23.8.26 CVE-2026-3055 Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread VULNEREBILITY VULNEREBILITY

23.8.26

 CVE-2026-4368 Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup VULNEREBILITY VULNEREBILITY
23.8.26 How MSPs can catch phishing attacks email filters miss AI is making phishing attacks more personalized, convincing, and difficult for traditional email filters to detect. Kaseya explains how MSPs can monitor identity, email, and endpoint activity to detect and contain attacks that make it past the inbox. Phishing BleepingComputer
23.8.26 Citrix urges admins to patch new NetScaler flaws as soon as possible Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances. Vulnerebility BleepingComputer
23.8.26 CISA warns of hackers exploiting critical MLflow vulnerability The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical vulnerability in the MLflow open-source AI engineering platform. Vulnerebility BleepingComputer
23.8.26 New Manic Android malware can exfiltrate data through nearby devices A new Android malware named Manic targeting users in multiple European countries has a fallback data exfiltration mechanism that uses nearby infected devices. Virus BleepingComputer
23.8.26 Critical Zimbra RCE flaw now actively exploited in attacks CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS). Vulnerebility BleepingComputer
23.8.26 Microsoft says August Windows updates may cause gaming issues Microsoft is investigating a potential issue with the August 2026 updates that may prevent some games from launching or cause them to crash on affected Windows 11 systems. OS BleepingComputer
23.8.26 OpenAI confirms ChatGPT is down as logins and signups fail ChatGPT is experiencing a major outage, and users are unable to sign in, create accounts, or load chats, including previous conversations. AI BleepingComputer
23.8.26 Rogue ransomware affiliate poses as recovery firm to steal payments A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. Ransom BleepingComputer
23.8.26 Sakura Internet hack exposes data of up to 1.36 million accounts Japanese cloud and data center service provider Sakura Internet disclosed that hackers accessed its sales management system, where customer contract and membership information is stored. Incindent BleepingComputer
23.8.26 Healthtech firm CareCloud data breach impacts 3.7 million patients U.S. healthcare IT company CareCloud disclosed that the data breach incident it suffered earlier this year has impacted more than 3.7 million individuals. Incindent BleepingComputer
23.8.26 Hackers compromise 14,500 Dahua web cameras in 35-day campaign In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia. Incindent BleepingComputer
23.8.26 US warns of AI-powered attacks on Siemens PLCs in critical infrastructure U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure. AI BleepingComputer
23.8.26 US charges Iranian hackers over $3.4 billion intellectual property theft The U.S. has charged 17 Iranians, alleged members of a hacking-for-hire company called Mabna Institute, involved in years-long operations that stole data from American organizations. BigBrothers BleepingComputer
23.8.26 TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit The U.S. Department of Justice (DoJ) announced on Friday that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit Social The Hacker News
22.8.26 Cisco Crosswork Security Hardening Release: August 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered VULNEREBILITY VULNEREBILITY
22.8.26 PlikanLocker Ransomware Point Wild Threat Intelligence has recently identified a new .NET-based ransomware strain named PlikanLocker that blends file extortion with aggressive endpoint lockdown tactics. Distributed primarily through phishing attachments, malicious links, and social media lures, the malware targets general Windows environments by securing administrator rights via UAC prompts. ALERTS RANSOM

22.8.26

 Threat Actors Deploy WordlistLoader in Latest Amatera Attacks Researchers at Gen Threat Labs recently reported a new malware family called WordlistLoader, which threat actors are utilizing to deliver the Amatera infostealer to a wide range of victims. According to their analysis, the attack begins on legitimate but compromised websites where visitors encounter a fake CAPTCHA prompt as part of a ClearFake campaign. ALERTS VIRUS

22.8.26

 Mirage2FA Campaigns ANY.RUN has published a report on Mirage2FA, a commercial phishing-as-a-service (PhaaS) kit operated by LinX Coders that has been active between September 2024 and July 2026. ALERTS CAMPAIGN

22.8.26

 Grandoreiro Banking Trojan Resurfaces With DLL Sideloading Campaign in Mexico In a recent write-up, Acronis details a campaign demonstrating the geographic expansion of the Grandoreiro banking trojan from South America into Mexican financial, logistics, and industrial sectors. Distributed through tax- and invoice-themed phishing emails containing malicious ZIP archive attachments or direct download links, the attack chain lures victims into executing a heavily padded installer binary.  ALERTS VIRUS

22.8.26

 Threat Group UAT-10147 Deploys SPECTRE Backdoor and Linux Rootkits Researchers at Cisco Talos recently reported on malicious campaigns conducted by the Chinese-speaking threat group UAT-10147 targeting Linux and Windows web servers across government, education, technology, media, and gaming sectors worldwide.  ALERTS APT
22.8.26 AmnesiaStealer - a macOS infostealer written in Rust Jamf Threat Labs researchers recently reported on AmnesiaStealer, an advanced multi-stage macOS malware written in Rust. Threat actors have been distributing this malware via "ClickFix" social engineering tactics, leveraging deceptive GitHub download pages. Once executed, the stealer extracts system passwords using native-looking prompts, exfiltrates Keychain data, and sweeps local storage for sensitive files, Apple Notes, and Telegram sessions. ALERTS VIRUS

22.8.26

 QUARTERLY THREAT LANDSCAPE REPORT The compression era: Q2 2026
has showed that traditional patch cycles are overwhelmed		 Q2 2026 was not just another busy quarter in cyber. It felt more like a stress test of the way we currently manage exposure. Traditional patch cycles are being overwhelmed by the sheer volume of vulnerabilities and attacker speed and precision. REPORT REPORT
22.8.26 Password spraying attacks surge 155x as hackers exploit MFA gaps Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected. Security BleepingComputer

22.8.26

 Microsoft fixes known issue causing Windows Defender crashes Microsoft has resolved a bug that caused Windows Defender to crash after a recent security update, resulting in 0xc0000005 access violation errors on some affected systems. OS BleepingComputer

22.8.26

 Critical RCE flaw in Windows IKE Extension now actively exploited The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component. Exploit BleepingComputer

22.8.26

 Windows 11 24H2 Home and Pro reach end of support in 2 months Microsoft has reminded customers that systems running Home and Pro editions of Windows 11 24H2 will stop receiving updates in two months. OS BleepingComputer
22.8.26 CISA: Medusa ransomware hit over 500 critical infrastructure orgs The FBI said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021. Ransom BleepingComputer

22.8.26

 Comcast turns your Xfinity WiFi into a home motion detector Comcast is promoting WiFi-based motion detection as a part of its new Xfinity Shield home protection platform, allowing routers and wireless devices to detect people moving through a home without cameras or motion sensors. Security BleepingComputer

22.8.26

 Clop created custom web shell for Windchill data theft attacks A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. Ransom BleepingComputer
22.8.26 Your Controls Block Known Attacks. What About the Behavior? Security controls can block a familiar attack method while missing quieter ways to achieve the same objective. Picus Security's Blue Report 2026 shows how prevention rates can vary dramatically by technique and why behavioral testing is needed to uncover those gaps. Security BleepingComputer

22.8.26

 Microsoft tests faster Windows File Explorer, new context menu Microsoft has started testing a faster File Explorer and a less cluttered and more customizable context menu in Windows 11 preview builds rolling out to Insiders this week. OS BleepingComputer
22.8.26 CISA: Windows Task Host flaw now exploited by ransomware gangs The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. Ransom BleepingComputer

22.8.26

 Microsoft confirms outage affecting search in Microsoft 365 apps Microsoft says some users are experiencing issues searching in Microsoft 365 apps, including Outlook on the web, Outlook desktop, SharePoint Online, and OneDrive. OS BleepingComputer

22.8.26

 Microsoft starts removing WMIC tool used by cybercriminals Microsoft announced that it removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week. CyberCrime BleepingComputer
22.8.26 Hacker claims 3.6 million Azure account records stolen from major companies A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials. Hack BleepingComputer
22.8.26 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are Virus The Hacker News
22.8.26 Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios. Hacking blog WIZ.IO

22.8.26

 UNISOC T612 LPE Summary UNISOC (Shanghai) Technologies Co., Ltd. is a top-three global fabless semiconductor company headquartered in Shanghai, specializing in 2G/3G/4G/5G mobile communication, IoT, and smart device chipsets. Formerly Spreadtrum, it serves major brands like Honor, realme, Security blog SSD-DISCLOSURE

22.8.26

 Linux Bridge STP Timer Use-After-Free Summary A use-after-free vulnerability in the Linux kernel bridge (net/bridge) Spanning Tree Protocol (STP) implementation. A bridge that is administratively down while kernel STP is enabled, together with a port driven into the LEARNING state, OS Blog SSD-DISCLOSURE
22.8.26 Device Code Phishing Up 1500% In a story recently reported by Dark Reading, Crowdstrike researchers found that device code phishing and voice phishing (vishing) attacks have more than doubled as cybercriminals increasingly combine phone calls with mobile authentication workflows to trick users into approving fraudulent device authentication requests, enabling corporate network access. Phishing blog ZIMPERIUM

22.8.26

 The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile The zLabs team recently identified an updated variant of ToxicPanda, the Android banking Trojan known to have primarily targeted Europe, that introduces significant enhancements, including a comprehensive command set of 167 remote commands and substantially expands its targets globally. Malware blog ZIMPERIUM

22.8.26

 GoldDigger Malware Demonstrates Advanced Mobile Banking Threats A recent analysis highlights GoldDigger, an Android malware family designed to steal financial information and facilitate fraudulent activity on compromised devices. The malware abuses accessibility services to monitor user activity, capture credentials, and interact with banking applications while operating with limited visibility to the victim. Malware blog ZIMPERIUM
22.8.26 Mobile Ad Fraud Scheme Uses Automation to Mimic Human Behavior A recent investigation uncovered Papyrus, a mobile ad fraud operation designed to generate fraudulent engagement by imitating legitimate user behavior. The scheme uses Android apps to produce automated clicks, scrolling, and other interactions that appear human, allowing fraudulent activity to blend into normal mobile traffic. By manipulating engagement signals rather than relying on obvious malicious actions, these techniques can make detection more difficult. Malware blog ZIMPERIUM

22.8.26

 Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. CloudSEK has published the victim list from Team PCP's supply chain campaign: 78,330 secrets exfiltrated from the CI/CD pipelines of 2,186 organizations over five days in March 2026. StepSecurity's research team has tracked this threat actor across the Trivy, telnyx, and LiteLLM compromises. Hacking blog STEPSECURITY

22.8.26

 Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper A compromised maintainer account and a same-day impersonator of one of Rust's best-known authors turned a routine cargo update into silent remote code execution. Three crates from the same owner were poisoned in 23 minutes (arrayref, internment, and append-only-vec), alongside six attacker-owned crates now deleted from crates.io. Security blog STEPSECURITY
22.8.26 AI-Agent-Driven Offensive Operation : Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign Leading to Mass Wallet and Credential Compromise CloudSEK uncovered a Chinese-speaking threat operator using autonomous AI coding agents to scale cyberattacks, including mass WordPress compromise, cryptocurrency wallet theft, credential harvesting and cryptojacking. The exposed infrastructure also revealed a developing blockchain-based command-and-control system designed to make future operations more resilient to takedowns. AI blog CloudSEK

22.8.26

 BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer CloudSEK’s BRIDGEHEAD investigation exposes a 40-package npm typosquatting campaign that abuses WSL to reach Windows hosts and deploy a concealed Rust-based stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory and using public infrastructure for reconnaissance and exfiltration, making detection and takedown significantly harder. Cryptocurrency blog CloudSEK

22.8.26

 PWNBench-v0.1: Evaluating frontier models for web application pentesting We benchmarked 11 frontier LLMs on real-world web app pentesting. See which AI models lead in recall, precision, and cost efficiency in PWNBench-v0.1. AI blog NOVEE
22.8.26 Bird Watching: Characterizing the Infrastructure and Behavior of Falcon-branded Extortion Operations Increased attention has been called to a sustained adversary-in-the-middle (AitM) phishing and vishing operation targeting financial services, professional services, energy and technology organizations since at least April 2026. This activity aligns with the threat cluster publicly designated UNC6671 by Google Threat Intelligence Group and O-UNC-045 / CORDIAL SPIDER by Okta Threat Intelligence, operating under extortion brands including Falcon, Helix, Pink and Redact (formerly BlackFile). APT blog GUIDESECURITY

22.8.26

 Beware the Ransomware Rescuer: Ransom Busters The GuidePoint Research and Intelligence Team (GRIT) has responded to several recent ransomware incidents in which victims received an unexpected email from an ostensible third-party entity referring to itself as “Ransom Busters.” Ransom blog GUIDESECURITY
22.8.26 CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The vulnerability carries a CVSS v4.0 base score of 9.3 and can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges. Vulnerebility blog RAPID7

22.8.26

 Rapid7 and Licencias OnLine Partner to Accelerate Cybersecurity Maturity across Latin America Across Latin America, organizations are embracing cloud, AI, and digital transformation to drive innovation and business growth. These technologies create new opportunities, but also introduce greater complexity and expanding attack surfaces. Cyber blog RAPID7
22.8.26 New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs. Success going forward can’t be about patching as much as possible - it has to be about understanding what matters most and reducing the exposures attackers can actually reach. AI blog RAPID7

22.8.26

 Copilot for KeyBank — a 3 KB VSIX that beacons through github-cdn.net and waits for eval A new VS Code extension called “Copilot for KeyBank” went live on the Microsoft Visual Studio Marketplace in August 2026. The publisher is verified, the display name on the marketplace is “Deep Seek”, and the package name is verified.pypi-keyBank. None of those brand names — GitHub Copilot, DeepSeek, PyPI, KeyBank — have anything to do with this extension. They are all cover. AI blog YEETH SECURITY

22.8.26

 The heyheyhey campaign: 6 fake Roblox VS Code extensions that fetch and run a remote script from GitHub A Kanban board for Roblox developers sounds harmless enough. Six of them hit the Microsoft VS Code Marketplace over three days in June 2026, all from different publishers, all with names like RoFlow, RoPilot, and ManageBlox. The boards work — they render a webview, they show columns, they look like a project tool. That is the cover. Hacking blog YEETH SECURITY
22.8.26 SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon Varonis Threat Labs discovered SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise that allows an attacker to steal sensitive data — MFA codes, email messages, meeting details, and private organizational files — with a single click. AI blog VARONIS

22.8.26

 CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower See how meta-hacking got Microsoft Copilot to snitch on itself, exposing CoSnitch, a one-click flaw that silently exfiltrates data. AI blog VARONIS

22.8.26

 Critical infrastructure security Is back in the headlines Recent cyber threats affecting water infrastructure and industrial control systems have renewed attention on the cybersecurity challenges facing critical infrastructure across the United States. This article examines emerging risks to water utilities, proposed legislation aimed at improving resilience and the ongoing debate over how critical infrastructure security should be funded and managed. Vulnerebility blog BARRACUDA
22.8.26 Threat Spotlight: The average web application has 20 security vulnerabilities Barracuda research finds the average web application has 20 security vulnerabilities. Learn the seven most common flaw types and how to reduce risk. Vulnerebility blog BARRACUDA

22.8.26

 The Gentlemen ransomware: Inside one of the fastest-growing extortion operations The Gentlemen has emerged as one of the fastest-growing ransomware-as-a-service operations. This threat profile examines the group's origins, affiliate model, attack chain, infrastructure, known tactics, techniques and procedures (TTPs), and the operational-security failures that exposed its internal workings. Ransom blog BARRACUDA

22.8.26

 CVE-2026-19490: NetScaler Auth Bypass Patched CVE-2026-19490: NetScaler Auth Bypass Patched Cloud Software Group released a critical security bulletin for customer-managed NetScaler ADC and NetScaler Gateway deployments, fixing two vulnerabilitie... Vulnerebility blog SOCRADAR
22.8.26 SOCRadar Ranks No. 542 on the 2026 Inc. 5000 List of America's Fastest... SOCRadar Ranks No. 542 on the 2026 Inc. 5000 List of America’s Fastest-Growing Private Companies SOCRadar Is Recognized for 645% Three-Year Revenue Growth, Marking Its Second Consecutive Year on the L... Cyber blog SOCRADAR

22.8.26

 CVE-2026-69836: Microsoft Entra ID RCE Exploited CVE-2026-69836: Microsoft Entra ID RCE Exploited Microsoft has disclosed CVE-2026-69836, a maximum-severity Remote Code Execution (RCE) vulnerability in Microsoft Entra ID, the cloud identity and acce... Vulnerebility blog SOCRADAR
22.8.26 FTP Banners: The New Dead Drop Resolver Delivering Novel RATs FTP Banners: The New Dead Drop Resolver Delivering Novel RATs STRU found threat actors using FTP banners as Dead Drop Resolvers – legitimate services or protocols abused to host C2 addresses and comma... Malware blog SOCRADAR

22.8.26

 Windows IKE CVE-2026-33824 Added to CISA KEV Windows IKE CVE-2026-33824 Added to CISA KEV Windows IKE CVE-2026-33824 is now in CISA’s Known Exploited Vulnerabilities catalog, giving defenders a short deadline to verify patching and exposure. CIS... Vulnerebility blog SOCRADAR

22.8.26

 July 2026: OpenAI Agent Incident, KDDI Breach July 2026: OpenAI Agent Incident, KDDI Breach July 2026 brought a mix of large scale data exposures, supply chain access risks, credential-driven activity, and a new kind of AI-related incident respon... Vulnerebility blog SOCRADAR
22.8.26 Telegram Applied for .gram: What It Means for the Threat Landscape Telegram Applied for .gram: What It Means for the Threat Landscape ... Social blog SOCRADAR

22.8.26

 Can NVD Modernization Keep Pace With AI? Can NVD Modernization Keep Pace With AI? AI can help security teams find vulnerabilities faster. That sounds entirely positive until we consider what happens after those vulnerabilities are found. Eve... Vulnerebility blog SOCRADAR

22.8.26

 Italy RDWeb Access, GBCSA Data Sale, SCHUFA Claim, and FLY Firebase Ex... Italy RDWeb Access, GBCSA Data Sale, SCHUFA Claim, and FLY Firebase Exposure SOCRadar Dark Web Team identified several new underground posts involving alleged initial access sales and large-scale data... Cyber blog SOCRADAR
22.8.26 From Blackwater to Cyber-Privateers: When States Outsource Force From Blackwater to Cyber-Privateers: When States Outsource Force On August 12, 2026, President Donald Trump signed a National Security Presidential Memorandum titled “Expanding Capabilities to Combat ... Cyber blog SOCRADAR

22.8.26

 Frequently asked questions about the active threat to Siemens S7 Series PLCs A joint cybersecurity advisory released by multiple U.S. government agencies warns that threat actors are using AI-generated exploitation scripts to target exposed Siemens S7 Series PLCs across critical infrastructure sectors. ICS blog TENABLE

22.8.26

 Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities Learn how Tenable One Cloud Exposure helps you unmask the sophisticated tactics of cybercrime group Storm-0501, which carries out Azure-based cloud ransomware campaigns. Tenable One Cloud Exposure uses AI-powered threat stories to expose Storm-0501 TTPs, backed by precision-engineered threat detection alerts. Ransom blog TENABLE

22.8.26

 Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs Oracle addresses 925 CVEs in its August 2026 Critical Security Patch Update with 943 patches, including 154 critical updates. Vulnerebility blog TENABLE
22.8.26 Death By 20,000 PoCs VulnCheck researchers curated 20K+ public exploits and vulnerability analyses in 2025. As of mid-August 2026, we’ve already reviewed 17,800+ PoCs and write-ups, putting us 87% of the way to 2025’s numbers with another 4.5 months left to go in the year. Exploit blog VULNCHECK

22.8.26

 FileRun: When Your File Manager Runs Your Files Today VulnCheck is disclosing CVE-2026-14863, an OS command injection to remote code execution in FileRun, a commercial self-hosted file manager. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. FileRun’s thumbnail extractors build shell commands by pasting the uploaded file path into a double-quoted string and handing it to exec(), and the filename sanitizer lets $() through, so a file named $(payload).mp4 runs its payload the moment a thumbnail is generated. Vulnerebility blog VULNCHECK

22.8.26

 Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directive Two flaws in GitLab’s GraphQL API: one lets any user wipe or alter public projects and user data, the other quietly runs changes using a logged-in user’s own permissions. Self-managed instances from 18.2 through 19.2 need to upgrade now. Vulnerebility blog OX

22.8.26

 Critical vm2 Vulnerability Allows Host DNS Hijacking and Information Disclosure vm2’s sandbox denylist forgot two modules: “os” and “dns.” Under the wildcard config vm2’s own docs recommend, that gap lets sandboxed code read the host process owner’s identity and hijack the host’s DNS with a single call — a change that outlives the sandbox run and never notifies the embedder. Patched in 3.11.6. Vulnerebility blog OX
22.8.26 1 in 20 Stealer Log Victims are Threat Actors When analysts examine stealer logs, the underlying assumption is that each infected device belongs to a victim. However, cybercriminals are not immune to the same operational mistakes as everyone else. Malware blog FLARE.IO

22.8.26

 July 2026 Threat Trend Report on APT Groups The July 2026 Threat Trend Report on APT Groups summarizes the trend in which state-sponsored threat actors and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques. Key targets include Microsoft 365, webmail accounts, cloud infrastructure, GitHub and development environments, VPN and remote access systems, mobile devices, and credentials stored in browsers. APT blog AHNLAB

22.8.26

 Clop Returns with Custom Implant in Mass-Extortion Campaign This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat landscape—not ReliaQuest's own environment. Nothing in this report should be interpreted as a vulnerability in ReliaQuest's systems or data. Ransom blog RELIAQUEST

22.8.26

 North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs The infiltration of North Korean IT workers into American and European organizations has evolved into a sophisticated operation that bypasses traditional security perimeters. By using forged identities and AI-assisted workflows, these operatives successfully transition from external applicants to trusted insiders. APT blog ANYRUN BLOG
22.8.26 Hunt Malware & Phishing Threats with ANY.RUN for Proactive Enterprise Security One of the biggest challenges for every threat hunter is navigating endless alerts, scattered indicators, behavioral evidence, and infrastructural context. Data collection is just the first step – but how do you turn it into findings that lead to proactive protection against malware and phishing? Malware blog ANYRUN BLOG

22.8.26

 Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle (AiTM) attacks. Phishing blog ANYRUN BLOG

22.8.26

 Post-DEF CON Phishing Uses Google Doc Apps Script to Deliver Malware Following Black Hat/DEF CON, a Huntress researcher was targeted by a threat actor who used X DMs and fake security conference planning as a pretext to establish trust before attempting to deploy malware. The researcher recognized the lure as a scam and did not fall for it, but continued engaging with the actor to better understand the tactics they were using. Phishing blog Huntress
22.8.26 PurpleDelta's Fraudulent Employment Operations Insikt Group has identified several clusters of activity linked to PurpleDelta, Recorded Future's designation for North Korean IT workers, comprising multiple operators likely based in China. Between late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors. APT blog Recorded Futures

22.8.26

 Don’t Break the Agent: Lessons in Token Optimization Measuring a token optimizer when your users are 1,000 engineers and your test suite is production Security blog JFROG

22.8.26

 Frontier AI Application Security: Every Second Counts A look at how AppSec processes must change to manage the ever increasing volume of CVEs resulting from today's cyber-capable AI models AI blog JFROG

22.8.26

 13 million tool calls: auditing every AI coding agent action with Elastic Agent We gave hundreds of developers an AI agent that can run shell commands, edit files, and call Model Context Protocol (MCP) servers on their laptops, then realized we had no record of what it actually did. So we built one. One 280-line dependency-free bash script, fired by Cursor's hooks, records every tool call as JSONL, and the Elastic Agent already on each endpoint ships it to Elasticsearch. Since the May rollout we have logged over 13 million tool-call events from more than 1,100 machines. AI blog ELASTIC
22.8.26 Every detection needs a next step: Why runbooks solve the investigation problem An alert appears in the security operations center. It reports a suspicious sign-in from an unusual location, involving an account that matters. The analyst opens it and reviews the information provided by the detection. Security blog SEKOIA

22.8.26

 AI SOC integrations: 6 capabilities worth connecting Explore six AI SOC integrations that bring identity, cloud, vulnerability, phishing, incident and network context into one investigation workflow. AI blog SEKOIA

22.8.26

 Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia Disclosure note: The relevant national CERTs were notified on 10 August 2026, and Dahua's PSIRT was notified regarding the issues that affect devices in all countries observed in this campaign. We appreciate Dahua PSIRT's engagement in reviewing parts of this research ahead of publication. Publication was held until 18 August 2026 under TLP:AMBER. BigBrother blog HUNT.IO
22.8.26 Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025 In late July 2026, eSentire's Threat Response Unit (TRU) identified several ErrTraffic-generated ClickFix campaigns attempting to deliver Cruciferra - a malware loader marketed on underground forums that boasts EDR-killing capabilities. TRU found Cruciferra using a vulnerable driver to fulfill this behavior. Malware blog ESENTIRE

22.8.26

 C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 In July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads. Malware blog Zscaler
22.8.26 How Grok unknowingly powers cybercrime Kriminal isn’t a custom-built criminal AI model: it’s Grok in a trench coat. The proof sits in its own code. AI blog THREATDOWN

22.8.26

 CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms Falcon Cloud Security earns the highest scores in both Innovation and Growth by connecting risk, adversary intelligence, and real-time protection to stop attacks. Security blog CROWDSTRIKE

22.8.26

 Benchmaxxing: When the Benchmark Becomes the Target In AI and cybersecurity, optimizing to meet benchmarks can have significant consequences. This is how CrowdStrike approaches benchmarks and evaluations. AI blog CROWDSTRIKE
22.8.26 Teaching AI to Reason Through Detection Triage New CrowdStrike research shows how step-by-step reasoning can improve detection triage accuracy, transparency, and safe automation. AI blog CROWDSTRIKE

22.8.26

 Fake AI, real malware: Attackers impersonating AI brands A year of MDR casework shows attackers repeatedly exploiting demand for AI tools AI blog SOPHOS

22.8.26

 Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace and defense, governments and think tanks across Europe, as well as academia and think tanks within the United States.  APT blog GTI
22.8.26 Staying Ahead of Adversarial AI Through Agentic Source Code Review Adversarial misuse of AI has increased the risk of data theft and extortion events, because when proprietary source code is exposed, defenders must scramble to identify and patch vulnerabilities while attackers deploy machine-speed AI tools against them. AI blog GTI

22.8.26

 CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. Vulnerebility blog Eclypsium
22.8.26 Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Campaign Timeline Initial Findings Looking into the Decoy Document Technical Analysis Stage 1 CyberCrime blog Seqrite

22.8.26

 Endpoint Blind Spots: The 5 Places Ransomware Hides Before It Detonates Discover ransomware attack vectors hiding in endpoint blind spots, including remote access tools, credentials, vendors, OT systems and phishing. Hacking blog Cyble

22.8.26

 When the Attacker Wears Your Logo: Detecting and Taking Down Impersonation at AI Speed AI-powered impersonation can damage brands in minutes. Learn how monitoring and rapid takedowns help detect threats and protect customer trust. Hacking blog Cyble
22.8.26 Brand Impersonation Takedown: From Whack-a-Mole to Managed Response Manual brand impersonation takedowns fail because attackers move faster than ticket-based abuse reports can resolve. Solution? Managed takedowns. Security blog Cyble

22.8.26

 Ransomware Threats in the Americas H1 2026: Dissecting the Regional Attack Patterns and Dominant Actors The Americas carried the heaviest ransomware burden of any region on the planet in the first half of 2026 with 2,188 attacks. Ransom blog Cyble
22.8.26 A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace We found a custom Windows backdoor on a single corporate workstation while hunting for unusual WMI persistence. The malware was small, had a limited command set and disguised itself as legitimate Realtek software. Its most unusual feature was its configuration: the address of its command-and-control server was not stored as readable text or encrypted data, but encoded in the number of spaces on each line of a Windows `desktop.ini` file. Malware blog GENDIGITAL

22.8.26

  WordlistLoader Delivering Amatera via ClearFake Campaigns Over the past few months, Amatera Stealer (also often referred to as ACR Stealer) has been actively developed and has gradually become one of the most prevalent infostealer in our user base. Most recently, we've been observing Amatera being distributed via ClearFake campaigns leveraging FakeCaptchas. Malware blog GENDIGITAL

22.8.26

 9Router Tailscale Install Endpoint Unauthenticated OS Command Injection SonicWall Capture Labs threat research team became aware of the threat CVE-2026-59800, assessed its impact, and developed mitigation measures. The flaw, also known as the 9Router Tailscale Install Endpoint Unauthenticated OS Command Injection, is a critical vulnerability affecting the 9Router AI request proxy (decolua/9router, distributed on npm as 9router) in all versions up to and including 0.4.39, which NVD expresses as any version before 0.4.44. Hacking blog SonicWall
22.8.26 Efimer Brings Its Own Tools to the Job This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of Efimer malware. This is a Python-based executable compiled with PyInstaller and protected with PyArmor to obfuscate the many libraries and payloads that are packed within. Efimer has extensive anti-analysis capabilities and, when executed, uses geo-IP information to identify Tor network connections for data exfiltration. Cyber blog SonicWall

22.8.26

 Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) Identity has effectively become the new perimeter, where cybercriminals are increasingly choosing to log in rather than break in. To accomplish this, attackers frequently gather previously leaked username and password pairs. Gathering these credentials can then allow them to pivot to password spraying against services exposed to the internet, gaining credentials for other products and services. Hacking blog Palo Alto
22.8.26 Identity Abuse Through Trusted Communication Channels Identity has become a primary security boundary for most organizations, reducing the ability to solely trust other boundaries once associated with corporate networks. Users authenticate to cloud services using enterprise identities that provide access to collaboration platforms, business applications and sensitive data. With the adoption of software-as-a-service (SaaS) on the rise, people are shifting to platforms for communication and collaboration. Cyber blog Palo Alto

22.8.26

 Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using them to spread the malware, control infected machines, and store stolen documents, screenshots, and activity logs (records created by malware to track its actions, progress, or status during execution). Cyber blog CHECKPOINT
22.8.26 BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver could be instructed to execute arbitrary file and registry operations from Ring 0 – without exploits, vulnerabilities, or memory corruption? Cyber blog CHECKPOINT

22.8.26

 Describing attacks with crime script analysis Martin explores how using crime script analysis to describe an attack with everyday language makes the situation accessible to non-technical audiences and identify points where the crime can be disrupted. Cyber blog CISCO TALOS
22.8.26 Is Cyber missing the Marque? In this week's newsletter, new author Mick Baccio introduces himself and explores the operational and security implications of the new White House memorandum regarding private sector participation in government-authorized offensive cyber operations. Cyber blog CISCO TALOS

22.8.26

 UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities The newly identified SPECTRE implant represents an evolution in commodity intrusion tooling, integrating cross-platform C2 operations, process injection, credential theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality. APT blog CISCO TALOS
22.8.26 UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics. APT blog CISCO TALOS
22.8.26 How QR-code phishing can slip past corporate security measures Quishing has become a popular alternative to traditional phishing. Here’s how businesses can close the gap. Phishing blog Eset

22.8.26

 Black Hat USA 2026: Will vulnerability discovery eventually decline in the AI era? And will today’s surge in AI-driven vulnerability discovery eventually make tomorrow’s software safer? AI blog Eset
22.8.26 Black Hat USA 2026: What the Hugging Face hack tells us about human responsibility The incident involving OpenAI models shows that autonomous hacks make human oversight more important, not less AI blog Eset

22.8.26

 Black Hat USA 2026: AI is racing ahead of cybersecurity controls AI took center stage, but the clearest lesson was less about what AI can do than about who is accountable when something goes wrong AI blog Eset
22.8.26 Are AI tutors safe for your kids? AI tutors can offer useful support, but their quality and safeguards vary widely. Here’s what parents should check before handing one to a child. AI blog Eset

22.8.26

 When Agents Go Rogue: The OpenClaw Supply Chain Crisis This comprehensive technical report provides an in-depth analysis of some of these attack vectors, the supply chain poisoning, profiles the threat actors involved, details about the NovaStealer payload, maps the attacks to the MITRE ATT&CK framework, and provides actionable, enterprise grade mitigation strategies. Hacking blog TRELLIX
22.8.26 Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation This blog continues the series exploring NTDS.dit credential theft, building on our earlier work. In this analysis, we examine the underlying methodologies used in these attacks and how Trellix Helix identifies them. We will highlight the Advanced Correlation Engine (ACE)'s capability to consolidate telemetry from policy, network, and endpoint sources. Exploit blog TRELLIX
21.8.26 CVE-2021-24092 Microsoft Defender Elevation of Privilege Vulnerability VULNEREBILITY VULNEREBILITY

21.8.26

 Calix GS7 XGS GS5239XG  residential router contains missing authentication vulnerability The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) WANIPConnection service on the public WAN interface. ALERT ALERT

21.8.26

 Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows OS The Hacker News

21.8.26

 Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware Virus The Hacker News

21.8.26

 Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0 Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued Vulnerebility The Hacker News

21.8.26

 Calix GS7 XGS GS5239XG  residential router contains missing authentication vulnerability The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) WANIPConnection service on the public WAN interface. ALERT ALERT

21.8.26

 CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability KEV KEV
21.8.26 CVE-2026-72530 TrueConf Server Code Injection Vulnerability KEV KEV

21.8.26

 The invisible passenger in your car Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet. It’s delivered through legitimate software for DoFun head units. Virus SECURELIST

21.8.26

 CVE-2026-69836 Microsoft Entra ID Remote Code Execution Vulnerability VULNEREBILITY VULNEREBILITY
21.8.26 Defending Against an Active Threat to Siemens S7 Series PLCs This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape. ICS ICS

21.8.26

 GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The Vulnerebility The Hacker News

21.8.26

 Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no Exploit The Hacker News

21.8.26

 Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published Virus The Hacker News

21.8.26

 Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. These clusters include UNC6293 , UNC7005 , and UNC5976 . APT The Hacker News

21.8.26

 AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure The U.S. government on Wednesday warned of an "active threat" targeting critical infrastructure organizations in the country using artificial AI The Hacker News

20.8.26

 Zero-click Grok data theft Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories INCIDENT INCIDENT

20.8.26

 Bypassing Prompt Guards in Production with Controlled-Release Prompting Ball et al. recently established that prompt filtering for AI alignment faces a fundamental barrier: under standard cryptographic assumptions, no filter running significantly faster than the protected model can universally distinguish adversarial prompts from benign ones. We investigate whether this impossibility result translates to real-world vulnerabilities in deployed large language model (LLM) systems. PAPERS PAPERS

20.8.26

 Cryptographic Payload Injection Cryptographic Payload Injection: A Novel Jailbreak Technique Against Gemini HACKING AI

20.8.26

 CVE-2026-19490 Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21. VULNEREBILITY VULNEREBILITY

20.8.26

 CVE-2026-19489 Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21. VULNEREBILITY VULNEREBILITY

20.8.26

 CVE-2026-73570 A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. VULNEREBILITY VULNEREBILITY

20.8.26

 RDK-B WebUI contains multiple vulnerabilities RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. ALERT ALERT

20.8.26

 CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability KEV KEV

20.8.26

 Zombie Credit Cards Attack When Zombie Credit Cards Attack: UMass Researchers Discover Loophole That Can Reanimate Expired Cards HACKING HACKING

20.8.26

 XRING XRING: Crashing XQUIC with spec-compliant QPACK instructions HACKING HACKING

20.8.26

 CDN Tsunami: Exploiting HTTP/3-HTTP/1.1
Conversion for DoS Attacks		 Content Delivery Networks (CDNs) provide high availability, accelerate content delivery for their host websites, but are also vulnerable to different types of Denial-of-Service (DoS) attacks. Prior works have studied a variety of DoS attacks with HTTP/1.1 or HTTP/2 connections, but most of them are being fixed, making CDNs robust against such attacks. PAPERS PAPERS

20.8.26

 Manic Manic: Blend between Banking Malware & Spyware MALWARE BANKING

20.8.26

 ToxicPanda The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile MALWARE ANDROID

20.8.26

 GoldDigger Striking gold: Inside the GoldDigger Android malware MALWARE ANDROID

20.8.26

 CVE-2026-69414 Microsoft Defender Elevation of Privilege Vulnerability VULNEREBILITY VULNEREBILITY

20.8.26

 CVE-2026-32475 Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1. VULNEREBILITY VULNEREBILITY

20.8.26

 Dynamic Process Isolation In the quest for efficiency and performance, edgecomputing providers eliminate isolation boundaries between tenants, such as strict process isolation, and instead let them compute in a more lightweight multi-threaded single-process design. Edgecomputing providers support a high number of tenants per machine to reduce the physical distance to customers without requiring a large number of machines. Isolation is provided by sandboxing mechanisms, e.g., tenants can only run sandboxed V8 JavaScript code. PAPERS PAPERS

20.8.26

 Remote-Timer-as-a-Service: Efficient Microarchitectural Leakage
in the Cloud with Remote Timers		 Edge computing solutions have become a crucial part of the industry, delivering fast, flexible and scalable applications close to the end users, with typical use cases including dynamic content creation, image resizing and chatbots. Cloudflare Workers is onesuch framework, which handles millions of HTTP requests per second across the world. PAPERS PAPERS

20.8.26

 New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page. Hack The Hacker News

20.8.26

 Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE Cybersecurity researchers have disclosed a critical security flaw in isolated-vm , a popular open-source sandbox with more than 2,900 stars and 190 forks on GitHub, that could allow attackers to escape the confines Vulnerebility The Hacker News

20.8.26

 Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical- Vulnerebility The Hacker News

20.8.26

 Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Exploit The Hacker News

20.8.26

 Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale Hack The Hacker News

20.8.26

 CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks that exploit how major content delivery networks (CDNs) convert Attack The Hacker News

20.8.26

 Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and Virus The Hacker News

20.8.26

 NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue Security The Hacker News

20.8.26

 ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements," Virus The Hacker News

20.8.26

 40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, Hack The Hacker News

20.8.26

 Pokémon Center data breach exposes customer info, cancels some orders Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information from third-party logistics provider CEVA Logistics. Incindent BleepingComputer

20.8.26

 Microsoft confirms GitHub is down worldwide GitHub is down for some users as a widespread outage is causing errors across the website, API, Actions, Pull Requests, and several other services. Security BleepingComputer

20.8.26

 Windows Server 2022 reaches end of mainstream support in 60 days Microsoft has reminded IT administrators that Windows Server 2022 is rapidly approaching its mainstream end date of October 2026, when it will switch to extended support. OS BleepingComputer

20.8.26

 Philips and GE investigating Clop ransomware data theft claims Tech giants General Electric (GE) and Philips have also confirmed they're investigating claims that the Clop ransomware gang breached their systems and stole data Ransom BleepingComputer

20.8.26

 French tax authority data breach affects 678,000 individuals The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals. Incindent BleepingComputer

20.8.26

 Microsoft working on Defender patch for ShieldBreak zero-day Microsoft is working on a security patch for the "ShieldBreak" zero-day vulnerability disclosed last week by security researcher "Nightmare Eclipse" and now tracked as CVE-2026-69414. OS BleepingComputer

20.8.26

 SafePal data breach impacts 39,798 customers, stolen info for sale Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data. Cryptocurrency BleepingComputer

20.8.26

 Anthropic confirms Claude is down in major outage affecting multiple services Claude is experiencing a major outage, with users reporting login problems and degraded performance across several Anthropic services. AI BleepingComputer

20.8.26

 Telegram Applied for .gram: What It Means for the Threat Landscape Telegram has applied for the .gram top-level domain through ICANN’s 2026 round. If approved, Telegram usernames could become web-addressable domains with AI-generated websites. Social SOCRADAR

20.8.26

 Can NVD Modernization Keep Pace With AI? AI can help security teams find vulnerabilities faster. That sounds entirely positive until we consider what happens after those vulnerabilities are found. Every new finding still needs to be validated, enriched, prioritized, communicated, and eventually fixed. Vulnerebility SOCRADAR

20.8.26

 Critical vm2 Vulnerability Allows Host DNS Hijacking and Information Disclosure vm2’s sandbox denylist forgot two modules: “os” and “dns.” Under the wildcard config vm2’s own docs recommend, that gap lets sandboxed code read the host process owner’s identity and hijack the host’s DNS with a single call — a change that outlives the sandbox run and never notifies the embedder. Patched in 3.11.6. Vulnerebility OX

20.8.26

 Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directive Two flaws in GitLab’s GraphQL API: one lets any user wipe or alter public projects and user data, the other quietly runs changes using a logged-in user’s own permissions. Self-managed instances from 18.2 through 19.2 need to upgrade now. Vulnerebility OX

20.8.26

 Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases in which attackers targeted web servers in Korea to install SoftEther VPN. Attack cases involving the installation of SoftEther VPN, an open-source VPN, were previously discussed in the 2024 ASEC blog post titled “Analysis of Attack Cases Targeting ERP Servers in Korea to Install SoftEther VPN”. Virus AHNLAB

20.8.26

 Beware of phishing emails disguised as requests to review quotes (PhantomStealer) The AhnLab SEcurity intelligence Center (ASEC) recently identified a phishing email campaign that disguised itself as a request to review a quote. The threat actor impersonated a sales team member at a specific overseas company and, by claiming that a previous quote needed to be revised and product versions verified, tricked recipients into opening the Attachment. Virus AHNLAB

20.8.26

 Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead Vulnerebility The Hacker News

20.8.26

 Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) Attack The Hacker News

20.8.26

 OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior OpenAI on Tuesday revealed that it paused reinforcement learning ( RL ) training for its latest artificial intelligence (AI) models for two weeks while AI The Hacker News

20.8.26

 Cisco Crosswork Security Hardening Release: August 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. VULNEREBILITY VULNEREBILITY

20.8.26

 Cisco Secure Workload Software Security Hardening Release: August 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. VULNEREBILITY VULNEREBILITY

20.8.26

 Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. VULNEREBILITY VULNEREBILITY

20.8.26

 Cisco Unified Intelligence Center SQL Injection Vulnerability A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. VULNEREBILITY VULNEREBILITY

20.8.26

 Cisco RoomOS Stack Overflow Vulnerability A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges. VULNEREBILITY VULNEREBILITY

20.8.26

 Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. VULNEREBILITY VULNEREBILITY

20.8.26

 Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an unauthenticated, remote attacker to cause the device manager, SSH, or API to become inaccessible. VULNEREBILITY VULNEREBILITY

20.8.26

 Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. VULNEREBILITY VULNEREBILITY

19.8.26

 StealNui - a new Linux RAT variant Security researchers at ExaTrack report on StealNui, an emerging C++-based Remote Access Trojan (RAT) crafted for Linux platforms. The malware provides operators with extensive espionage and surveillance functionality. Its toolkit includes screen capture utilities, a keystroke logger, reverse shell access, local file exfiltration, and arbitrary remote command execution and a cryptocurrency clipper module. ALERTS VIRUS

19.8.26

 JWR PhaaS In a recent write-up, Cisco Talos details an undocumented phishing framework dubbed JWR, which is built to impersonate major payment and e-commerce platforms. Delivered primarily through SMS lures disguised as postal and toll authorities in Southeast Asia and the Middle East, the framework operates as a highly interactive, real-time threat rather than a static credential harvester. ALERTS PHISHING

19.8.26

 QUICAgent Backdoor Hidden in VHD Lures Researchers at Seqrite recently reported a campaign orchestrated by a China-nexus threat actor targeting Myanmar's government and IT sectors. Dubbed Operation QUICSILVER, the attacks single out diplomats and officials by using deceptive Burmese-language graduation ceremony invitations packaged inside Virtual Hard Disk (VHD) files. ALERTS VIRUS

19.8.26

 Lucid Stealer malware Lucid Stealer is a sophisticated information-harvesting malware variant promoted through Telegram that masquerades as a legitimate Node.js JavaScript runtime. Upon execution, the malware deploys native modular components to conduct data harvesting operations. ALERTS VIRUS

19.8.26

 A new C2Looper backdoor variant identified Kaspersky’s GReAT team has identified a major upgrade to the CoolClient backdoor, used by the Mustang Panda (aka HoneyMyte) APT group against government and corporate targets across Asia and Russia. Deployed alongside PlugX, CoolClient is sideloaded via a legitimate Sangfor application, executes an RPC-based privilege escalation, and injects into a suspended system process. ALERTS VIRUS

19.8.26

 Defending Against an Active Threat to Siemens S7 Series PLCs This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape. IC3 IC3

19.8.26

 NodeEdgeRAT (JavaScript), which ships its entire functionality spanning command execution, file management, and file transfer in one script. MALWARE RAT

19.8.26

 GoginRAT (Go), which has architectural similarities with NomadRAT and uses a separate transmitter for C2, and implements file system and shell capabilities as independent plugins. The results of the plugin execution are routed through a shared callback. MALWARE RAT

19.8.26

 NomadRAT (C++), which features a main orchestrator, a dedicated transmitter library that handles all C2 traffic, and plugins fetched from the server by numeric identifiers only when they are required. MALWARE RAT

19.8.26

 CookiETagRAT (C++), which uses HTTP Cookie / ETag response headers as C2 to receive and execute commands. MALWARE RAT

19.8.26

 DriveSilkRAT (.NET/C++), which uses Google Drive as command-and-control (C2) to poll a specific folder for tasking, run it through an in-memory .NET plugin system, and upload the results of the execution back to the same folder. It supports 12 plugins for process listing, system and network enumeration, file management, and command execution. MALWARE RAT

19.8.26

 SilkParasite SilkParasite: Tracking a China-Nexus APT Across Central Asia APT APT

19.8.26

 CVE-2025-31702 A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. VULNEREBILITY VULNEREBILITY

19.8.26

 CVE-2021-33044 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. VULNEREBILITY VULNEREBILITY

19.8.26

 CVE-2024-39943 rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js). VULNEREBILITY VULNEREBILITY

19.8.26

 Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using them to spread the malware, control infected machines, and store stolen documents, screenshots, and activity logs (records created by malware to track its actions, progress, or status during execution). Hack CHECKPOINT

19.8.26

 SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The APT The Hacker News

19.8.26

 Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication- CyberCrime The Hacker News

19.8.26

 StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to Virus The Hacker News

19.8.26

 Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, stating they are being exploited in the wild. Exploit The Hacker News

19.8.26

 MacSync Stealer On 5 May 2026, an RST Cloud customer’s Jamf Protect blocked a download from jacksonvillemma[.]com. Four days earlier, the operator’s prior MacSync C2 had been publicly disclosed. Twenty-four hours after that disclosure, the new C2’s TLS certificate had been issued. Three days later, the new C2 was attempting to deliver its loader to a managed endpoint in our customer’s estate. MALWARE STEALER

19.8.26

 PurpleDelta's Fraudulent Employment Operations PurpleDelta operates at an industrial scale, using at least 22 personas to apply to over 1,100 companies and submitting more than 60 applications per day. REPORT REPORT

19.8.26

 Operation CameraSwarm Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia OPERATION OPERATION

19.8.26

 Hunting MacSync Stealer infrastructure through behavioral pivots MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure. Virus Microsoft blog

19.8.26

 StubMaker RubyGems Campaign Delivers a Windows Infostealer On August 15, 2026, we discovered newly-published RubyGems packages that installs a multi-stage Windows infostealer malware. This new malware harvests browser credentials, cryptocurrency wallets, seed phrases, and Telegram data. Virus OPENSOURCE MALWARE

19.8.26

 Anatomy of a High-Profile Data Breach:
Dissecting the Aftermath of a Crypto-Wallet Case		 Media reports show an alarming increase of data breaches at providers of cybersecurity products and services. Since the exposed records may reveal security-relevant data, such incidents cause undue burden and create the risk of revictimization to individuals whose personal data gets exposed. PAPERS PAPERS

19.8.26

 Clop Returns with Custom Implant in Mass-Extortion Campaign “Clop's” exploitation of CVE-2026-12569 in PTC Windchill has returned the group to mass exploitation, delivering a custom web shell that provides full data-theft capability from the moment of deployment, with no additional tooling required. Ransom RELIAQUEST

19.8.26

 Hunt Malware & Phishing Threats with ANY.RUN for Proactive Enterprise Security One of the biggest challenges for every threat hunter is navigating endless alerts, scattered indicators, behavioral evidence, and infrastructural context. Data collection is just the first step – but how do you turn it into findings that lead to proactive protection against malware and phishing? Security ANYRUN BLOG

19.8.26

 Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle (AiTM) attacks. Phishing ANYRUN BLOG

19.8.26

 PurpleDelta's Fraudulent Employment Operations Insikt Group has identified several clusters of activity linked to PurpleDelta, Recorded Future's designation for North Korean IT workers, comprising multiple operators likely based in China. Between late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors. APT Recorded Futures

19.8.26

 Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia Disclosure note: The relevant national CERTs were notified on 10 August 2026, and Dahua's PSIRT was notified regarding the issues that affect devices in all countries observed in this campaign. We appreciate Dahua PSIRT's engagement in reviewing parts of this research ahead of publication. Publication was held until 18 August 2026 under TLP:AMBER. BigBrothers HUNT.IO

19.8.26

 CVE-2026-65400 Apple macOS Improper Authentication Vulnerability: Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. ECV ECV

19.8.26

 CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability: Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. ECV ECV

19.8.26

 CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability: Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. ECV ECV

19.8.26

 CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability: Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. ECV ECV

19.8.26

 #StopRansomware: Medusa Ransomware Medusa is a ransomware-as-a-service (RaaS) variant first identified in June 2021. As of April 2026, Medusa developers and affiliates—referred to as “Medusa actors” in this advisory—have impacted over 500 victims from a variety of critical infrastructure sectors. Affected industries include medical, education, legal, insurance, technology, and manufacturing. Per FBI, the Medusa ransomware variant is unrelated to the MedusaLocker variant and the Medusa mobile malware variant. IC3 IC3

19.8.26

 #StopRansomware: Medusa Ransomware Medusa is a ransomware-as-a-service (RaaS) variant first identified in June 2021. As of April 2026, Medusa developers and affiliates—referred to as “Medusa actors” in this advisory—have impacted over 500 victims from a variety of critical infrastructure sectors. Affected industries include medical, education, legal, insurance, technology, and manufacturing. Per FBI, the Medusa ransomware variant is unrelated to the MedusaLocker variant and the Medusa mobile malware variant. RANSOM RANSOM

19.8.26

 943 Patches Rolled Out With Oracle’s August 2026 Security Update The fixes resolve over 1,000 vulnerabilities across two dozen products, including over 460 remotely exploitable bugs. Vulnerebility SECURITYWEEK

19.8.26

 Chrome, Firefox Updates Patch Dozens of Vulnerabilities The bugs could lead to code execution, privilege escalation, sandbox escape, and information disclosure. Vulnerebility SECURITYWEEK

19.8.26

 Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains Microsoft tracked over 30 MacSync Stealer domains by focusing on behavioral patterns, revealing a campaign targeting passwords, keys, wallets and other data. Virus SECURITYAFFAIRS

19.8.26

 Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating Virus The Hacker News

19.8.26

 Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically ICS The Hacker News

19.8.26

 MAJINAHANASHI RANSOMWARE This is the initial intelligence gathering and analysis based on the newly found IOCs of Ransomware and also uncovered new File Servers and Communication Channel of the Group. RANSOM RANSOM

19.8.26

 CRPX0 Ransomware CRPX0 Ransomware Group, releasing samples (which has not yet been public as of now) and uncovering a Scam Service which was running by the same group, before launching Ransomware Program. RANSOM RANSOM

19.8.26

 TENGU RANSOMWARE This is the initial report of Tengu Ransomware. New Information was last added on 16th March 2026. RANSOM RANSOM

19.8.26

 CVE-2026-24301 Microsoft Copilot Information Disclosure Vulnerability VULNEREBILITY VULNEREBILITY

19.8.26

 CVE-2026-64849 (CVSS score: 9.3) - An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow that can allow an attacker who can reach the Tracking Server (mlflow server) to issue HTTP requests to arbitrary internal cloud metadata endpoints and extract sensitive data. (Affects versions < 3.15.0) VULNEREBILITY VULNEREBILITY

19.8.26

 CVE-2026-25895 (CVSS score: 9.5) - A missing authentication for a critical function and path traversal vulnerability in FUXA that can allow an unauthenticated, remote attacker to write arbitrary files to the server file system and achieve remote code execution. (Affects versions <= 1.2.9) VULNEREBILITY VULNEREBILITY

19.8.26

 CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability KEV KEV

19.8.26

 CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability KEV KEV

19.8.26

 CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability KEV KEV

19.8.26

 CVE-2026-65400 Apple macOS Improper Authentication Vulnerability KEV KEV

19.8.26

 AgentWorm: Self-Propagating Attacks Across
LLM Agent Ecosystems		 Autonomous LLM-based agents increasingly operate as long-running processes forming densely interconnected multiagentecosystems, whose security properties remain largely unexplored. Systems such as OpenClaw, an open-source platform with over 40,000 active instances, persistent configurations, toolexecution privileges, and cross-platform messaging, are deployed at scale, yet the security of such agent ecosystems remains largely unexplored. PAPERS PAPERS

19.8.26

 PROMPT INFECTION: LLM-TO-LLM PROMPT INJECTION WITHIN MULTI-AGENT SYSTEMS As Large Language Models (LLMs) grow increasingly powerful, multi-agent systems—where multiple LLMs collaborate to tackle complex tasks—are becoming more prevalent in modern AI applications. Most safety research, however, has focused on vulnerabilities in single-agent LLMs PAPERS PAPERS

19.8.26

 Thought Virus: Viral Misalignment via Subliminal Prompting
in Multi-Agent Systems		 Subliminal prompting is a phenomenon inwhich language models are biased towards certain concepts or traits through prompting with semantically unrelated tokens. While prior work has examined subliminal prompting in user-LLMinteractions, potential bias transfer in multi-agent systems and its associated security implications remain unexplored. PAPERS PAPERS

19.8.26

 Mind Viruses: Self-Propagating Ideas in Multi-Agent
LLM Systems		 AI agents are becoming more autonomous and increasingly interconnected, exposing them to new emergent risks arising from agent-to-agent interaction. One such risk is the spread of mind viruses: ideas or goals that propagate through multiagent systems by inducing the agents that adopt them to transmit them onward. PAPERS PAPERS

19.8.26

 Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to AI The Hacker News

19.8.26

 Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / Exploit The Hacker News

19.8.26

 Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000 A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete Ransom The Hacker News

19.8.26

 AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files Security researchers at Anthropic and Switzerland's EPFL have demonstrated that self-propagating payloads can spread from one AI The Hacker News

18.8.26

 Mustang Panda Updates CoolClient Backdoor with Rootkit Kaspersky’s GReAT team has identified a major upgrade to the CoolClient backdoor, used by the Mustang Panda (aka HoneyMyte) APT group against government and corporate targets across Asia and Russia. Deployed alongside PlugX, CoolClient is sideloaded via a legitimate Sangfor application, executes an RPC-based privilege escalation, and injects into a suspended system process. ALERTS APT

18.8.26

 Majinahanashi Ransomware Researchers at The Raven File recently reported a new ransomware family known as Majinahanashi, marking the emergence of another Japanese-themed extortion group. ALERTS RANSOM

18.8.26

 ClickFix Lures Drop CNCMachineRMS RAT LevelBlue SpiderLabs has published a report on a previously undocumented remote administration tool named CNCMachineRMS, distributed through a deceptive ClickFix lure. The infection flow abuses a legitimately signed IBM executable to activate a sequence of decoy dynamic link libraries, ultimately executing a BabaDeda shellcode loader. ALERTS VIRUS

18.8.26

 Gh0st RAT malware distribution continues to be observed in the wild The researchers from Checkpoint recently presented an update on ongoing malicious deployments of the Gh0st RAT, which is a well known Remote Access Trojan designed to grant cybercriminals covert, full-scale surveillance and unauthorized control over compromised endpoints. ALERTS VIRUS

18.8.26

 Evooo1Bot Linux botnet Discovered by FortiGuard Labs, Evooo1Bot is an emerging Linux malware family named after a hardcoded string embedded in its binaries. Active against internet-exposed systems across multiple regions since at least July 2026, the botnet expands upon Mirai’s leaked DDoS engine with a sophisticated, modular toolset. ALERTS BOTNET

18.8.26

 Project CAV3RN abuses trusted Google infrastructure for resilient espionage Project CAV3RN is an evolving cyberespionage framework distinguished by its modular architecture and stealthy communication methods. Recent intelligence presented by the researchers from Securelist reveals the attackers leveraging command-and-control mechanism orchestrated through a 64-bit .NET 8 NativeAOT module. ALERTS HACKING

18.8.26

 PATCHCORD Malware Cluster Targets Telecom and Critical Infrastructure A new campaign documented by Acronis Threat Research Unit reveals an ongoing cyber espionage cluster targeting Afghan telecommunications providers and government, defense, and energy organizations across South Asia. ALERTS VIRUS

18.8.26

 CVE-2025-62593 Ray-Project Ray Code Injection Vulnerability: Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. ECV ECV

18.8.26

 CVE-2026-72898 Metabase SQL Injection Vulnerability: Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. ECV ECV

18.8.26

 CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability: Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. ECV ECV

18.8.26

 CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. ECV ECV

18.8.26

 16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. Cryptocurrency The Hacker News

18.8.26

 One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025 A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than Security The Hacker News

18.8.26

 SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone Incindent The Hacker News

18.8.26

 The Gentlemen ransomware: Inside one of the fastest-growing extortion operations The Gentlemen grew from affiliate roots into a major ransomware brand. The group's operators appear to have leveraged relationships, expertise, and credibility developed as the ArmCorp affiliate team to accelerate growth after launching their own ransomware-as-a-service (RaaS) operation. Ransom BARRACUDA

18.8.26

 Italy RDWeb Access, GBCSA Data Sale, SCHUFA Claim, and FLY Firebase Exposure SOCRadar Dark Web Team identified several new underground posts involving alleged initial access sales and large-scale data exposure. The findings include an alleged RDWeb access listing for an Italian cloud and IT services provider, a claimed GBCSA database sale, an alleged BullyPedex customer and payment dataset, a major SCHUFA credit data claim, and an alleged Firebase-related exposure affecting the Korean food-delivery platform FLY. CyberCrime SOCRADAR

18.8.26

 Closing the IT/OT Gap: GreyMatter’s OT Engineer Teammate Is Here Industrial environments face a security challenge that traditional tools were never built to solve. IT and OT networks are managed by separate teams with competing priorities—IT protects data, OT keeps production running—yet attacks cross between them without friction. Security RELIAQUEST

18.8.26

 The OWASP LLM Top 10 Was the Warm-Up: What Comes Next When the OWASP Top 10 for LLM Applications arrived, it did the industry a real service. It gave security teams a stable, vendor-neutral vocabulary for a threat surface that was moving too fast to describe. AI IMPERVA

18.8.26

 C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 In July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain. Ransom Zscaler

18.8.26

 CVE-2026-19650 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling. VULNEREBILITY VULNEREBILITY

18.8.26

 CVE-2026-19478 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive. VULNEREBILITY VULNEREBILITY

18.8.26

 CVE-2025-62593 Ray-Project Ray Code Injection Vulnerability KEV KEV

18.8.26

 Operation ASTERIX Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline OPERATION OPERATION

18.8.26

 CVE-2026-15748 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device. VULNEREBILITY VULNEREBILITY

18.8.26

 APT42 APT42: AI-Assisted Rapport Phishing and a More Resilient TAMECAT AI AI

18.8.26

 HOLLOWGRAPH HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels MALWARE MALWARE

18.8.26

 CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerebility The Hacker News

18.8.26

 Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software Vulnerebility The Hacker News

18.8.26

 Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public Hack The Hacker News

18.8.26

 Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could Vulnerebility The Hacker News

18.8.26

 Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Hack The Hacker News

17.8.26

 CVE-2007-3010 Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 CVE-2016-6277 NETGEAR Multiple Routers Remote Code Execution Vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 CVE-2018-14558 Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 CVE-2019-14931 Mitsubishi Electric Europe B.V. ME-RTU devices and INEA ME-RTU devices remote Command Injection vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 CVE-2020-10987 Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 CVE-2021-46422 Telesquare SDT-CW3B1 Command Injection vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 CVE-2022-37055 D-Link Routers Buffer Overflow Vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 CVE-2024-29269 Telesquare TLR-2005KSH Command Injection Vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 CVE-2025-10123 D-Link DIR-823X Command Injection Vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 CVE-2025-55583 D-Link DIR-868L B1 router Command Injection Vulnerability VULNEREBILITY VULNEREBILITY

17.8.26

 Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the OS The Hacker News

17.8.26

 Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from BotNet The Hacker News

17.8.26

 Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China- APT The Hacker News

17.8.26

 Large-scale DDoS attacks disrupted Threema secure messaging service Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service earlier this week, causing severe disruptions to communications. Attack BleepingComputer

17.8.26

 New AmnesiaStealer macOS malware hijacks browser sessions via remote control A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. Virus BleepingComputer

16.8.26

 The Jewelbug Dossier China-based hackers-for-hire group staging espionage attacks alongside a cryptocurrency fraud business. REPORT REPORT

16.8.26

 CVE-2026-12569 A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. VULNEREBILITY VULNEREBILITY

16.8.26

 Hackers exploit macOS Screen Sharing flaw to deploy Monero miner The Netherlands' National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged. Exploit BleepingComputer

16.8.26

 The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI Google Workspace attacks do not always begin with phishing. Stolen OAuth tokens can provide another path into Gmail, Drive, and connected systems. Material Security explains why organizations need defenses that cover the entire Workspace attack chain. AI BleepingComputer

16.8.26

 Max severity SAP Commerce Cloud flaw now targeted in attacks A maximum-severity SAP Commerce Cloud remote code execution vulnerability patched three days ago is already being targeted in attacks, according to threat intelligence company Defused. Vulnerebility BleepingComputer

16.8.26

 Shell investigates 'potential incident' after Clop data theft claims Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed it stole 89GB of data. Ransom BleepingComputer

16.8.26

 RingCentral data breach exposed info of 1.6 million accounts The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned. Incindent BleepingComputer

16.8.26

 Data analyst sent to prison for stealing data, extorting employer A former data analyst contractor for Brightly Software has been sentenced to two years in prison for targeting his employer in a $2.5 million extortion scheme. Incindent BleepingComputer

16.8.26

 Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks You're not alone if you just received an "Apple Threat Notification" saying it detected a "mercenary spyware attack targeted at your iPhone." Mobil BleepingComputer

16.8.26

 Ukraine shuts down 94 fraudulent call centers, seize millions in cash Authorities in Ukraine shut down 94 fraudulent call centers across the country that lured people into investment scams or tried to obtain access to bank accounts. CyberCrime BleepingComputer

16.8.26

 Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. Ransom BleepingComputer

16.8.26

 Hackers breach govt webmail while running parallel crypto fraud The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. Cryptocurrency BleepingComputer

16.8.26

 Microsoft patches LegacyHive Windows zero-day vulnerability Microsoft has released security patches to address a Windows zero-day vulnerability known as "LegacyHive," disclosed after the July 2026 Patch Tuesday. Vulnerebility BleepingComputer

16.8.26

 AI 'watermark removers' flood the web. Almost none can prove they work. Multiple 'watermark removers' have surfaced days after Anthropic began watermarking text generated by Claude, including an open source project with over 4,500 GitHub stars and paid AI detection evasion services. None of the tools' claims about defeating the text watermark can be verified, as Anthropic has not released a detector. AI BleepingComputer

16.8.26

 Critical VMware vCenter RCE flaw exploited for reverse SSH access A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being exploited in an active campaign to deploy a reverse SSH tool for persistence and remote access. Vulnerebility BleepingComputer

16.8.26

 Trezor discloses data breach affecting nearly 14,000 customers Hardware wallet manufacturer Trezor disclosed a data breach affecting nearly 14,000 of its customers after ShipMonk, its shipping and logistics provider, was hacked Incindent BleepingComputer

16.8.26

 Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion AI coding tools can introduce unvetted or hallucinated open source dependencies faster than traditional security reviews can keep pace. ActiveState explains why organizations should govern packages at the point of selection, before they enter the development pipeline. AI BleepingComputer

16.8.26

 White House taps security firms for offensive hack-back operations A new White House memo signed by U.S. President Donald Trump instructs the National Coordination Center (NCC) to establish a program that would allow private security companies to apply for approval to hack foreign cybercrime organizations. BigBrothers BleepingComputer

16.8.26

 Plug&Pwn: Weaponizing
Windows PnP		 Every time a USB device is plugged into a Windows machine, the operating system may silently download a package from Microsoft and execute vendor code as NT AUTHORITY\SYSTEM. That can happen without administrator privileges, without a logged-on user, and in some environments even remotely through RDP USB redirection. ATTACK ATTACK

16.8.26

 CVE-2019-10617 Low privilege users can access service configuration which contains registry data that admins uses to create or delete entries in the registry in QCA6174_9377.WIN.1.0 in QCA6174_9377 VULNEREBILITY VULNEREBILITY

16.8.26

 WhatsApp rolls out new feature that flags potential scam messages WhatsApp has begun rolling out a new optional "Scam Alert" feature, which uses a local machine learning model to warn users when scammers are targeting them. Social BleepingComputer

16.8.26

 "City-Forum" data-theft attacks target Salesforce, ServiceNow portals An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals. Hack BleepingComputer

16.8.26

 Android malware combo takes out loans and relays victims' credit cards A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal live card data and send it to attackers in real time. Virus BleepingComputer

16.8.26

 Hackers exploit critical Adobe Commerce flaw to hijack customer accounts Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts. Exploit BleepingComputer

16.8.26

 Hundreds of fake Chrome VPN extensions route traffic through a proxy More than 737 browser extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing users' traffic through SOCKS5 proxies operated by a single provider. Hack BleepingComputer

16.8.26

 Plug and Pwn attack uses fake USB devices for Windows SYSTEM access Security researchers have disclosed new "Plug and Pwn" attacks that abuse the Windows Plug and Play feature to trigger Windows into installing vulnerable or insecure vendor software and gain SYSTEM privileges. Attack BleepingComputer

16.8.26

 Lazarus hackers exploited Windows zero-day to target defense firms North Korean hackers have been exploiting a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector companies as part of the Operation Dream Job campaign. APT BleepingComputer

16.8.26

 FBI: Hackers target online accounts to steal nude photos The FBI warns that cybercriminals are targeting adults' and children's social media and other online accounts to steal sexually explicit images or videos. CyberCrime BleepingComputer

16.8.26

 The Threat Hiding in Your Hiring Process: How Fake Remote Workers Get In Fake remote workers can exploit gaps between hiring checks, device delivery, and account access to enter organizations under false identities. Specops Software explains how document verification and biometric liveness checks can help organizations confirm that the person receiving access is the legitimate new hire. Security BleepingComputer

16.8.26

 Hackers leverage new Microsoft SharePoint exploit in attacks Hackers have already begun using a proof-of-concept (PoC) exploit for a critical Microsoft SharePoint vulnerability, published by cybersecurity company Rapid7 on Tuesday. Exploit BleepingComputer

16.8.26

 Signal adds new security feature to thwart man-in-the-middle attacks ​Signal has introduced Automatic Key Verification, a new security feature that gives users a new way to ensure their encrypted chats haven't been intercepted. Hack BleepingComputer

16.8.26

 New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldBreak" after Microsoft released the August 2026 Patch Tuesday security updates. Vulnerebility BleepingComputer

16.8.26

 Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse Google says Chrome's anti-abuse systems reduced unwanted notifications on Android by more than 7 billion per day during the first quarter of 2026. OS BleepingComputer

16.8.26

 DeadLock ransomware uses blockchain to resist infrastructure takedown The DeadLock ransomware operation is using a decentralized infrastructure that relies on blockchain-backed services to protect its communication with victims and data-leak activity. Ransom BleepingComputer

16.8.26

 Sandworm hackers target IT pros with trojanized WireGuard VPN client Hackers associated with the Russian threat group Sandworm have been targeting system administrators and IT professionals through fake job offers since at least May. APT BleepingComputer

16.8.26

 Cisco warns of ASA and FTD VPN flaw exploited to crash devices Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices. Exploit BleepingComputer

15.8.26

 Cloudflare DDoS Threat Report H1 2026 Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave ATTACK ATTACK

15.8.26

 CVE-2026-45659 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. VULNEREBILITY VULNEREBILITY

15.8.26

 CVE-2026-20337 A vulnerability in the zip archive parser of ClamAV could... VULNEREBILITY VULNEREBILITY

15.8.26

 Follow-Up Analysis of the 29 December 2025 Energy Sector Incident On 29 December 2025, coordinated attacks targeted the energy sector in Poland, including 30 renewable energy facilities and a large combined heat and power (CHP) plant. These attacks were described in detail in the report published on 30 January 2026*. At the same time, another incident occurred at a smaller CHP plant supplying heat to 50,000 residents. REPORT REPORT

15.8.26

 Delta probes Wi-Fi deauth attack on flight carrying DEF CON attendees Delta Air Lines is investigating an unauthorized Wi-Fi network that appeared aboard a flight from Las Vegas to Atlanta carrying passengers who had attended the DEF CON hacker convention. Incindent BleepingComputer

15.8.26

 Microsoft releases Windows 10 KB5120249 extended security update Microsoft has released Windows 10 KB5120249 Extended Security Updates for versions 22H2 and 21H2 to fix security vulnerabilities and bugs. OS BleepingComputer

15.8.26

 Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days Today is Microsoft's August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. OS BleepingComputer

15.8.26

 Windows 11 KB5121003 & KB5120240 cumulative updates released Microsoft has released Windows 11 KB5121003 and KB5120240 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features. OS BleepingComputer

15.8.26

 Wesco confirms security incident after ExfilSquad claims data theft Global supply chain and distribution giant Wesco has confirmed in a statement for BleepingComputer that it is investigating a cybersecurity incident. Incindent BleepingComputer

15.8.26

 Mozilla updates GPG signing key for Firefox releases after exposure Mozilla announced today that it updated the GPG key used to sign Firefox and Thunderbird releases after it was accidentally exposed on GitHub. Security BleepingComputer

15.8.26

 Vague Task, Total Access: When AI Delegation Becomes a Security Risk AI agents can improvise beyond the intended scope of a task when they are given broad access to enterprise systems and data. Token Security explains why organizations need to define agent intent and continuously enforce permissions around what each agent was actually created to do. AI BleepingComputer

15.8.26

 DDoS attacks over 1 Tbps surged fivefold in the second quarter Cloudflare says it mitigated more than 800 network-layer distributed denial-of-service (DDoS) attacks exceeding 1 Tbps in the second quarter of the year. Attack BleepingComputer

15.8.26

 CISA: Microsoft SharePoint flaw now exploited in ransomware attacks CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July. Exploit BleepingComputer

15.8.26

 Cisco warns of high-severity ClamAV flaws with public exploits Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks. Exploit BleepingComputer

15.8.26

 US and South Korea warn of Gunra ransomware targeting govt agencies U.S. federal agencies and South Korea's National Policy Agency warned government and critical infrastructure organizations worldwide to secure their systems against Gunra ransomware attacks. Ransom BleepingComputer

15.8.26

 Hackers breached a small Polish energy plant via private APN last year Hackers breached a heat-and-power plant facility in Poland, which supplies heat to about 50,000 residents, using a private APN (Access Point Name) to access an OT (Operational Technology) network. Hack BleepingComputer

15.8.26

 BdThemes plugins supply-chain hack creates rogue WordPress admins A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create rogue admin accounts. Hack BleepingComputer

15.8.26

 OSDI '26 20th USENIX Symposium on Operating Systems Design and Implementation (OSDI ’26)

CONGRESS

 OSDI '26

15.8.26

 NSDI '26 23rd USENIX Symposium on Networked Systems Design and Implementation (NSDI ’26)

CONGRESS

 NSDI '26

15.8.26

 FAST '26 24th USENIX Conference on File and Storage Technologies (FAST ’26)

CONGRESS

 FAST '26

15.8.26

 USENIX Security '26 Thanks to those who joined us for the 34th USENIX Security Symposium. We hope you enjoyed the event. CONGRESS USENIX Security '26

15.8.26

 VehicleSec '26 Symposium on Vehicle Security and Privacy

CONGRESS

 VehicleSec '26

15.8.26

 WOOT '26 Conference on Offensive Technologies brings together both academics and practitioners in the field of offensive security research.

CONGRESS

 WOOT

15.8.26

 Evooo1Bot FortiGuard Labs analyzes Evooo1Bot, a modular Linux botnet targeting internet-facing devices with DDoS, SSH attacks, CVE exploits, and SOCKS relays BOTNET BOTNET

15.8.26

 CVE-2026-65400 An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials. VULNEREBILITY VULNEREBILITY

15.8.26

 SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch A maximum-severity security vulnerability impacting SAP Commerce Cloud is witnessing active exploitation efforts. The vulnerability, tracked as Vulnerebility The Hacker News

15.8.26

 Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC) has warned . Vulnerebility The Hacker News

15.8.26

 Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware Threat actors are acquiring expired domains to Verdana website traffic and reputation to redirect victims to scams and malware on a large scale. DNS Hack The Hacker News

15.8.26

 NightmareEclipse releases new PoC, ShieldBreak, exploits same weakness as RoguePlanet NightmareEclipse claims Microsoft did not properly patch RoguePlanet vulnerability Vulnerebility blog THREATLOCKER

15.8.26

 AI-related software vulnerabilities: 2025–2026 Why AI software vulnerabilities are increasing faster than the rest of the CVE landscape—and what defenders should do about it AI blog BARRACUDA

15.8.26

 From Blackwater to Cyber-Privateers: When States Outsource Force On August 12, 2026, President Donald Trump signed a National Security Presidential Memorandum titled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime.” Cyber blog SOCRADAR

15.8.26

 LiteLLM Supply Chain Attack: Inside the AI Breach That Exposed 2,500+ Companies New in this update: SOCRadar’s row-level analysis found that 95% of affected organizations were exposed before the well-known 40-minute PyPI window opened. That window marked the end of a five-day collection run, not the beginning. AI blog SOCRADAR

15.8.26

 FileRun: When Your File Manager Runs Your Files Today VulnCheck is disclosing CVE-2026-14863, an OS command injection to remote code execution in FileRun, a commercial self-hosted file manager. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. FileRun’s thumbnail extractors build shell commands by pasting the uploaded file path into a double-quoted string and handing it to exec(), and the filename sanitizer lets $() through, so a file named $(payload).mp4 runs its payload the moment a thumbnail is generated. Vulnerebility blog VULNCHECK

15.8.26

 Multi-Functional Linux Botnet “Evooo1Bot” FortiGuard Labs analyzes Evooo1Bot, a modular Linux botnet targeting internet-facing devices with DDoS, SSH attacks, CVE exploits, and SOCKS relays BotNet blog FORTINET BLOG

15.8.26

 August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs Microsoft has addressed 415 vulnerabilities in its August 2026 security update release. This month's patches include fixes for one exploited zero-day vulnerability, three disclosed zero-day vulnerabilities, and 62 Critical vulnerabilities, along with 349 additional vulnerabilities of varying severity levels. OS Blog CROWDSTRIKE

15.8.26

 Expanding AI Benchmarks in Cybersecurity Beyond Vulnerability Discovery The conversation about AI in cybersecurity has recently centered on capabilities like vulnerability discovery, exploit generation, and automated proof-of-concept development. It’s easy to see why: These tasks produce binary outcomes; a vulnerability either exists or it doesn't. That makes them useful for measuring model progress and demonstrating increasingly sophisticated cybersecurity capabilities. AI blog CROWDSTRIKE

15.8.26

 ClickFix campaign abuses Deno runtime for infostealer delivery Lures on compromised WordPress sites led to installation of Deno and a Python-based infostealer Malware blog SOPHOS

15.8.26

 Abuse of alternative runtime environments Deno-tes defender headaches Attack TTPs combine fileless execution, wide LOLBin use Hacking blog SOPHOS

15.8.26

 When Patching Isn't Enough: What the Fairlife Ransomware Attack Says About Network Edge Risk A recent ransomware incident at Coca-cola owned dairy company Fairlife provides a potent example of network edge devices being targeted for exploitation, and of the scale of outcomes attackers can achieve by exploiting them. Ransom blog Eclypsium

15.8.26

 Ransomware Now Shows Up in Nearly Half of All Breaches: A Survival Playbook for Lean Security Teams Ransomware now drives nearly half of breaches. Explore a practical survival playbook for lean security teams, from prevention to recovery in 2026.! Ransom blog Cyble

15.8.26

 A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace A hand-written Windows backdoor stored its command-and-control domain as the number of trailing spaces in a fake desktop.ini, and we found it on exactly one machine. Malware blog GENDIGITAL

15.8.26

 The phishing link that died on purpose A single expired URL exposed a phishing campaign built around Mailer-Go, Cloudflare Workers and an EvilTokens OneDrive lure. Phishing blog GENDIGITAL

15.8.26

 Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side China-based hackers-for-hire group is breaking into government ministries across the Middle East and Asia from the same control panel it uses to run an industrial-scale cryptocurrency fraud business. APT blog SECURITY.COM

15.8.26

 DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations alongside double extortion tactics used to pressure victims. Ransom blog Microsoft blog

15.8.26

 From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. Malware blog Microsoft blog

15.8.26

 ChainDrop supply chain compromise: Anatomy of a self-propagating worm A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates Malware blog Microsoft blog

15.8.26

 A Deep-Dive into the Multi-Stage .NET Loader Chain Delivering LokiBot Recently, the SonicWall Capture Labs Threat Research Team discovered a sophisticated multi-stage .NET malware campaign that delivers the LokiBot information stealer via a heavily obfuscated infection chain. The malware uses multiple .NET loader stages, layered decryption, and process hollowing to evade detection before executing the final native LokiBot payload. Malware blog SonicWall

15.8.26

 Microsoft Security Bulletin Coverage for August 2026 Microsoft’s August 2026 Patch Tuesday has 422 vulnerabilities, of which 177 are Elevation of Privilege. SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of August 2026 and has produced coverage for 24 of the reported vulnerabilities. OS Blog SonicWall

15.8.26

 Kimwolf v7: An Evolution of the Kimwolf Botnet We identified a new version (v7) of the Kimwolf Android/internet-of-things (IoT) botnet. This version upgrades its distributed denial-of-service (DDoS) attack capabilities and the resilience of its command-and-control (C2) infrastructure. Kimwolf primarily affects Android TV boxes and set-top boxes. BotNet blog Palo Alto

15.8.26

 The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications Aeternum is a recently discovered C++ botnet loader that shifts its command-and-control (C2) infrastructure entirely to the public Polygon blockchain. Instead of relying on centralized servers or domains, threat actors operate Aeternum by writing encrypted and plaintext instructions directly using smart contracts. A smart contract is a self-executing program stored on a blockchain that automatically runs when specific conditions are met. BotNet blog Palo Alto

15.8.26

 Inside the Modern SOC: The Identity Front Door In The 72-Minute Race, we explored how attackers are compressing the time between initial access and business impact. But as attacks continue to accelerate, another trend has emerged: Attackers are increasingly gaining access through compromised identities rather than exploiting technology vulnerabilities. Security blog Palo Alto

15.8.26

 The State of Ransomware Q2 2026 For the past year, the ransomware conversation has centered on concentration: a handful of dominant RaaS operations controlling most of the damage, and a shrinking pool of active groups fighting over the same territory. The State of Ransomware Q2 2026 report from Check Point Research shows that picture starting to shift. The leaders are still winning, but the road to joining them has gotten a great deal shorter. Ransom blog CHECKPOINT

15.8.26

 Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack Check Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India. APT blog CHECKPOINT

15.8.26

 When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers Check Point Research analyzed Cloudflare Code Mode, a technique that changes how AI agents use MCP by turning tools into a TypeScript API the model can write code against. AI blog CHECKPOINT

15.8.26

 Curiouser and Curiouser In this edition of the Threat Source newsletter, William reflects on the “Make Hazel a Hacker” segment in Beers with Talos, and how cybersecurity is a field where questions can lead to multiple correct answers. Cyber blog CISCO TALOS

15.8.26

 Dissecting the JWR phishing framework Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. Phishing blog CISCO TALOS

15.8.26

 Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities Microsoft has released its monthly security update for August 2026, which includes 421 vulnerabilities affecting a range of products, including 62 that Microsoft marked as "critical." OS Blog CISCO TALOS

15.8.26

 Why metaphor may dictate your security strategy In this week's newsletter, Martin looks at how the metaphors we use to describe AI "escaping" its sandbox can completely change how we react to the threat. Security blog CISCO TALOS

15.8.26

 Black Hat USA 2026: Will vulnerability discovery eventually decline in the AI era? And will today’s surge in AI-driven vulnerability discovery eventually make tomorrow’s software safer? AI blog Eset

15.8.26

 Black Hat USA 2026: What the Hugging Face hack tells us about human responsibility The incident involving OpenAI models shows that autonomous hacks make human oversight more important, not less Security blog Eset

15.8.26

 Black Hat USA 2026: AI is racing ahead of cybersecurity controls AI took center stage, but the clearest lesson was less about what AI can do than about who is accountable when something goes wrong AI blog Eset

15.8.26

 Are AI tutors safe for your kids? AI tutors can offer useful support, but their quality and safeguards vary widely. Here’s what parents should check before handing one to a child. AI blog Eset

15.8.26

 This month in security with Tony Anscombe – July 2026 edition OpenAI models going rogue, the first documented agentic ransomware operation, and an emergent AI-driven supply chain threat made for a packed July roundup Cyber blog Eset

15.8.26

 Signed, sealed, injected: The mechanics of DCRat in 2026 This DCRat campaign shows how attackers combine phishing lures, DLL sideloading, and process hollowing to attempt to slip past defenses and gain full remote access. Malware blog TRELLIX

15.8.26

 Weaponized AI: The Commoditization of Cybercrime This highlights emerging threats tied to artificial intelligence (AI), from autonomous kill-chain planning engines to uncensored AI-as-a-service platforms. AI blog TRELLIX

14.8.26

 Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth The threat actor known as HoneyMyte (aka Mustang Panda ) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious APT The Hacker News

14.8.26

 Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Hack The Hacker News

14.8.26

 CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview Phishing The Hacker News

14.8.26

 Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware Apple on Thursday sent a fresh batch of notifications to customers whom it suspects may have been targeted by mercenary spyware attacks. In a OS The Hacker News

14.8.26

 GhostDesk via Fake Softwares A new campaign documented by Malwarebytes details the distribution of a malicious Google Chrome extension dubbed GhostDesk, delivered through counterfeit software installers. ALERTS VIRUS

14.8.26

 WindRelay and SpyNote Drive NFC Fraud Researchers at Group-IB recently reported a new malware family combination involving a custom near-field communication (NFC) relay tool dubbed WindRelay deployed alongside the known SpyNote remote access trojan (RAT). ALERTS VIRUS

14.8.26

 Sandworm-Linked Group Uses Fake Job Interviews to Deploy Trojanized WireGuard Client According to CERT-UA, the Russian state-sponsored threat group Sandworm (tracked in this campaign as UAC-0145) is actively targeting system administrators and IT staff through fake job recruitment offers. Posing as hiring representatives from legitimate IT firms, the operators engage candidates via email and Telegram before conducting online technical interviews. ALERTS APT

14.8.26

 Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side A months-long investigation by the Symantec Threat Hunter Team has produced unprecedented visibility into the activities of Jewelbug (aka Earth Alux, REF7707, CL-STA-0049), a China-based APT group that has been breaking into government ministries across Asia and the Middle East while quietly running a cryptocurrency fraud business on the side. ALERTS APT

14.8.26

 Chaos Malware Variant Targeting Linux Cloud Infrastructure A new variant documented by Darktrace highlights how the Go-based Chaos botnet has shifted its targeting from edge routers to Linux cloud environments. Following an initial infection that quickly deletes its own footprint from the disk, the malware establishes long-term persistence using systemd services alongside a keep-alive script. ALERTS VIRUS

14.8.26

 Gunra Ransomware expands its operations A joint cybersecurity advisory released by international law enforcement and intelligence agencies including CISA, the FBI, NSA, USSS, DC3, and South Korea’s KNPA warns organizations of Gunra, an escalating ransomware-as-a-service (RaaS) threat. Initially discovered in April 2025 and built upon leaked Conti ransomware source code, the encryptor targeted Windows environments before incorporating Linux capabilities to enable multi-platform attacks. ALERTS RANSOM

14.8.26

 A new variant of the Kimwolf botnet identified in the wild Researchers at Unit 42 of Palo Alto Networks detailed the operation of Aeternum, a C++ botnet loader that uses public Polygon blockchain smart contracts to manage decentralized command-and-control (C2) operations. ALERTS BOTNET

14.8.26

 Jewelbug Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side APT APT

14.8.26

 NFC skimming attacks How criminals exploit the familiar “tap your phone to pay” feature to steal your money. ATTACK ATTACK

14.8.26

 WindRelay Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme MALWARE RAT/NFC

14.8.26

 PATCHCORD PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure MALWARE BACKDOOR

14.8.26

 AmnesiaStealer AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers MALWARE STEALER

13.8.26

 SmartApeSG ClickFix leads to two RATs Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

13.8.26

 CVE-2026-15409 A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location. VULNEREBILITY VULNEREBILITY

13.8.26

 CVE-2026-15410 Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. VULNEREBILITY VULNEREBILITY

13.8.26

 CVE-2025-49113 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. VULNEREBILITY VULNEREBILITY

13.8.26

 CVE-2026-68820 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability VULNEREBILITY VULNEREBILITY

13.8.26

 Critical VMware vCenter Vulnerability in Attackers’ Crosshairs Tracked as CVE-2026–59310, the directory traversal bug allows remote attackers to execute arbitrary code. Vulnerebility SECURITYWEEK

13.8.26

 Fortinet Patches Authentication Flaws in FortiWeb and FortiManager The vulnerabilities could allow attackers to log in with random usernames and passwords or impersonate any FortiGate appliance Vulnerebility SECURITYWEEK

13.8.26

 SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit Attackers are exploiting SharePoint flaw CVE-2026-55040 after a public PoC was released, allowing unauthenticated users to impersonate administrators. Attackers started exploiting CVE-2026-55040 ( ... Exploit SECURITYAFFAIRS

13.8.26

 Storm-1175 Replaces Medusa With New StormEncryptor Ransomware Microsoft says China-linked Storm-1175 is using a new ransomware called StormEncryptor, replacing Medusa in its latest attacks. Microsoft says China-linked, financially motivated threat actor Stor ... Ransom SECURITYAFFAIRS

13.8.26

 North Korean Lazarus Group Uses Windows Zero-Day in Operation Dream Job Lazarus targets defense professionals with fake Lockheed Martin jobs, exploiting a Windows zero-day to deploy backdoors and evade security controls. Check Point Research has uncovered a new wave APT SECURITYAFFAIRS

13.8.26

 China-Linked Hackers Use AI Agents in Autonomous Attack on Taiwan China-linked hackers reportedly used eight AI agents to breach a government network, steal data and compromise accounts with minimal human oversight. Israeli cybersecurity firm Dream documented wh ... APT SECURITYAFFAIRS

13.8.26

 ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch Chaotic Eclipse released a PoC for ShieldBreak, a Microsoft Defender zero-day that bypasses the CVE-2026-50656 patch and could enable SYSTEM-level code execution. Security researcher Chaotic Eclip ... Exploit SECURITYAFFAIRS

13.8.26

 WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud A previously unseen Android near field communication ( NFC ) relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan (RAT) called SpyNote as part of a contactless Virus The Hacker News

13.8.26

 North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring Companies are used to thinking about attackers as outsiders trying to break in. North Korean IT workers flip that model. They apply for jobs, pass APT The Hacker News

13.8.26

 Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages NUL1DROPPER, aka Flooding Dropper, is a new downloader targeting mobile SDK installs a RAT to Windows, Mac, and Linux with no install script required AI Opensourcemalware

13.8.26

 State Sponsored Hackers Use Fake Job Offers to Deliver New Zero Day Exploit It typically begins the same way it has for years, with an approach from a recruiter offering a role at a company the target would recognize, accompanied by a PDF describing the position in convincing detail. Exploit CHECKPOINT

13.8.26

 Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack Check Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India. Exploit CHECKPOINT

13.8.26

 Akira Hits Safe Mode: Ransomware Rebooting Around EDR After gaining access via an exposed SonicWall VPN, an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR, a first for this ransomware variant in our telemetry. Ransom Huntress

13.8.26

 Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme A new NFC relay malware designated as WindRelay, paired with SpyNote RAT enables live-call fraud, combining social engineering with dual digital and physical cash-out. Virus GROUP-IB

13.8.26

 WS-Trust Autologon Endpoint: Password Spray Without Smart Lockout Blocking Learn how to mitigate risks tied to a legacy Entra ID endpoint that undermines Smart Lockout, allowing attackers to confirm valid passwords even on MFA-protected accounts. Hack VARONIS

13.8.26

 Armored Likho expands its cyber-espionage toolkit Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims. APT SECURELIST

13.8.26

 OpenAI releases ChatGPT 5.6 Cyber, but it's only for approved users OpenAI has developed a new model called "GPT 5.6 Cyber," designed for vulnerability research, penetration testing, incident response, and remediation. AI BleepingComputer

13.8.26

 New StormEncryptor ransomware used by former Medusa affiliate A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. Ransom BleepingComputer

13.8.26

 CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs CISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw. Ransom BleepingComputer

13.8.26

 Attackers Exploit SharePoint Authentication Bypass After Public PoC Release Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) Exploit The Hacker News

13.8.26

 Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw Exploit The Hacker News

12.8.26

 Head Mare Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants APT APT

12.8.26

 Stealing Reasoning Traces from Proprietary LLM APIs Leading large language model providers now conceal their models’ step-by-step reasoning, or chainof-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. PAPERS PAPERS

12.8.26

 CVE-2026-48362 (CVSS score: 10.0) - An operating system command injection vulnerability in ColdFusion that could lead to arbitrary code execution (Fixed in 2025.0.12 and 2023.0.23) VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-48273 (CVSS score: 9.9) - An eval injection vulnerability in ColdFusion that could lead to arbitrary code execution (Fixed in 2025.0.12 and 2023.0.23) VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-71384 (CVSS score: 9.6) - An incorrect authorization vulnerability in ColdFusion that could lead to an application denial-of-service (Fixed in 2025.0.12 and 2023.0.23) VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-71362 (CVSS score: 9.1) - An incorrect authorization vulnerability in Commerce that could lead to privilege escalation VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-71398 (CVSS score: 10.0) - An incorrect authorization vulnerability in Campaign Classic that could lead to arbitrary code execution (Fixed in ACC v7 7.4.4 build 9400) VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-27302 (CVSS score: 10.0) - An incorrect authorization vulnerability in Campaign Classic that could lead to arbitrary code execution (Fixed in ACC v7 7.4.4 build 9400) VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-48381 (CVSS score: 9.0) - An SQL injection vulnerability in Campaign Classic that could lead to arbitrary code execution (Fixed in ACC v7 7.4.4 build 9400) VULNEREBILITY VULNEREBILITY

12.8.26

 TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks Two vulnerabilities have been identified in the Trusted Platform Module (TPM) 2.0 reference implementation: CVE-2026-6726 – Information leakage via falsified TPM keys.CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption.An attacker with privileged access to a TPM command interface may be able to exploit these vulnerabilities by sending specially crafted TPM commands. ALERT ALERT

12.8.26

CVE-2026-20349

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) Heap Inspection Vulnerability

KEV

KEV

12.8.26

CVE-2026-68820

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

KEV

KEV

12.8.26

CVE-2026-72898

Metabase SQL Injection Vulnerability

KEV

KEV

12.8.26

 Aeternum Botnet Researchers at Unit 42 of Palo Alto Networks detailed the operation of Aeternum, a C++ botnet loader that uses public Polygon blockchain smart contracts to manage decentralized command-and-control (C2) operations. The threat actors leverage JSON-RPC requests to public Polygon endpoints to bypass conventional IP and domain blocking, staging secondary payloads including XWorm RAT, XMRig cryptocurrency miners, data stealers, and Telegram-controlled Python backdoors. ALERTS BOTNET

12.8.26

 DeadLock Ransomware Combines Resource-Aware Encryption with Resilient Extortion Protocols Researchers at SOCRadar's Threat Research Unit recently reported on DOUBLECUP, a Russian Loader-as-a-Service platform built for ClickFix-style social engineering campaigns and active since early June 2026. Operators license access to a client panel and embed DOUBLECUP's front-end logic into lure pages, including sites spoofing NetSuite, Odoo, HubSpot, and Salesforce login portals. ALERTS RANSOM

12.8.26

 CRPxO Ransomware Researchers at SOCRadar's Threat Research Unit recently reported on DOUBLECUP, a Russian Loader-as-a-Service platform built for ClickFix-style social engineering campaigns and active since early June 2026. Operators license access to a client panel and embed DOUBLECUP's front-end logic into lure pages, including sites spoofing NetSuite, Odoo, HubSpot, and Salesforce login portals ALERTS RANSOM

12.8.26

 Largest AI Supply Chain Breach of 2026 2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026 AI AI

12.8.26

 CVE-2026-33634 Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-58231 SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-44772 (CVSS score: 9.9) - A code injection vulnerability in Manufacturing Integration and Intelligence VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-34265 (CVSS score: 9.8) - An out-of-bounds write vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform that allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This could be exploited to disclose sensitive system information or crash the system. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-44758 (CVSS score: 9.1) - A code injection vulnerability in Manufacturing Integration and Intelligence that could allow an attacker with high privileges to execute arbitrary commands on the underlying operating system. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-59124 Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-62878 Microsoft reports that CVE-2026-62878 is neither exploited in the wild nor publicly disclosed; it is a Critical Windows DNS Server remote code execution vulnerability with a CVSS score of 9.8. The flaw is a stack-based buffer overflow in Windows DNS that can be triggered remotely by an unauthenticated attacker sending a specially crafted packet to an affected service over the network, with no user interaction required, potentially allowing code execution on the target DNS server. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-72971 This vulnerability was publicly disclosed before Patch Tuesday, making it a zero-day, but Microsoft says it has not been exploited in the wild; it is rated Important with a CVSS score of 5.5. The flaw is an improper link-resolution, or “link following,” issue in the Windows Container Isolation file system filter driver, unionfs.sys, affecting Windows 11 Version 26H1 on x64 and ARM64 systems. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-62832 Microsoft says this vulnerability has been publicly disclosed but has not been exploited in the wild, making it a zero-day disclosure without confirmed exploitation at this time. Rated Important with a CVSS score of 7.8, this Windows User Profile Service flaw is an improper link resolution, or “link following,” issue that could allow a local authenticated attacker to elevate privileges. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-68820 This Important-severity elevation of privilege vulnerability is listed by Microsoft as exploited in the wild but not publicly disclosed, and it has a CVSS score of 7.0. The flaw is a use-after-free issue in the Windows Ancillary Function Driver for WinSock affecting supported Windows client and server versions; a locally authenticated attacker with low privileges could run a specially crafted application to trigger a race condition and, if successful, gain SYSTEM privileges. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-62815 This Critical Microsoft QUIC remote code execution vulnerability is not listed as exploited in the wild or publicly disclosed. It carries a CVSS score of 9.8 and is a use-after-free flaw that could allow an unauthenticated remote attacker to send a specially crafted packet to an affected service over the network and execute code on the target system, with no user interaction required. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-53415 Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-53414 Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access. VULNEREBILITY VULNEREBILITY

12.8.26

 CVE-2026-53413 Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access. VULNEREBILITY VULNEREBILITY

12.8.26

 Kimwolf v7 Kimwolf v7: An Evolution of the Kimwolf Botnet BOTNET BOTNET

12.8.26

 Partners have spoken: Barracuda earns four 2026 CRN Annual Report Card (ARC) Awards Partner feedback earns Barracuda top honors for support, managed services, partnership, and channel success. Cyber BARRACUDA

12.8.26

 Palacký University strengthens cyber resilience and simplifies compliance How Barracuda helps one of the Czech Republic’s oldest universities protect on-premises data, simplify recovery and support NIS2 readiness. Cyber BARRACUDA

12.8.26

 Phantom Project: A cybercrime toolkit bundle How a malware-as-a-service platform combines credential theft, obfuscation and remote access to support identity-focused cybercrime operations CyberCrime SOCRADAR

12.8.26

 August 2026 Patch Tuesday: 421 Flaws, 3 Zero-Days Microsoft’s August 2026 Patch Tuesday release addresses 421 vulnerabilities, including three zero-days. One zero-day was exploited in the wild, while two others were publicly disclosed before fixes were available. Vulnerebility SOCRADAR

12.8.26

 SAP Commerce Cloud CVE-2026-58231 Requires Urgent Patching SAP has addressed CVE-2026-58231, a maximum-severity improper authorization vulnerability in the Data Hub Adapter for SAP Commerce Cloud. The flaw carries a CVSS score of 10.0 and may allow an unauthenticated attacker with network access to execute arbitrary code on an affected system. Vulnerebility SOCRADAR

12.8.26

 Cisco ASA and FTD CVE-2026-20349 Exploited Cisco has confirmed active exploitation of CVE-2026-20349, a High-severity denial-of-service (DoS) vulnerability affecting the Remote Access SSL VPN service in Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) Software. Exploit SOCRADAR

12.8.26

 Top 10 Phishing Kits Used by Cybercriminals Phishing kits have turned credential theft into a scalable service by packaging fake login pages, hosting, traffic filtering, victim management, and technical support into ready-made platforms. Phishing SOCRADAR

12.8.26

 INC Ransom Targeted 24 Law Firms, but Only 10 are Listed INC was on an encryption streak against US law firms in March 2026. SOCRadar identified 24 individualized extortion sites, hosted across two IP addresses, that we assess with high confidence are tied to INC Ransom. Each one is built for a specific US law firm, complete with its own countdown timer and highly likely shared with the victim firm’s customers to increase the pressure. Ransom SOCRADAR

12.8.26

 Critical Metabase Zero-Day Exploited Metabase has disclosed a critical zero-day SQL injection (SQLi) vulnerability that can allow unauthenticated attackers to gain administrator access to vulnerable instances. The flaw is rated at maximum severity, and the vendor has confirmed active exploitation. Exploit SOCRADAR

12.8.26

 Steam Customer Data Exposed in CEVA Logistics Cyberattack A cyberattack on CEVA Logistics, the company that distributes Steam hardware in Europe, may have exposed delivery and order information belonging to some Steam customers. Valve said the incident occurred between July 29 and August 1, 2026, and began notifying potentially affected customers on August 10. CyberCrime SOCRADAR

12.8.26

 Brazil Fiscal Leak, US Fullz, Telecom Access, Endesa IBANs, and Mexico Fortinet Access SOCRadar Dark Web Team identified several new underground posts involving alleged large-scale data exposure and initial access sales. The findings include an alleged leak of 72 million Brazilian fiscal records, a claimed 1 million record U.S. Fullz dataset, unauthorized access to a major Asian telecom provider, an alleged Endesa Spain IBAN database, and Fortinet-related access to a large Mexican network. CyberCrime SOCRADAR

12.8.26

 Is your security stack actually running? Adversaries love to make life difficult for defenders. One of the best ways for attackers to operate undetected is to disable security tools on a compromised device. Security OKTA

12.8.26

 New Intelligence Links TeamPCP to ShadowRay 2.0 and Traces Activity back to 2020 OLIGO Security has identified evidence that TeamPCP was responsible for the first known attack in which AI infrastructure was hijacked into a self-propagating botnet during the ShadowRay 2.0 campaign. Our findings also link the group to activity previously attributed to TA-NATALSTATUS dating back to 2020. Virus OLIGO

12.8.26

 Mirai and Its Heirs: A Decade of Structural Neglect in IoT Security Nearly ten years after its source code was leaked, Mirai’s methodology is still working largely unchanged. The original botnet scanned the Internet for devices running default credentials and unpatched services, then weaponized them at scale. Its descendants do the same thing against the same device categories: consumer routers, DVRs, and IP cameras. BotNet CENSYS

12.8.26

 Shai-Hulud Outbreak Debrief: The Worm Evolves into MCP 5 days after 440+ npm packages were compromised, 5 malicious repositories remain live in the wild—and the threat is still active Virus OX SECURITY

12.8.26

 FirewallFalcon Manager: Supply-Chain Backdoors in Underground VPN Infrastructure What if the tool you use to run your criminal infrastructure is itself criminal infrastructure, and you are the target? FirewallFalcon Manager is presented as a free open-source Linux server management tool for VPN and proxy services. But, beneath the well-polished GitHub repo and feature-rich shell menus lies a multi-layered well hidden and sophisticated attack: Hack FLARE.IO

12.8.26

 Plugged In and Exposed: The Growing Cybersecurity Threat to EV Charging Infrastructure Publicly exposed EV charging infrastructure remains an unresolved cybersecurity problem. Security practitioner Ken Munro has spent years taking apart the machines that charge electric cars. When asked what actually kept him up at night, he did not point to any one broken device. He pointed at all of them at once. Security FLARE.IO

12.8.26

 Cursor CLI ran untrusted repo code A repository could execute any command it chose on your machine, as you, the moment you started Cursor's CLI agent in it with -w. It ran before the workspace-trust dialog, and fired even for users who had explicitly passed --sandbox enabled. AI MANIFOLD

12.8.26

 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services Hack The Hacker News

12.8.26

 OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal AI The Hacker News

12.8.26

 Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic Vulnerebility The Hacker News

12.8.26

 CopyEscape: Taking Over Docker Hosts with docker cp Imperva Red Team uncovered CVE-2026-17106, a container-to-host arbitrary file-write vulnerability in Docker’s docker cp command. Docker later confirmed that the same CVE also affected sbx cp when copying files out of Docker Sandboxes. Vulnerebility IMPERVA

12.8.26

 Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. Vulnerebility IMPERVA

12.8.26

 Intelligence-Driven SOC: Modernizing Threat Monitoring and Detection Engineering for Ultimate MTTR Reduction Threat monitoring serves as the vital connective tissue of modern security operations. It ensures that every function from triage to response operates effectively. To meet evolving threat challenges, SOC teams and MSSPs must transition from simple log collection to a proactive, intelligence-driven framework. Security ANYRUN BLOG

12.8.26

 Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup Researchers created a fake DeFi startup and hired suspected Famous Chollima operatives, providing a rare inside view of a DPRK IT worker operation. APT ANYRUN BLOG

12.8.26

 Inside a Russian-Speaking Operator's Toolkit for Compromising Ukrainian IP Cameras Disclosure note: Hunt.io notified CERT-UA on July 30, 2026, and held publication for the standard 7-day disclosure window. The affected e-commerce operator was notified via CERT-UA. APT HUNT.IO

12.8.26

 Tracking Shai-Hulud: Inside the ChainDrop NPM Worm On August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowing the attacker to rotate domains with a single blockchain transaction and rendering domain-based blocklists ineffective. Virus Zscaler

12.8.26

 Abyssos: Technical Analysis of a New Modular RAT In late June 2026, Zscaler ThreatLabz identified a new malware family that we track as Abyssos. Abyssos is a new modular remote administration tool (RAT) written in C++ that supports a variety of features including credential theft, file exfiltration, and remote access via VNC. Virus Zscaler

12.8.26

 ThreatLabz 2026 Report: Frontier AI and Enterprise Readiness It was 9:14 AM when the CISO's VPN connection momentarily dropped, something that normally wouldn’t cause any concern. What he couldn't see was that attackers had already exploited a pre-authentication flaw in the VPN appliance itself, gaining access before any login ever occurred. AI Zscaler

12.8.26

 CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials On July 31, Microsoft Threat Intelligence reported an ongoing credential theft campaign tracked as CaptiveCrunch. Microsoft attributes this activity to Storm-2945, a sub-cluster of Midnight Blizzard (also known as APT29, Cozy Bear, NOBELIUM, and BlueBravo), a threat group linked to Russia. APT Zscaler

12.8.26

 Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings Exploit The Hacker News

12.8.26

 Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, Hack The Hacker News

12.8.26

 SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in Vulnerebility The Hacker News

12.8.26

 ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access The security researcher going by the name Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof- Exploit The Hacker News

12.8.26

 Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Exploit The Hacker News

12.8.26

 Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. OS The Hacker News

12.8.26

 Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and BotNet The Hacker News

12.8.26

 Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client Anyone sharing their screen on a Zoom call could have taken over the computers of everyone watching, and anyone watching could have taken Social The Hacker News

12.8.26

 Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by APT The Hacker News

11.8.26

 DeadLock ransomware DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure RANSOM RANSOM

11.8.26

 CVE-2026-63520 Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available. VULNEREBILITY VULNEREBILITY

11.8.26

 CVE-2026-55040 Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. VULNEREBILITY VULNEREBILITY

11.8.26

 CVE-2026-31431 Linux privilege escalation (“Copy Fail”) VULNEREBILITY VULNEREBILITY

11.8.26

 CVE-2026-34197 ActiveMQ Remote Code Execution VULNEREBILITY VULNEREBILITY

11.8.26

 CVE-2026-8512 Use-after-free in Chrome's File System Access API on macOS VULNEREBILITY VULNEREBILITY

11.8.26

 CVE-2026-45185 EXIM unauthenticated Remote Code Execution VULNEREBILITY VULNEREBILITY

11.8.26

 CVE-2026-22738 SpringAI SpEL Remote Code Execution VULNEREBILITY VULNEREBILITY

11.8.26

 CVE-2026-20339 A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of&nbsp;memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an integer overflow. VULNEREBILITY VULNEREBILITY

11.8.26

 CVE-2026-20338 A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. VULNEREBILITY VULNEREBILITY

11.8.26

 CVE-2026-20337 A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. VULNEREBILITY VULNEREBILITY

11.8.26

 Sexual Exploitation Actors Stealing and Leaking Explicit Content The Federal Bureau of Investigation (FBI) warns the public about sexual exploitation (SE) actors targeting adult and underage victims1 by illegally accessing their social media and personal accounts to steal and post their explicit content (also known as non-consensual intimate images, or NCII) for sale on criminal marketplaces. IC3 IC3 PRESS

11.8.26

 #StopRansomware: Gunra Ransomware Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid. IC3 IC3 INDUSTRY

11.8.26

 #StopRansomware: Gunra Ransomware Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid. GROUP RANSOM

11.8.26

 Opencart ecommerce platform contains directory traversal vulnerability The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability. The extension installation process extracts uploaded .zip files then uses the zip entry filenames as filesystem paths, without validating that the resolved path stays inside the intended directory. This vulnerability is tracked as CVE-2026-18412. ALERT ALERT

11.8.26

 AA26-222A StopRansomware Gunra Ransomware The FBI originally observed Gunra ransomware in April 2025. The threat actors quickly established a DLS on the Tor network to list victims and publish exfiltrated data. As of January 2026, Gunra launched a formal RaaS affiliate program on dark web forums, providing affiliates with access to a management panel, a configurable ransomware builder, cross-platform locker payloads, and structured affiliate documentation. GROUP RANSOM

11.8.26

 Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE Security researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, with no valid account. A significant AI The Hacker News

11.8.26

 DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt The ransomware group known as DeadLock has been observed using decentralized infrastructure to facilitate victim communications and data Ransom The Hacker News

11.8.26

 OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development OpenAI on Monday unveiled a new cybersecurity-focused model called GPT‑5.6‑Cyber that it said is focused on vulnerability research, penetration AI The Hacker News

11.8.26

 Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants Kaspersky experts have discovered malicious TrueConf software installers. The Head Mare APT group uses them to deliver the PhantomCore and PhantomGraph backdoors to target systems by exploiting vulnerabilities in an unpatched TrueConf server. APT SECURELIST

11.8.26

 Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first was published in June 2026 as part of our Kaspersky Threat Intelligence Reporting service, and the second was published on Securelist the following month, further documenting the framework’s evolving architecture and C2 capabilities. APT SECURELIST

11.8.26

 A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle Mobil The Hacker News

11.8.26

 Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo Mozilla has scrapped the cryptographic key behind Firefox and Thunderbird downloads for Linux after an unencrypted copy of it was Security The Hacker News

11.8.26

 Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean Cryptocurrency The Hacker News

11.8.26

 Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components OS The Hacker News

11.8.26

 Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer AI The Hacker News

11.8.26

 Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks Cybersecurity and intelligence agencies from South Korea and the U.S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world. Targets of these attacks include healthcare and public health, financial services, government services and facilities, and professional and nonprofit services. Ransom The Hacker News

11.8.26

 Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power plant by coming in over the ICS The Hacker News

11.8.26

 BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems (CMS) platform's plugins team to temporarily Hack The Hacker News

11.8.26

 Member of The Com sent to prison for blackmail, sextortion A member of "The Com," a loose-knit online cybercrime collective that targets children and teenagers, has been sentenced to two years in prison for blackmail and sextortion offenses against nearly 120 victims worldwide. BigBrothers BleepingComputer

11.8.26

 LexisNexis shuts down services after suspicious activity on servers LexisNexis took its Diligence, Metabase API, and Newsdesk services offline as part of its response to unusual activity on servers hosted and managed by an unnamed third-party vendor. Incindent BleepingComputer

11.8.26

 Valve notifies Steam hardware customers of a data breach Video game publisher and digital distribution giant Valve is notifying Steam hardware customers in Europe that hackers stole their data after hacking its shipping partner, CEVA Logistics. Incindent BleepingComputer

11.8.26

 China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw Microsoft has disclosed that Storm-1175 , a financially motivated threat actor linked to China, has deployed a previously undocumented APT The Hacker News

10.8.26

 Operation Capsule Vault Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2 OPERATION OPERATION

10.8.26

 Pass-the-Passkey Family of Attacks Coming from the field of enterprise security, we have spent much of our careers studying privilege escalation and lateral movement through attacks against Windows Integrated Authentication. But as more companies adopt cloud services, we decided to shift our attention to passkeys, which are slowly but steadily becoming the norm. REPORT REPORT

10.8.26

 CVE-2026-34348 CVE-2026-34348 is a medium-severity information disclosure vulnerability (CVSS score 6.5) in the Windows Event Logging Service. It stems from a protection mechanism failure where sensitive data, such as passkey assertions or authentication material, is improperly logged in a recoverable form, letting an authorized attacker view data over a VULNEREBILITY VULNEREBILITY

10.8.26

 CVE-2026-33691 The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). VULNEREBILITY VULNEREBILITY

10.8.26

 CVE-2026-3502 TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. VULNEREBILITY VULNEREBILITY

10.8.26

 Соціальна інженерія у виконанні UAC-0145: компрометація у процесі працевлаштування CERT-UA отримано інформацію щодо застосування просунутих методів соціальної інженерії кластером кіберзагроз UAC-0145 (субкластер UAC-0002, також відомий як Sandworm, APT44, Seashell Blizzard). Зокрема, на сайтах пошуку роботи зловмисники, попередньо вивчивши резюме кандидата, від імені ІТ компанії (наприклад, ATLAS Business Group) виходять на зв'язок з потенційною жертвою, як правило системним адміністратором/ІТ фахівцем. BATTLEFIELD UKRAINE BATTLEFIELD UKRAINE

10.8.26

 WhiteCobra Chassis Solidity Pro's WhiteCobra Chassis: Cloudflare C2 to Telegram Infostealer MALWARE STEALER

10.8.26

 AI-Driven Deepfake-Based Military ID Forgery APT Campaign Emergence of APT attacks using generative AI "ChatGPT" AI GENIANS.KR

10.8.26

 Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM Observed indications that the Kimsuky group built and operated local LLM environments using Ollama, GPT4All, and Msty. AI GENIANS.KR

10.8.26

 DPRK-Related Campaigns with LNK and GitHub C2 FortiGuard Labs recently detected a series of LNK files targeting users in South Korea. These attacks use a multi-stage scripting process and leverage GitHub as Command and Control (C2) infrastructure to evade detection. APT FORTINET BLOG

10.8.26

 IT threat evolution in Q2 2026. Non-mobile statistics The report presents key trends and statistics on malware that targeted personal computers running Windows and macOS, as well as internet of things (IoT) devices, during Q2 2026. Mobil SECURELIST

10.8.26

 IT threat evolution in Q2 2026. Mobile statistics The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwanted software for Android, as well as descriptions of the most notable threats for Android and iOS discovered during the reporting period. Mobil SECURELIST

10.8.26

 Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun APT The Hacker News

10.8.26

 New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Phishing The Hacker News

10.8.26

 Shipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development AI is helping development teams produce far more code, far faster. But security teams still have to review vulnerabilities, manage dependencies, AI The Hacker News

10.8.26

 Critical Progress LoadMaster flaw now actively exploited in attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability. Exploit BleepingComputer

10.8.26

 Hackers breach TrueConf to trojanize client installers with backdoors The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors. Virus BleepingComputer

10.8.26

 Metabase SQLi zero-day exploited in customer data-theft attacks A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. Exploit BleepingComputer

10.8.26

 Unlimited Technology Systems breach impacts 3.8 million people Unlimited Technology Systems breach impacts 3.8 million people Incindent BleepingComputer

10.8.26

 Levi Strauss & Co. says hackers stole corporate data in cyberattack Levi Strauss & Co. (Levi's) says that hackers used social engineering on three of its employees to gain access to and steal corporate data stored on their machines. Incindent BleepingComputer

10.8.26

 Real emails, hijacked payments: Two H1 2026 attack chains Gen's H1 2026 Threat Report examines two separate attack chains. One used compromised business inboxes and browser manipulation in a banking-malware campaign, while the other used clipboard hijacking to redirect cryptocurrency payments. Spam BleepingComputer

10.8.26

 Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro") that has been observed delivering a browser wallet and credential stealer. Cryptocurrency The Hacker News

10.8.26

 OpenAI's Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause OpenAI has announced that it's pausing some "internal activities" involving its upcoming artificial intelligence (AI) model Astra after an internal AI The Hacker News

9.8.26

 Safe RET Interrupt Vulnerability An external researcher has reported a potential vulnerability affecting AMD "Zen" architecture processors. The report claims that an attacker executing code on an affected system could inject an interrupt at a precise moment to disrupt “Safe RET,” the default Linux mitigation for Speculative Return Stack Overflow (SRSO), which could potentially weaken that protection and may result in information disclosure. VULNEREBILITY VULNEREBILITY

9.8.26

 Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send Cyber The Hacker News

9.8.26

 North Carolina Ports confirms cyberattack disrupting operations The North Carolina Ports Authority has confirmed that a cyberattack disrupted IT systems and slowed operations at Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. Hack BleepingComputer

9.8.26

 OpenAI rolls out a major ChatGPT upgrade, even if you don’t pay for it OpenAI is rolling out a more reliable version of ChatGPT GPT-5.6 Sol for Plus and Pro users, while Free users are getting unlimited text chats with GPT-5.6 Luna. AI BleepingComputer

9.8.26

 ClickFix attack pushes macOS infostealer for crypto theft attacks A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. Virus BleepingComputer

9.8.26

 Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group A recent wave of cyberattacks targeting hedge funds, private-equity firms, and other financial organizations has been linked to UNC6671, an extortion group reportedly associated with the BlackFile threat actors. APT BleepingComputer

9.8.26

 Swiss government SharePoint breach compromised 200 accounts Switzerland's federal IT office says hackers exploited vulnerabilities to breach its Microsoft SharePoint servers and compromised approximately 200 accounts. Incindent BleepingComputer

9.8.26

 New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines. Attack BleepingComputer

9.8.26

 Meta AI model hacked a company during misconfigured cyber test Meta has become the latest AI company to confirm that one of its models hacked a real organization during cybersecurity testing, as similar incidents continue to emerge following OpenAI'sOpenAI's initial disclosure that its agents breached Hugging Face. AI BleepingComputer

9.8.26

 Ransom Cartel ransomware creator sentenced to 16 years in prison Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for his role in ransomware attacks against at least 18 companies worldwide. Ransom BleepingComputer

9.8.26

 Canadian pleads guilty to Snowflake cloud data-theft attacks A Canadian man pleaded guilty today to his role in accessing company accounts at cloud storage provider Snowflake and stealing data from at least 165 organizations in a scheme to extort millions of dollars from victims. Incindent BleepingComputer

8.8.26

 CVE-2026-20339 A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of&nbsp;memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an integer overflow. VULNEREBILITY VULNEREBILITY

8.8.26

 CVE-2026-20338 A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. VULNEREBILITY VULNEREBILITY

8.8.26

 CVE-2026-20337 A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. VULNEREBILITY VULNEREBILITY

8.8.26

 CVE-2026-20294 A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types that are not included in the encryption allowlist VULNEREBILITY VULNEREBILITY

8.8.26

 CVE-2023-38646 Metabase RCE Vulnerability Explained VULNEREBILITY VULNEREBILITY

8.8.26

 DOUBLECUP Loader-as-a-Service Deploys Stealthy RATs via Fake CRM Portals Researchers at SOCRadar's Threat Research Unit recently reported on DOUBLECUP, a Russian Loader-as-a-Service platform built for ClickFix-style social engineering campaigns and active since early June 2026. ALERTS VIRUS

8.8.26

 Fake CAPTCHA Prompts Leverage ClickFix Tactics to Infect macOS Systems In a recent write-up, Huntress details a macOS stealer malware campaign that uses ClickFix social engineering tricks to compromise Apple systems and siphon cryptocurrency wallets. Initiated through malicious links in email messages, the attack presents victims with a fake CAPTCHA window instructing them to paste a shell command into the macOS Terminal. ALERTS VIRUS

8.8.26

 Vanta Stealer Dubbed Vanta Stealer, a Python-based information stealer has been analyzed by the Lat61 Threat Intelligence Team, who describe it as a PyInstaller-packaged Windows executable with PyArmor-obfuscated bytecode protecting its core logic. ALERTS VIRUS

8.8.26

 Greatness PhaaS Campaigns Continue In a recent write-up, ZeroBEC details a campaign utilizing the Greatness phishing-as-a-service (PhaaS) platform, tracked under the HoneyStorm tag by URLQuery. ALERTS CAMPAIGN

8.8.26

 Popular NPM Packages Hijacked with New Shai-Hulud Malware Researchers at Aikido Security recently reported an active supply chain attack impacting widely downloaded npm libraries, including keyv and related caching utilities. The campaign leverages compromised maintainer credentials to publish poisoned package versions containing malicious preinstall hooks. ALERTS VIRUS

8.8.26

 Abuse of ScreenConnect RMM and Cloudflare Tunnels in SMOKE#SCREEN Campaign Researchers at Securonix recently reported an active multi-stage campaign dubbed SMOKE#SCREEN that abuses legitimate ScreenConnect remote monitoring and management (RMM) software to gain persistent access to enterprise endpoints. The operation targets both Windows and macOS environments using social engineering lures themed around Zoom updates, corporate document reviews, and system utilities. ALERTS CAMPAIGN

8.8.26

 CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability KEV KEV

8.8.26

 The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability A heap buffer overflow vulnerability exists in the stb TrueType library created by nothings. Exploitation of this vulnerability can occur when handling malformed font data and may lead to both Denial of Service (DoS) and Information Disclosure. ALERT ALERT

8.8.26

 Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations A cross-site scripting (XSS) vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG (Scalable Vector Graphics) objects in ICS (iCalendar) invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTotal sightings. ALERT ALERT

8.8.26

 MythStealer A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates. MALWARE STEALER

8.8.26

 Token Jacking It’s three a.m., do you know what your AI agent is doing? Unit 42 has responded to a growing number of AI token jacking cases resulting in staggering financial losses. AI AI

8.8.26

 Flooding Dropper 'Flooding Dropper' Campaign Hits npm With Nearly 850 Malicious Packages CAMPAIGN CAMPAIGN

8.8.26

 Pink New Data Extortion Group “Pink” Goes Big Game Hunting With Evasive Phishing Kits GROUP GROUP

8.8.26

 UNC6671 UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments GROUP GROUP

8.8.26

 CVE-2026-64638 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79) VULNEREBILITY VULNEREBILITY

8.8.26

 Hackers run khunt post-exploitation toolkit from Oracle database Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network. Exploit BleepingComputer

8.8.26

 COLDCARD security audit phishing attack installs remote access tool COLDCARD security audit phishing attack installs remote access tool Phishing BleepingComputer

8.8.26

 CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited. Exploit BleepingComputer

8.8.26

 Google Blogger locks hundreds of blogs in malware false positive Google has locked hundreds of Blogger websites after a false positive claimed they violated its "Malware and Similar Malicious Content" policy, with some sites deleted from the platform. Virus BleepingComputer

8.8.26

 How AI-powered phishing killed blocklists for good AI is helping attackers create disposable phishing infrastructure and rapidly evolving toolkits that blocklists cannot track fast enough. Push Security explains why browser-level, technique-based detection offers a more durable defense than relying on domains, signatures, and other known-bad indicators. AI BleepingComputer

8.8.26

 OpenAI, Anthropic AI agents targeted real people and systems in cyber tests OpenAI and Anthropic have confirmed that their AI models were involved in separate, newly disclosed third-party cybersecurity testing incidents that resulted in a real website being breached and social engineering attacks against people outside the intended testing boundaries. AI BleepingComputer

8.8.26

 TP-Link patches Omada ZTP flaws allowing hackers to breach networks TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices that could be chained with previously disclosed flaws to achieve remote code execution (RCE). Vulnerebility BleepingComputer

8.8.26

 Phishing service spoofs RingCentral to steal Microsoft 365 accounts The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts. Phishing BleepingComputer

8.8.26

 New XCSSET variant targets macOS devs via compromised Xcode projects A new version of the XCSSET malware is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. Virus BleepingComputer

8.8.26

 77 Open VSX extensions found harvesting developer info 77 extensions on the Open VSX marketplace impersonated legitimate developer tools while transmitting information about the systems and development environments where they were installed. Virus BleepingComputer

8.8.26

 Massive ChainDrop npm supply-chain attack infects hundreds of packages Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry. Virus BleepingComputer

8.8.26

 Varonis Agent IBAC keeps AI agents within their intended boundaries AI agents need broad access to be useful, but traditional access controls cannot determine whether an action aligns with a user's intent. Varonis explains how Agent IBAC detects intent drift and enforces real-time guardrails to keep agents within their intended boundaries. AI BleepingComputer

8.8.26

 Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts Microsoft has linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard, also known as APT29. APT BleepingComputer

8.8.26

 New Pass-ta-key attacks let malware hijack Google-synced passkeys Security researchers have discovered three attacks that allow malware on already-compromised Windows devices to abuse Google Password Manager's synced passkeys to take over accounts, bypass user verification, and extract passkey private keys. Hack BleepingComputer

8.8.26

 New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. Hack The Hacker News

8.8.26

 Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been Exploit The Hacker News

8.8.26

 N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw Vulnerebility The Hacker News

8.8.26

 Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw impacting Progress Kemp Vulnerebility The Hacker News

8.8.26

 Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform Virus The Hacker News

8.8.26

 ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored Cryptocurrency The Hacker News

8.8.26

 UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data A recent wave of cyber attacks targeting financial services, private equity, and professional services is attributed to a data extortion group known as UNC6671 . "UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. Phishing The Hacker News

8.8.26

 New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content Vulnerebility The Hacker News

8.8.26

 XSS2Shell (CVE-2026-64638): Patch WordPress Now XSS2Shell (CVE-2026-64638): Patch WordPress Now A new WordPress Core vulnerability chain called XSS2Shell turns a login page XSS bug into a much more serious risk for exposed WordPress sites. The issu... Vulnerebility blog SOCRADAR

8.8.26

 Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools Infostealers are a rapidly evolving threat, enabling various adversaries, ranging from ransomware groups and hacktivists to nation-state actors, to exploit stolen credentials for unauthorized access to sensitive resources. In today’s threat landscape, identity is a primary target, with attackers seeking diverse credentials including usernames, passwords, tokens, and seed phrases.  Malware blog SOCRADAR

8.8.26

 Snowflake Hacker Pleads Guilty, Faces 32 Years Snowflake hacker Connor Riley Moucka pleaded guilty on August 5, 2026, in the U.S. District Court for the Western District of Washington, admitting to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy count tied to the 2024 breaches of Snowflake customer accounts. CyberCrime blog SOCRADAR

8.8.26

 Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005) AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and In March 2026, Hauri disclosed an attack case in which the malware was disguised as an integrated security program. Malware blog AHNLAB

8.8.26

 CVE-2026-44613: Turning a CSRF into Silent Unauthorized Actions Apache Zeppelin’s default CORS configuration allowed cross-origin, credentialed, state-changing requests (and accepted text/plain request bodies), letting a remote attacker who lures an authenticated user to a malicious site perform unauthorized actions through Zeppelin’s REST and WebSocket endpoints. Vulnerebility blog OX

8.8.26

 IBM report sees deep fakes emerging as top AI attack threat IBM study finds deepfake attacks now account for nearly half of AI-enabled breaches as organizations grapple with rising costs and expanding cyber risks. AI blog BARRACUDA

8.8.26

 Malware signing: When trust becomes an attack surface How cybercriminals use stolen, fraudulent, and commercialized code-signing certificates to make malware appear legitimate and bypass traditional trust controls. Malware blog BARRACUDA

8.8.26

 Dark Web Market: Vortex Market Vortex Market describes itself as a “classic wallet escrow market,” and that self-description is accurate. It is a general-purpose Dark Web marketplace built around anonymous trade, vendor reputation levels, and cryptocurrency payments held in market-controlled wallets. Reporting on mirror directories places the launch of the Vortex darknet market in October 2023 with full public access during 2024. CyberCrime blog SOCRADAR

8.8.26

 Formula 1 Phishing Campaign & Kit Analysis SOCRadar Threat Research Unit (STRU) has identified and analyzed a sophisticated, multi-stage phishing campaign that exploits the high-intensity demand for Formula 1 Grand Prix tickets. The attackers use highly convincing replicas of official ticketing platforms to deceive victims, tricking them into providing payment information and two-factor authentication (2FA) tokens. Phishing blog SOCRADAR

8.8.26

 Free tokens for sale: How fake signups drive AI fraud As AI models have become vastly more capable, these multifunctional tools are being used for a wide range of tasks—from coding and analysis to software testing, research, and vulnerability hunting. AI blog OKTA

8.8.26

 QuickFox Supply Chain Attack Used to Deploy FDMTP Implant The FortiGuard Labs Incident Response team analyzes a QuickFox supply chain attack that used trojanized Windows installers, selective targeting, and an evolving FDMTP implant Hacking blog FORTINET BLOG

8.8.26

 Inside Greatness: Telegram-Distributed M365 AiTM PhaaS ZeroBEC threat research on the Greatness phishing-as-a-service (PhaaS) platform, a commercially distributed kit sold via Telegram that combines adversary-in-the-middle (AiTM) credential and token theft with device code phishing in a single operator product. Social blog ZEROBEC BLOG

8.8.26

 Sorting the Agentic AI Hype From Black Hat 2026: 4 Things to Look For At the Mandalay Bay Convention Center, you could measure how fast the market is moving by counting the signs that read "Agentic AI" over the booth. The label was everywhere. What it actually meant changed booth to booth—and that is the problem you carry home. AI blog RELIAQUEST

8.8.26

 Agentic AI Security: The Chatbot Era Is Already Over There is a diagram most security teams still carry in their heads when they think about AI. A user talks to a chatbot. The chatbot talks to a large language model. The model talks back. Put an inspection point in the middle, and the problem is solved. AI blog IMPERVA

8.8.26

 Wallet-depleting macOS malware wants your crypto During a retrospective threat hunt in June 2026, a Huntress analyst found components of a Mac-specific stealer malware on a monitored system that had been infected three months earlier. Malware blog Huntress

8.8.26

 Fake Bank of America "Action Needed" Phishing Email Deposits ScreenConnect Instead We recently came across a fake Bank of America message that closely imitates the targeted bank's visual style, layout, and branding – from the initial phishing email, to the eventual webpage that victims are redirected to. Phishing blog Huntress

8.8.26

 Toolkit Installation via SQL Injection Shows the Classics Still Hit Huntress recently observed an incident that started with a "simple" SQL injection bug in an organization's vulnerable public-facing web app, and ended with OS-level remote code execution Hacking blog Huntress

8.8.26

 Living off the coding agent: Two tales of tunnels and LaunchAgents Agent-parented reverse tunnels and LaunchAgents can expose a local admin app to the internet. Endpoint still needs to treat that as high severity even when the activity looks like vibe-coded ops, not confirmed malware. AI blog ELASTIC

8.8.26

 Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows Public leaderboards can't tell you which LLM to trust in your SOC, so Elastic built an evaluation framework that grades models on the work (tool calls, execution traces, blind judging) across Agent Builder, Attack Discovery, and automatic migration. Security blog ELASTIC

8.8.26

 Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAINDROP, a worm that uses stolen npm credentials to backdoor co-owned packages totaling over 1.3 billion monthly downloads. Malware blog ELASTIC

8.8.26

 Payroll Pirates: Strange New Tides in Business Email Compromise Key Takeaways Arctic Wolf is tracking an active, widespread email-driven phishing campaign that uses adversary-in-the-middle (AiTM) techniques to compromise Microsoft 365 accounts, identify personnel involved Phishing blog ARTICWOLF

8.8.26

 Ransomware Moves up the Org Chart: Managers Are Prime Targets When a ransomware attack makes headlines, attention usually turns to the organization that was breached, the systems encrypted, data stolen, and disruption or ransom demand that followed. Ransom blog Zscaler

8.8.26

 Targeted Attack on Government Entities in the Middle East | Part 2 This is Part 2 of our two-part technical analysis on new tools used by an East Asia-linked threat actor targeting government entities in the Middle East. After ThreatLabz published Part 1 on the TELESHIM backdoor and MIXEDKEY loader, Kaspersky highlighted a related campaign in recent reporting. Hacking blog Zscaler

8.8.26

 ThreatLabz 2026 Report: Frontier AI and Enterprise Readiness It was 9:14 AM when the CISO's VPN connection momentarily dropped, something that normally wouldn’t cause any concern. What he couldn't see was that attackers had already exploited a pre-authentication flaw in the VPN appliance itself, gaining access before any login ever occurred. AI blog Zscaler

8.8.26

 Expanding AI Benchmarks in Cybersecurity Beyond Vulnerability Discovery The conversation about AI in cybersecurity has recently centered on capabilities like vulnerability discovery, exploit generation, and automated proof-of-concept development. It’s easy to see why: These tasks produce binary outcomes; a vulnerability either exists or it doesn't. That makes them useful for measuring model progress and demonstrating increasingly sophisticated cybersecurity capabilities. AI blog CROWDSTRIKE

8.8.26

 CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates Real-world case studies and observations demonstrate an increase in attacks on trusted relationships and adversarial use of AI. Exploit blog CROWDSTRIKE

8.8.26

 Secure Agent Harness Execution: Preventing Escape CrowdStrike uses a defense-in-depth architecture, consisting of seven independent control layers, to prevent autonomous AI agents from taking unintended actions. Vulnerebility blog CROWDSTRIKE

8.8.26

 N-able N-central exploitation results in RMM tool deployment After compromising systems via CVE-2026-18577, threat actors use the additional RMM tools and network tunnels to establish persistent remote access Vulnerebility blog SOPHOS

8.8.26

 Interlock ransomware gang creates volatile situation Multiple legitimate DFIR tools abused by GOLD EMBRACE double-extortion specialists Ransom blog SOPHOS

8.8.26

 GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. AI blog GTI

8.8.26

 UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments Google Threat Intelligence Group (GTIG) continues to track UNC6671 actively conducting compromises leading to data theft extortion, despite the alleged announced retirement of the BlackFile extortion brand in May 2026. Cyber blog GTI

8.8.26

 Ransomware Threats in Europe H1 2026: A Deep Dive into Regional Attack Patterns and Dominant Threat Actors Europe faced a ransomware onslaught in the first half of 2026 that sets a troubling precedent for the remainder of the year. According to Cyble Research and Intelligence Labs (CRIL), the region experienced 866 documented… Ransom blog Cyble

8.8.26

 From Stolen Credentials to Full Breach: The 72-Hour Timeline The 72-hour Timeline reveals how stolen credentials can escalate into a cyberattack, showing key attack stages and detection opportunities. CyberCrime blog Cyble

8.8.26

 The Assets You Don’t Know You Own: Attack Surface Sprawl Is a Discovery Problem, Not a Tooling Problem Discover why continuous asset discovery is the foundation of attack surface management and how visibility helps reduce cyber risk and exposure. Hacking blog Cyble

8.8.26

 From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide  A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. Malware blog Microsoft blog

8.8.26

 ChainDrop supply chain compromise: Anatomy of a self-propagating worm A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates. Malware blog Microsoft blog

8.8.26

 MythStealer: Browser and Discord Credential Theft with HTTPS Exfiltration to Operator-Notified C2 The Sonicwall Threats research team have recently been tracking an information-stealer malware family known as Myth. The sample we analyzed is a 43.8 MB Windows executable combining browser credential theft, Discord session token extraction, Firefox cookie harvesting, and HTTPS exfiltration into a single binary. Malware blog SonicWall

8.8.26

 AI Meets Ransomware : Open‑Weight AI Models Fueling Ransomware Evolution This week, the SonicWall Capture Labs Threat Research team analyzed an interesting ransomware sample discovered about an year ago, that leverages AI capabilities in its attack workflow. Unlike conventional ransomware that embeds its malicious logic directly within the binary, PromptLock adopts a fundamentally different approach. Ransom blog SonicWall

8.8.26

 No File, No Trace: How a Fake Invoice Hides a Formbook Loader in Plain Sight This week, the SonicWall Capture Labs Threat Research Team identified an ongoing campaign distributing Formbook malware through phishing emails disguised as routine business documents, purchase orders, shipping notices, and request-for-quote attachments targeting unsuspecting users and businesses. Cyber blog SonicWall

8.8.26

 Langflow AI Untrusted Control Sphere Remote Code Execution The SonicWall Capture Labs threat research team became aware of an unauthenticated remote code execution vulnerability in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. AI blog SonicWall

8.8.26

 ChainDrop: Inside a Self-Propagating npm Worm A self-propagating npm worm nicknamed ChainDrop infected over 400 packages that are collectively downloaded hundreds of millions of times each week. This includes malicious versions of widely used packages such as keyv and cacheable-request. Unit 42 has unique observations of this attack. Malware blog Palo Alto

8.8.26

 The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software Frontier AI is fundamentally shifting the dynamics of cybersecurity — accelerating both how vulnerabilities are discovered and how quickly they can be exploited. AI blog Palo Alto

8.8.26

 Token Jacking: Cybercriminals Could Be Stealing Your AI Resources It’s three a.m., do you know what your AI agent is doing? Unit 42 has responded to a growing number of AI token jacking cases resulting in staggering financial losses. AI blog Palo Alto

8.8.26

 “Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI Talos has collected prompt logs from threat actor endpoints running various applications, such as Claude Code, CodeX, Cursor, or Gemini. This blog is an analysis of the ways we've seen bad actors leveraging cloud-based AI. AI blog CISCO TALOS

8.8.26

 Why metaphor may dictate your security strategy In this week's newsletter, Martin looks at how the metaphors we use to describe AI "escaping" its sandbox can completely change how we react to the threat. Cyber blog CISCO TALOS

8.8.26

 [Webinar] Tales from the Frontlines: An exclusive briefing on Q2 incidents Register for an exclusive, unrecorded 30-minute webinar to review the most high-impact incidents Talos IR faced in Q2. Incident blog CISCO TALOS

7.8.26

 Payroll Pirates Payroll Pirates: Strange New Tides in Business Email Compromise CAMPAIGN CAMPAIGN

7.8.26

 SCTPhantom SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free VULNEREBILITY VULNEREBILITY

7.8.26

 CVE-2026-64564 In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). VULNEREBILITY VULNEREBILITY

7.8.26

 CVE-2026-44613 Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the user's behalf through REST and WebSocket endpoints. VULNEREBILITY VULNEREBILITY

7.8.26

 ChainDrop ChainDrop: When Opening a Repository Becomes Execution CAMPAIGN CAMPAIGN

7.8.26

 CVE-2026-54316 Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions VULNEREBILITY VULNEREBILITY

7.8.26

 CVE-2026-12537 Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file. VULNEREBILITY VULNEREBILITY

7.8.26

 CVE-2026-63913 In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. VULNEREBILITY VULNEREBILITY

7.8.26

 CVE-2026-56181 Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network. VULNEREBILITY VULNEREBILITY

7.8.26

 natjack A NEW ATTACK CLASS AGAINST NETWORK INFRASTRUCTURE DEVICES ATTACK ATTACK

7.8.26

 CVE-2026-64561 A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit (MMU) page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing child shadow pages to Verdana an invalid state. VULNEREBILITY VULNEREBILITY

7.8.26

 ShadowRay 2.0 New Intelligence Links TeamPCP to ShadowRay 2.0 and Traces Activity back to 2020 CAMPAIGN CAMPAIGN

7.8.26

 CVE-2026-64561 In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. VULNEREBILITY VULNEREBILITY

7.8.26

 Zapscape Zapscape (CVE-2026-64561) is a use-after-free vulnerability that occurs in the shadow MMU of KVM/x86. When an attacker-controlled guest that uses nested virtualization makes KVM recursively zap a root shadow page that is still in use during MMU page quota reclaim, KVM keeps handling the fault on a root that has already become invalid. As a result an invalid child enters the active MMU page list, and afterwards the same list link is attached to two lists at once and then freed, producing a dangling link and a post-free write. VULNEREBILITY VULNEREBILITY

7.8.26

 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers A use-after-free bug in Linux's SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The flaw has existed since Vulnerebility The Hacker News

7.8.26

 New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) Attack The Hacker News

7.8.26

 Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle Phishing The Hacker News

7.8.26

 AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle , generated and proved new HTTP AI The Hacker News

7.8.26

 Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools Infostealers are a rapidly evolving threat, enabling various adversaries, ranging from ransomware groups and hacktivists to nation-state actors, to exploit stolen credentials for unauthorized access to sensitive resources. In today’s threat landscape, identity is a primary target, with attackers seeking diverse credentials including usernames, passwords, tokens, and seed phrases.  Virus SOCRADAR

7.8.26

 Snowflake Hacker Pleads Guilty, Faces 32 Years Snowflake hacker Connor Riley Moucka pleaded guilty on August 5, 2026, in the U.S. District Court for the Western District of Washington, admitting to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy count tied to the 2024 breaches of Snowflake customer accounts. CyberCrime SOCRADAR

7.8.26

 Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005) AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and In March 2026, Hauri disclosed an attack case in which the malware was disguised as an integrated security program. Hack AHNLAB

7.8.26

 CVE-2026-44613: Turning a CSRF into Silent Unauthorized Actions Apache Zeppelin’s default CORS configuration allowed cross-origin, credentialed, state-changing requests (and accepted text/plain request bodies), letting a remote attacker who lures an authenticated user to a malicious site perform unauthorized actions through Zeppelin’s REST and WebSocket endpoints. Vulnerebility OX

7.8.26

 Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables. Virus The Hacker News

7.8.26

 Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's AI The Hacker News

7.8.26

 TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign A new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating Hack The Hacker News

7.8.26

 New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts Zapscape , a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM Vulnerebility The Hacker News

6.8.26

 TONTOU: On the Exploitability of Time-of-Neutralization to Time-of-Use Windows Recently deployed Spectre v2 mitigations neutralize branch predictor state when switching privilege contexts or immediately prior to indirect branch execution, either through domain isolation or sanitization. These defenses assume that subsequent branch predictor behavior remains free from attacker influence until the neutralized state is used. EXPLOIT EXPLOIT

6.8.26

 CVE-2026-20303 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20304 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20304 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20310 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20310 are related to improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-59. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20269 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20269 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20268 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20268 are related to issues with improper restriction of operations within the bounds of a memory buffer that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-119. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20267 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by&nbsp;CVE-2026-20267 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar&nbsp;CWE-284. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20289 A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging level and then collecting the system logs. A successful exploit could allow the attacker to view sensitive information like user login credentials. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20294 A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types that are not included in the encryption allowlist. A low-privileged attacker could exploit this vulnerability by viewing logs on the local system or on a remote logging server. A successful exploit could allow the attacker to view sensitive authentication credentials, which could lead to further compromise of network infrastructure and connected services. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20028 Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed to be strings and passed unmodified to Preact as children, a specially-crafted JSON payload could be constructed that would be incorrectly treated as a valid VNode. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20308 A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the web-based management interface to become unresponsive. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20311 A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error handling in the web-based management interface. An attacker could exploit this vulnerability by authenticating with a malformed certificate. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20316 A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20200 CVE-2026-20200: Cisco Cisco Unified Computing System (Standalone): A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with… VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20288 A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with&nbsp;Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.&nbsp; VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20301 CVE-2026-20301: Cisco: A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol,… VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20263 GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20124 The PhotoStack Gallery plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 0.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-20079 A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.&nbsp; VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability KEV KEV

6.8.26

 CVE-2026-18236 A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. VULNEREBILITY VULNEREBILITY

6.8.26

 CVE-2026-18830 Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required. VULNEREBILITY VULNEREBILITY

6.8.26

 ENDLESSDOORS ENDLESSDOORS Is Phoning Home. Pick Up. MALWARE MALWARE

6.8.26

 Cost of a Data Breach Report 2026
The AI tipping point		 Welcome to the 21st annual Cost of a Data Breach Report. Frontier AI models have radically shifted the cybersecurity threat landscape. REPORT REPORT

6.8.26

 macOS ClickFix campaign From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide CAMPAIGN CAMPAIGN

6.8.26

 Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of Vulnerebility The Hacker News

6.8.26

 New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel Hack The Hacker News

6.8.26

 Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network. Its August 3 scan ICS The Hacker News

6.8.26

 CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains . Introduced in Cryptocurrency The Hacker News

6.8.26

 Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses Cybersecurity researchers have disclosed a security issue with Apple's iCloud Private Relay tool that can expose a user's real IP address. OS The Hacker News

6.8.26

 Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post- Attack The Hacker News

6.8.26

 AWS, Google, and Vercel Patch Agent Flaws That Let Tool Calls Skip the Model Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several of Vulnerebility The Hacker News

6.8.26

 Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. Virus The Hacker News

6.8.26

 Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel , the Ransom The Hacker News

6.8.26

 CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild , according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The Exploit The Hacker News

6.8.26

 Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People Connor Riley Moucka pleaded guilty in Seattle federal court on Wednesday to computer fraud, wire fraud, aggravated identity theft and a related CyberCrime The Hacker News

6.8.26

 IBM report sees deep fakes emerging as top AI attack threat IBM study finds deepfake attacks now account for nearly half of AI-enabled breaches as organizations grapple with rising costs and expanding cyber risks. AI BARRACUDA

6.8.26

 Malware signing: When trust becomes an attack surface How cybercriminals use stolen, fraudulent, and commercialized code-signing certificates to make malware appear legitimate and bypass traditional trust controls. Virus BARRACUDA

6.8.26

 Dark Web Market: Vortex Market Vortex Market describes itself as a “classic wallet escrow market,” and that self-description is accurate. It is a general-purpose Dark Web marketplace built around anonymous trade, vendor reputation levels, and cryptocurrency payments held in market-controlled wallets. CyberCrime SOCRADAR

6.8.26

 Formula 1 Phishing Campaign & Kit Analysis SOCRadar Threat Research Unit (STRU) has identified and analyzed a sophisticated, multi-stage phishing campaign that exploits the high-intensity demand for Formula 1 Grand Prix tickets. Phishing SOCRADAR

6.8.26

 Free tokens for sale: How fake signups drive AI fraud As AI models have become vastly more capable, these multifunctional tools are being used for a wide range of tasks—from coding and analysis to software testing, research, and vulnerability hunting. AI OKTA

6.8.26

 QuickFox Supply Chain Attack Used to Deploy FDMTP Implant The FortiGuard Labs Incident Response team analyzes a QuickFox supply chain attack that used trojanized Windows installers, selective targeting, and an evolving FDMTP implant Hack FORTINET BLOG

6.8.26

 Inside Greatness: Telegram-Distributed M365 AiTM PhaaS ZeroBEC threat research on the Greatness phishing-as-a-service (PhaaS) platform, a commercially distributed kit sold via Telegram that combines adversary-in-the-middle (AiTM) credential and token theft with device code phishing in a single operator product. Phishing ZEROBEC BLOG

6.8.26

 Fake Bank of America "Action Needed" Phishing Email Deposits ScreenConnect Instead We recently came across a fake Bank of America message that closely imitates the targeted bank's visual style, layout, and branding – from the initial phishing email, to the eventual webpage that victims are redirected to. Phishing Huntress

6.8.26

 Toolkit Installation via SQL Injection Shows the Classics Still Hit Huntress recently observed an incident that started with a "simple" SQL injection bug in an organization's vulnerable public-facing web app, and ended with OS-level remote code execution Hack Huntress

6.8.26

 Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAINDROP, a worm that uses stolen npm credentials to backdoor co-owned packages totaling over 1.3 billion monthly downloads. Virus ELASTIC

6.8.26

 The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2 An exposed open directory at 193.233.202[.]17 caught an operator tied to The Gentlemen ransomware mid-intrusion, setting up a Windows domain for persistent access, credential theft, and lateral movement. The files left behind trace the full operation, from privileged account creation and LSASS dumping to security-product tampering and reverse tunnels. Virus HUNT.IO

6.8.26

 Targeted Attack on Government Entities in the Middle East | Part 2 This is Part 2 of our two-part technical analysis on new tools used by an East Asia-linked threat actor targeting government entities in the Middle East. Virus Zscaler

6.8.26

 Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had Virus The Hacker News

6.8.26

 OpenAI Disrupts Poipet Scam Network Using ChatGPT Across Multiple Fraud Schemes OpenAI said it disrupted a Cambodia-based scam operation that used its generative artificial intelligence (AI) chatbot ChatGPT to facilitate a wide AI The Hacker News

5.8.26

 CVE-2026-58073 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. VULNEREBILITY VULNEREBILITY

5.8.26

 CVE-2026-58072 A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution. VULNEREBILITY VULNEREBILITY

5.8.26

 CVE-2026-58067 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service. VULNEREBILITY VULNEREBILITY

5.8.26

 CVE-2026-58071 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins. VULNEREBILITY VULNEREBILITY

5.8.26

 Breaking the Paperclip Critical Vulnerabilities in AI Agent Orchestration

5.8.26

 CVE-2026-41679 Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. VULNEREBILITY VULNEREBILITY

5.8.26

 CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. VULNEREBILITY VULNEREBILITY

5.8.26

 OVSwrap OVSwrap (CVE-2026-64531) local root exploit: mitigation for CloudLinux 9, 10, and CloudLinux for Ubuntu VULNEREBILITY VULNEREBILITY

5.8.26

 CVE-2026-60004 . When these hook scripts are subsequently triggered during Git operations, they execute arbitrary shell commands with the privileges of the Gitea process user. VULNEREBILITY VULNEREBILITY

5.8.26

 CVE-2026-49774 Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0. VULNEREBILITY VULNEREBILITY

5.8.26

 keyv and cacheable compromise On August 4, 2026, a threat actor compromised the source or release credentials for the widely used keyv and cacheable npm packages and published trojanized versions of at least ten packages, beginning with keyv@6.0.0 at 09:35 UTC. Unlike a typical dependency swap, each version carries a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime and executes an obfuscated ~728 KB second stage (Math_Symbol.js). CAMPAIGN CAMPAIGN

5.8.26

 Hump Hump Locker Ransomware Symantec's Threat Intelligence teams worldwide offer unparalleled analysis and commentary on current cyberthreats impacting businesses. Symantec's browser extensions integrate this intelligence directly into your browser, enabling effective detection and blocking of various web-borne threats. ALERTS RANSOM

5.8.26

Ongoing Threats of Swatting and Indicators for Community Members

This Public Service Announcement (PSA) is an update to Alert Number I-042925-PSA titled, "Threat Actors Use 'Swatting' to Target Victims Nationwide." This PSA contains updated information about the ongoing threat posed by “swatting” incidents targeting a variety of locations across the United States, including educational institutions, government buildings, religious institutions, public transportation centers, hospitals, and other public buildings.

IC3

IC3 PRESS

5.8.26

CVE-2026-9198

IBM Langflow Code Injection Vulnerability: Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.

IBM | Langflow

ECV

5.8.26

CVE-2026-34486

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability: Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.

Apache | Tomcat

ECV

5.8.26

CVE-2026-18556

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability: N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.

N-able | N-central

ECV

5.8.26

 CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability: N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. N-able | N-central ECV

5.8.26

 CVE-2026-9198 IBM Langflow Code Injection Vulnerability KEV KEV

5.8.26

 CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability KEV KEV

5.8.26

 CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability KEV KEV

5.8.26

 CVE-2026-9198 (CVSS score: 9.8) - A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. (Fixed in July 2026 with version 1.10.1) VULNEREBILITY VULNEREBILITY

5.8.26

 CVE-2026-34486 (CVS score: 7.5) - A missing encryption of sensitive data vulnerability in Apache Tomcat that allows a bypass of EncryptInterceptor, a cluster component that adds pre-shared key encryption to messages sent between cluster nodes. (Fixed in April 2026 with versions 11.0.21, 10.1.54, and 9.0.117) VULNEREBILITY VULNEREBILITY

5.8.26

 Security Incident INC-2026-07-28-01 The UK AI Security Institute (AISI) exists to equip governments with a scientific understanding of the risks posed by advanced AI. To achieve that goal, AISI routinely evaluates the capabilities of frontier AI systems in domains such as cybersecurity. REPORT REPORT

5.8.26

 QuickFox QuickFox Supply Chain Attack Used to Deploy FDMTP Implant CAMPAIGN CAMPAIGN

5.8.26

 Telegram-Distributed M365 AiTM PhaaS ZeroBEC threat research on the Greatness phishing-as-a-service (PhaaS) platform, a commercially distributed kit sold via Telegram that combines adversary-in-the-middle (AiTM) credential and token theft with device code phishing in a single operator product. PHISHING PhaaS

5.8.26

 Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Cybersecurity researchers have discovered more than half-a-dozen services advertisements for illegal access to artificial intelligence (AI) AI The Hacker News

5.8.26

 Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports Two security flaws in Paperclip could let attackers execute commands on a network server or a developer's computer. Paperclip is an open-source AI The Hacker News

5.8.26

 Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Vulnerebility The Hacker News

5.8.26

 Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the Virus The Hacker News

5.8.26

 77 evil twin Open VSX extensions Between July 26 and August 1, 2026, our monitoring systems identified 77 Open VSX extensions that beacon to the same newly registered domain. Each one republishes the name, namespace and description of a real, unrelated extension at a low version number, almost always 0.0.1, under an account that does not own the namespace and does not belong to the original author Hack MANIFOLD

5.8.26

 A Massive Shai-Hulud Campaign Hits npm: +440 Packages Compromised, Over 2B Monthly Downloads A massive Shai-Hulud campaign hit npm, affecting over 2 billion monthly downloads of packages, the code contains the classic infostealer logic, and self propagating code. Virus OX SECURITY

5.8.26

 ChainDrop supply chain compromise: Anatomy of a self-propagating worm Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, including packages associated with major enterprise software ecosystems such as keyv, flat-cache, cache-manager, and others. Hack Microsoft blog

5.8.26

 New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default- Vulnerebility The Hacker News

5.8.26

 Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled Phishing The Hacker News

5.8.26

 Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup An unauthenticated attacker can read any file the service account can access on Gitea , the self-hosted Git platform, in versions 1.22.1 through Vulnerebility The Hacker News

5.8.26

 Leaked n8n API Tokens Exposed Live Instances to Credential Theft GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers Vulnerebility The Hacker News

5.8.26

 Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were Virus The Hacker News

5.8.26

 New DOUBLECUP ClickFix service hides malware in browser cache images A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. Virus BleepingComputer

5.8.26

 Fake Roblox Xeno script launcher pushes infostealer, RAT malware Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information. Virus BleepingComputer

5.8.26

 N-able warns of N-central auth bypass flaw exploited in attacks N-able is warning customers that hackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) affecting both hosted and on-premises N-central servers. Vulnerebility BleepingComputer

5.8.26

 ExfilSquad hackers leak info of over 100,000 UK police officers, staff A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals. Incindent BleepingComputer

5.8.26

 Inside the Underground Business of the Android BTMOB RAT malware Flare researchers analyzed thousands of underground posts to examine how the BTMOB Android malware operation evolved into a fragmented ecosystem of resellers, source-code vendors, custom versions, and competing sales channels. Virus BleepingComputer

5.8.26

 OpenAI teases Astra, its next major AI model, after it solves 10 long-standing math problems OpenAI has revealed Astra, an unreleased model designed to tackle complex, long-running tasks, after an internal version produced ten significant advances in mathematics and theoretical computer science. AI BleepingComputer

5.8.26

 COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft A vulnerability in COLDCARD hardware wallet firmware allowed attackers to steal an estimated $88.6 million in Bitcoin from thousands of wallets whose seeds were generated using a flawed random number generator. Vulnerebility BleepingComputer

5.8.26

 Google Chrome may soon block New Tab hijacker extensions by default Google is preparing a new Chrome security feature that would block policy-installed extensions from hijacking the New Tab page or changing the default search engine. Hack BleepingComputer

5.8.26

 Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself An agent running Anthropic's Claude Mythos 5 spent 34 hours trying to get a malware dropper merged into a real open-source project during a cyber AI The Hacker News

5.8.26

 CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities ( Exploit The Hacker News

5.8.26

 QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users. Virus The Hacker News

5.8.26

 Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code Phishing The Hacker News

4.8.26

 Powercat malware campaign Powercat malware campaign: Fake game cheats deliver infostealer CAMPAIGN CAMPAIGN

4.8.26

 Fake Xeno Roblox Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums MALWARE JAVA

4.8.26

 SMOKE#SCREEN Analyzing SMOKE#SCREEN: ScreenConnect RMM Abuse, Cloudflare Tunnels, and Trusted Software Lures CAMPAIGN CAMPAIGN

4.8.26

 Zero Day Provisioning Chaining TP-Link ZTP Vulnerabilities to Infiltrate Networks REPORT REPORT

4.8.26

 CVE-2025-9290 An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality. VULNEREBILITY VULNEREBILITY

4.8.26

 CVE-2025-9289 A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. VULNEREBILITY VULNEREBILITY

4.8.26

 Agent-to-Agent Privilege Boundary Failures I'll Just Call You: Agent-to-Agent Privilege Boundary Failures in CI/CD on Google's ADK Repository AI AI

4.8.26

 CVE-2026-58047 HTTP Smuggling in cPanel allows potential leak of credentials. VULNEREBILITY VULNEREBILITY

4.8.26

 CVE-2026-58048 Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context. VULNEREBILITY VULNEREBILITY

4.8.26

 DOUBLECUP Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs MALWARE LOADER

4.8.26

 Critical N-able N-central Vulnerability and Active Exploitation N-able has disclosed a critical vulnerability impacting all current versions of N-central, including 2026.3, across both hosted and on‑prem deployments. The flaw can give attackers unauthenticated, "god-mode" access to the RMM console. EXPLOIT EXPLOIT

4.8.26

 CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability KEV KEV

4.8.26

 Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026. SafeDep verified 353 Virus The Hacker News

4.8.26

 Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe Hack The Hacker News

4.8.26

 How legitimate cloud platforms enable phishers to bypass MFA We cover a cloud-based AitM attack scenario leveraging service workers and Ultraviolet, and provide detailed phishing hosting statistics across platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. Phishing SECURELIST

4.8.26

 Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue AI The Hacker News

4.8.26

 New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege Vulnerebility The Hacker News

4.8.26

 DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in Virus The Hacker News

4.8.26

 CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to Exploit The Hacker News

4.8.26

 18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments. Virus The Hacker News

3.8.26

 SonicWall SMA Exploit Chain From WSProxy to Root: INC ransomware and SonicWall SMA Exploit Chain EXPLOIT EXPLOIT

3.8.26

 Larva-24009 Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor GROUP GROUP

3.8.26

 DarkSword DarkSword's Panel Sprawl: How One Body Hash Unravels a Six-Panel, Two-Codebase Operator Cluster EXPLOIT EXPLOIT

3.8.26

 ExfilSquad ExfilSquad Targets Misconfigured Microsoft Power Pages Portals CAMPAIGN CAMPAIGN

3.8.26

 CVE-2026-17883 Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium) VULNEREBILITY VULNEREBILITY

3.8.26

 CVE-2026-18577 An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 VULNEREBILITY VULNEREBILITY

3.8.26

 CVE-2026-18556 Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1. VULNEREBILITY VULNEREBILITY

3.8.26

 FaceHugger FaceHugger: Vulnerabilities in Hugging Face Diffusers Open Door to Supply Chain Attacks on Enterprise AI VULNEREBILITY VULNEREBILITY

3.8.26

 CVE-2026-44827 (CVSS score: 8.8) - A code injection vulnerability that allows arbitrary code to be loaded through the custom_pipeline flow from a Hub repository by means of a crafted pipeline with the name "None.py" despite passing trust_remote_code=False (or omitting it, which is the default). VULNEREBILITY VULNEREBILITY

3.8.26

 CVE-2026-45804 (CVSS score: 7.5) - A race condition vulnerability that allows arbitrary code to be introduced to a repository by modifying the configuration between the hf_hub_download and snapshot_download HTTP calls to the Hub, leading to code execution. VULNEREBILITY VULNEREBILITY

3.8.26

 CVE-2026-44513 (CVSS score: 8.8) - A code injection vulnerability that allows arbitrary code to be loaded through the custom_pipeline flow from a Hub repository despite passing trust_remote_code=False (or omitting it). VULNEREBILITY VULNEREBILITY

3.8.26

 An analysis of incidents at Brazilian educational institutions Kaspersky expert provides statistics and details on several incident response cases at educational institutions in Brazil, as well as tips for schools and universities on how to stay safe. Incindent SECURELIST

3.8.26

 Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts Malware running as an ordinary user on a Windows machine can sign into a victim's passkey-protected accounts without a fingerprint, a PIN, or Hack The Hacker News

3.8.26

 INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Ransom The Hacker News

3.8.26

 Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS An unknown Chinese-threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. APT The Hacker News

3.8.26

 PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web. The data included names, organisations and BigBrothers The Hacker News

3.8.26

 Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable Thermo Fisher Scientific has patched a flaw in select Applied Biosystems human identification software that could allow data files to be altered Vulnerebility The Hacker News

3.8.26

 N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete N-able said attackers exploited an authentication bypass in N-central to gain remote administrative access and reach the customer systems Exploit The Hacker News

3.8.26

 Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library that could allow crafted model repositories to stealthily Vulnerebility The Hacker News

2.8.26

 AUR Attack Prompts Adoption Lock A new round of Arch User Repository malware has prompted the disabling of package adoption. ATTACK AI

2.8.26

 Threat H1 2026 December 2025 – May 2026 Report Welcome to the H1 2026 issue of the ESET Threat Report! REPORT REPORT

2.8.26

 Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers North Korea relies upon a network of skilled Information Technology (IT) workers, deployed within and outside of North Korea, to obtain false identities and remotely earn income to fund North Korea’s unlawful nuclear weapons and ballistic missile programs. IC3 IC3 INDUSTRY

2.8.26

 VirtualGHOST A "VirtualGHOST" (or just Ghost) is a VMware Virtual Machine on an ESXi host that has been powered on manually from the command line. MALWARE VMware ESXi

2.8.26

 CVE-2026-63077 In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol VULNEREBILITY VULNEREBILITY

2.8.26

 Rails patches critical Active Storage flaw with RCE potential A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE). Vulnerebility BleepingComputer

2.8.26

 Amgen says cloud data breach exposed patient health, proprietary info Pharmaceutical company Amgen says it suffered a data breach after threat actors stole corporate data and patient information stored in multiple cloud systems operated by third-party service providers. Incindent BleepingComputer

2.8.26

 Arch Linux disables AUR package adoption to stop malware flood Arch Linux disables AUR package adoption to stop malware flood Virus BleepingComputer

2.8.26

 Online ad firm Adform’s script compromised to steal cryptocurrency Online advertising firm Adform suffered a supply-chain attack that delivered cryptocurrency-stealing scripts to websites using its ad platform, replacing wallet addresses copied to visitors' clipboards with ones controlled by an attacker. Cryptocurrency BleepingComputer

2.8.26

 OpenAI says its new GPT 5.6 models are becoming more cost-efficient OpenAI says it has reduced the price of two GPT-5.6 models, cutting Luna's API price by 80% and Terra's by 20% as it works to make its models more efficient. AI BleepingComputer

2.8.26

 Hacker uses DeepSeek AI to autonomously attack vulnerable servers A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement. AI BleepingComputer

2.8.26

 CISA warns of cyberattacks disrupting U.S. water utilities The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a significant increase in attacks targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector. BigBrothers BleepingComputer

2.8.26

 ESET tracks rise in malicious AI skills and adaptable malware Attackers are adapting established techniques to AI platforms, emerging technologies, and changing user behavior. ESET's new threat report examines the rise of malicious AI skills, AI-assisted malware, ClickFix attacks, record quishing activity, and ransomware tools designed to disable security software AI BleepingComputer

2.8.26

 Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests One of Anthropic's Claude models built and uploaded a malicious Python package to PyPI during a botched security evaluation, where it ran on 15 real systems and stole credentials from a security vendor. It was one of three incidents affecting real companies. AI BleepingComputer

2.8.26

 South Korea fines telco giant KT $39 million for customer data breach South Korea fines telco giant KT $39 million for customer data breach Incindent BleepingComputer

2.8.26

 Network Anomaly Detection in KATA Once the attacker has breached the corporate network, subsequent stages of the attack often involve leveraging standard domain infrastructure protocols: using Kerberos, running DNS queries, accessing internal services, opening network shares, and other common networking actions. Security SECURELIST

2.8.26

 Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Cryptocurrency The Hacker News

2.8.26

 JetBrains warns of critical TeamCity remote code execution flaw JetBrains is warning of a critical authentication bypass vulnerability affecting TeamCity On-Premises that could be exploited to achieve remote code execution. Vulnerebility BleepingComputer

2.8.26

 Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers Amazon linked multiple high-profile open-source software supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers. APT BleepingComputer

2.8.26

 VMware fixes three critical flaws allowing auth bypass, VM escapes Broadcom has released security updates to fix five vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, including three critical flaws that allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host. Vulnerebility BleepingComputer

2.8.26

 Google says AI helped Chrome fix 1,072 security bugs in two releases Google says artificial intelligence is dramatically increasing the number of security vulnerabilities it can find and fix in Chrome, with more than 1,000 security bugs patched across the browser's two most recent releases as it expands its use of AI. AI BleepingComputer

2.8.26

 ShinyHunters claims Brinks Home breach, threatens to leak stolen data Residential security company Brinks Home has disclosed that hackers breached some of its systems and are threatening to leak allegedly stolen data. Incindent BleepingComputer

2.8.26

 Microsoft Teams vishing attacks lead to Chaos ransomware attacks Threat actors are impersonating IT support staff in Microsoft Teams calls to gain remote access to corporate devices and deploy Chaos ransomware in attacks targeting North American organizations. Ransom BleepingComputer

2.8.26

 Analog Devices discloses data breach, says operations unaffected Analog Devices discloses data breach, says operations unaffected Incindent BleepingComputer

2.8.26

 Russian hackers exploit Exchange OWA zero-day for long-term mailbox access The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper. APT BleepingComputer

2.8.26

 Anthropic confirms Claude is down worldwide Claude is down for some users, with Anthropic confirming elevated errors across multiple AI models. The disruption is causing requests to fail with a "529 Overloaded" message, including in Claude and tools that rely on its API. AI BleepingComputer

2.8.26

 Cisco warns of FMC static credential flaw exploited in zero-day attacks Cisco is warning that a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices. Vulnerebility BleepingComputer

2.8.26

 Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare Health-ISAC, a cybersecurity information-sharing organization for the health sector, is warning healthcare and medical technology organizations of an observed increase in successful attacks by ShinyHunters. CyberCrime BleepingComputer

1.8.26

 CVE-2026-61511 vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. VULNEREBILITY VULNEREBILITY

1.8.26

 CVE-2013-4786 The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC. VULNEREBILITY VULNEREBILITY

1.8.26

 ValleyRAT distribution campaign targeting organizations in Japan As reported by the researchers from Cato Networks, the Monarch threat group (aka SilverFox) has recently launched a malicious campaign targeting a Japanese industrial manufacturing company to deliver ValleyRAT, a persistent remote access trojan. Initiated via invoice-themed phishing emails linked to attacker-controlled content hosted on legitimate Tencent Cloud and QQ services, the attack drops a compressed file containing an initial downloader executable. ALERTS VIRUS

1.8.26

 AtlasRAT malware variant AtlasRAT is a Remote Access Trojan (RAT) variant delivered through malicious setup files disguised as legitimate Flash Player software. As reported by researchers from ASEC, to obfuscate its command-and-control traffic, AtlasRAT utilizes ChaCha20 encryption over TLS, employing self-signed certificates spoofed to resemble Microsoft update infrastructure. ALERTS VIRUS

1.8.26

 SmartApeSG ClickFix campaign pushes unidentified RAT Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

1.8.26

 Seven days of scans and probes and web traffic hitting my web server Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

1.8.26

 CVE-2026-48448 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. VULNEREBILITY VULNEREBILITY

1.8.26

 CVE-2026-48449 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. VULNEREBILITY VULNEREBILITY

1.8.26

 CaptiveCrunch CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft CAMPAIGN CAMPAIGN

1.8.26

 Matryoshka Nested Trust: HollowFrame’s Layered Loader and Matryoshka Backdoors MALWARE Backdoor

1.8.26

 OpenAI agent used exposed credentials at 4 services in Hugging Face breach In a new update, OpenAI says its AI models also used publicly exposed credentials to compromise accounts on four third-party services during the recent attack on Hugging Face, expanding the scope of the four-day security incident to other organizations. AI BleepingComputer

1.8.26

 Hackers disrupt over 30 Minnesota water utilities in coordinated OT attack The Minnesota IT Services (MNIT) agency activated its cybersecurity incident response capabilities across the entire state after hackers targeted more than 30 community water systems in "a coordinated cyberattack." Incindent BleepingComputer

1.8.26

 Your AI Agents Are Guessing at Scale: Permissions Decide the Damage AI agents are designed to improvise as they complete tasks, making broad permissions a growing security risk. Token Security explains why identity, intent-based access controls, and least privilege are becoming the foundation for securing agentic AI. AI BleepingComputer

1.8.26

 Windows 11 KB5101684 update released with 42 changes and fixes Microsoft has released the KB5101684 preview cumulative update for Windows 11 24H2 and 25H2, which 42 bug fixes and additional feature improvements for the operating system. OS BleepingComputer

1.8.26

 These near-mint ASUS Chromebook refurbs are only $145 Buying a new computer in 2026 is a unique experience. Rather than deal with incredibly high tech prices, more shoppers are opting for high-quality refurbished tech. This ASUS Chromebook CM30 refurb is in near-mint condition with a grade "A" rating, but it still only costs $144.97 (reg. $369.99) on sale. Security BleepingComputer

1.8.26

 CubePilot drone software dev hit by DNS hijacking to intercept traffic CubePilot, an Australian firm that designs flight controllers for drones (UAVs), announced a severe operational disruption caused by a DNS hijacking attack. AI BleepingComputer

1.8.26

 OpenAI models used Artifactory zero-days to escape to the internet JFrog has confirmed that OpenAI models exploited zero-day vulnerabilities in self-hosted Artifactory servers to help escape an isolated testing environment and gain access to the internet before attacking Hugging Face. AI BleepingComputer

1.8.26

 CISA shares advice on isolating vital systems during cyberattacks The U.S. and Australian governments have released new guidance urging critical infrastructure organizations to prepare to isolate vital operational technology systems in the event of a cyberattack or other major disruptions. ICS BleepingComputer

1.8.26

 vBulletin fixes critical pre-auth RCE flaw with public exploit A critical vulnerability in the vBulletin forum software allows unauthenticated attackers to execute arbitrary PHP code through template rendering. Vulnerebility BleepingComputer

1.8.26

 Is Your SSO Protected Against Modern Credential Attacks? A compromised SSO login can provide attackers with access to multiple enterprise applications and services. Specops Software explains how stronger passwords, phishing-resistant MFA, and identity hardening help secure modern SSO environments and the applications they protect. Security BleepingComputer

1.8.26

 Over 24,000 exposed server BMCs leak password hash via decades-old flaw More than 24,000 internet-exposed servers are leaking authentication password hashes due to a 20-year-old vulnerability in their Baseboard Management Controller (BMC) interface. Incindent BleepingComputer

1.8.26

 Data breach at medical billing firm MCBS affects 1.26 million people Healthcare billing company Medical Computer Business Services (MCBS) has disclosed that a 2025 network breach exposed the sensitive information of more than 1.2 million people. Incindent BleepingComputer

1.8.26

 Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites Attackers modified a JavaScript file served by advertising technology company Adform , turning it into a browser-side tool that rewrites Cryptocurrency The Hacker News

1.8.26

 Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing Vulnerebility The Hacker News

1.8.26

 Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake , a remote access trojan (RAT) that can capture webcam Virus The Hacker News

1.8.26

 Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in APT The Hacker News

1.8.26

 HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based Virus The Hacker News

1.8.26

 Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies Bitsight says some cheap Android TV boxes have shipped with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo Hack The Hacker News

1.8.26

 [Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group) This technical analysis report was prepared as part of the joint cybersecurity advisory titled “Advisory on Cyberattacks Targeting Korean Citizens and Businesses by State-Sponsored Hacking Groups” issued by the Republic of Korea’s National Intelligence Service (NIS), National Police Agency (NPA), Korea Internet & Security Agency (KISA), and Financial Security Institute (FSI). Ransom blog AHNLAB

1.8.26

 Not Every Fox is Silver: Inside an AtlasRAT loader chain AtlasRAT is a Windows-based remote access malware. This report analyzes a four-stage in-memory loader chain—which begins with a Delphi executable that is disguised as AGE Flash Player—and its final RAT functionality. The final payload performs TLS-based ChaCha20-encrypted C2 communication, executes modular plugins, performs offline keylogging, and injects DLLs into WeChat processes. Malware blog AHNLAB

1.8.26

 Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner. While the installation of CoinMiner is common in attack cases targeting MS-SQL servers, in this particular attack case, the attacker installed VShell and GotoHTTP to gain control over the infected system and also installed SoftEther to use it as a VPN server. Hacking blog AHNLAB

1.8.26

 June 2026 Threat Trend Report on APT Attacks (South Korea) AhnLab monitored domestic APT (Advanced Persistent Threat) attacks—which are conducted covertly and persistently—using its own infrastructure. This report summarizes the classification and statistics on domestic APT attacks identified in June 2026 and describes the capabilities of each type of APT attack. APT blog AHNLAB

1.8.26

 Bitdefender Threat Debrief | July 2026 This edition of the Bitdefender Threat Debrief covers the latest developments in the ransomware threat landscape, including Qilin’s fall from the number one rank in Top Groups. Other events featured in this release include the arrest of a Scattered Spider operator, the criminal act of ransom negotiation, and an update on the FortiBleed campaign. Cyber blog BITDEFENDER

1.8.26

 Operation BlueDash: Multi-RMM Workplace Phishing ZeroBEC investigated a live Microsoft Teams-themed phishing operation that began with a "secure document" email and ended with the silent enrollment of the victim endpoint into attacker-controlled remote monitoring and management environments. Phishing blog ZEROBEC BLOG

1.8.26

 Kali365 Ringer: Targeting Financial and Insurance Sectors ZeroBEC prevented a Kali365 device-code phishing attack targeting a financial, regulated customer environment. The lure used a missed-call notification and a trusted Google Sites wrapper before redirecting through Google redirector, OCI API Gateway, and a Cloudflare-protected Kali365 host. The campaign targeted multiple organizations on the same day, including financial and insurance services customers, using the same Google Sites landing page, sender subdomain, subject pattern, and fake internal reference ID. Phishing blog ZEROBEC BLOG

1.8.26

 Inside JIVS PhishKit: A Domain-Adaptive Credential Harvester ZeroBEC prevented a coordinated mailbox credential-harvesting campaign targeting multiple users within the same Microsoft 365 organization. The messages used an authenticated but unrelated external sender, warned that each recipient mailbox had violated policy, and directed users to a live PHP phishing page on corychase[.]org. Phishing blog ZEROBEC BLOG

1.8.26

 Apple Libnotify/notifyd Stack Overflow (CVE-2026-64739) — Discovered by ThreatBook XGPT On July 27, 2026, Apple released security updates for iOS 26.6 and iPadOS 26.6, fixing vulnerabilities across several components — Accessibility, Kernel, Libnotify, and WebKit. Among them is CVE-2026-64739, a stack-based buffer overflow in Libnotify/notifyd found and reported to Apple by ThreatBook XGPT. Vulnerebility blog THREATBOOK

1.8.26

 Fastjson RCE (≤1.2.83): Active Exploitation Detected — Detection & Mitigation A remote code execution vulnerability in Fastjson affects every version up to and including 1.2.83. A remote attacker can run arbitrary code on a vulnerable server by sending it specially crafted JSON — no user privileges, no victim interaction, and no third-party libraries required. ThreatBook TDP® (Threat Detection Platform) has already captured this vulnerability being exploited in the wild, so if you run an affected version without SafeMode enabled, treat remediation as urgent. Exploit blog THREATBOOK

1.8.26

 Threat Coverage Digest: New TI Report, Threat Research and 750+ Detection Rules July brought another set of threat coverage updates designed to help security teams work faster and with more confidence. ANY.RUN added 42 behavior signatures, 11 YARA rules, and 703 Suricata rules, giving SOCs broader visibility across files, malware behavior, and network activity. Security blog ANYRUN BLOG

1.8.26

 The US CFO’s Playbook: How to Reduce Cyber Risk Without Scaling SOC Team in a Tight Labor Market Cyber risk is increasing, but so is the cost of managing it. More than 514,000 cybersecurity job listings appeared in the US between May 2024 and April 2025, while the mean annual wage for an information security analyst reached $132,510. Cyber blog ANYRUN BLOG

1.8.26

 Building Resilience Against AiTM Phishing: What SOC Leaders Should Know Email gateways, endpoint controls, and file-centric sandboxing remain essential layers of defense. But many of today’s phishing attacks unfold in ways they weren’t designed to fully expose. Phishing blog ANYRUN BLOG

1.8.26

 Infrastructure Health, Now Agentic: The IT Engineer Teammate Is Here Technology and infrastructure health is the foundation of the SOC. Investigations, threat hunts, and detection engineering all assume the same thing: the tools underneath are up, generating telemetry, and functioning as intended. When that assumption breaks, the rest of the SOC breaks with it. Security blog RELIAQUEST

1.8.26

 DNS Poisoning Tactics Expand to Hospitality Wi-Fi Adversaries have been compromising public Wi-Fi gateways at hotels, conference centers, and other shared venues to hijack the accounts of traveling corporate employees. Once they control the Wi-Fi gateway, they quietly redirect users to attacker-controlled infrastructure to steal credentials, in activity ongoing since at least June 2026. Hacking blog RELIAQUEST

1.8.26

 The Five Questions Every Security Team Should Be Asking After the OpenAI–Hugging Face Incident On Tuesday, July 21, OpenAI reported that its own AI models were behind an unprecedented cyber incident against the open-source developer platform, Hugging Face. A combination of GPT-5.6 Sol, and a more capable, unreleased model broke out of a sandboxed testing environment, reached the public internet, and exploited a vulnerability to access Hugging Face's systems. AI blog RELIAQUEST

1.8.26

 Fake Claude Install Guide Leads to MacSync Stealer and RAT: What We Pulled From the Attacker’s Servers Huntress recently investigated an incident where the victim searched Google for how to install Claude on a Mac, clicked a sponsored result, and landed on a weaponised claude.ai/share conversation dressed up as an Apple Support install guide. It told them to open Terminal and paste a single curl command. Malware blog Huntress

1.8.26

 Huntress Threat Advisory: Widespread SonicWall Credential Stuffing Campaign Starting on July 25, 2026, at approximately 18:02:21 UTC, the Huntress SOC detected an out-of-the-ordinary spike in successful SonicWall VPN and firewall logins. These logins originated from a suspicious Autonomous System Number (ASN). We did not observe any post-compromise hands-on-keyboard activity from these attacks. Cyber blog Huntress

1.8.26

 Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT Between July 21 and July 22, 2026, Huntress' Security Operations Center (SOC) lit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe. The attacks had one common denominator: victims had searched for the Claude desktop app and were taken to a malicious public Claude Artifact on the actual Claude AI domain, which appeared to be a legitimate download link for the desktop app. Malware blog Huntress

1.8.26

 Iran War’s Secondary Effects Shape 2026 US Violent Extremism Explore the 2026 US violent extremism threat landscape. This report analyzes rising risks from HVEs, DVEs, and Iran-nexus actors to public and BigBrother blog Recorded Futures

1.8.26

 Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend Every stage of the Hugging Face breach maps to Elastic Defend and SIEM rules already shipping, from worker RCE and credential harvest to self-migrating C2 and GenAI detection. AI blog ELASTIC

1.8.26

 Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas Attack Discovery turns raw alerts into validated threats and Elastic Defend closes vulnerable driver gaps as fast as they're disclosed. Watch it all run against real attacks at the booth. Cyber blog ELASTIC

1.8.26

 What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support Elastic Defend automatically generates and instantly deploys vulnerable driver YARA rules from VirusTotal, LOLDrivers and Microsoft's blocklist, closing the gap BYOVD attacks depend on. Plus a new troubleshooting skill and ARM endpoint protection. Safety blog ELASTIC

1.8.26

 Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here Elastic's first automatic migration from a modern SIEM. Translate your Sentinel detection rules into Elastic Security without rebuilding them. Security blog ELASTIC

1.8.26

 Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called While conducting routine open-source research, NetAskari identified a malicious Android APK impersonating a Chinese Provincial Public Security Bureau service app. Analysis of the malware led to a Telegram channel distributing the source code for an undocumented Android application builder and device control framework called Flying Eagle (飞鹰). Hunt.io researchers pivoted on TLS certificates and panel fingerprints to identify 170 servers running the framework, and uncovered a fractured criminal ecosystem built around its leaked codebase. Malware blog HUNT.IO

1.8.26

 Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades NGINX sits in front of a large share of the internet's web traffic and Ghost CMS powers well over 100,000 publishing sites. Within months of each other earlier this year, critical vulnerabilities were found in both: NGINX Rift (CVE-2026-42945), a long-standing heap overflow in the rewrite module, and a blind SQL injection in the Ghost Content API (CVE-2026-26980). Exploit code for both became public quickly. AI blog HUNT.IO

1.8.26

 Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Financ Disclosure note: This research was conducted jointly by Hunt.io and Bob Diachenko, security researcher and journalist. Thailand's national CERT and NCSA were notified on July 15, 2026, and acknowledged receipt the same day. Publication was held for the standard 7-day disclosure window. Exploit blog HUNT.IO

1.8.26

 Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection Summary Arctic Wolf Labs has been tracking a cluster of campaigns built around CastleLoader, a multi-stage shellcode loader that has served as the backbone of Malware blog ARTICWOLF

1.8.26

 Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit On 22 July 2026 (the day prior to Proofpoint’s joint release with the NSA), TA488 initiated a new wave of exploitation abusing a cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Outlook Web Access (OWA). Proofpoint did not have sufficient time to analyze, action, and incorporate the new activity into existing reporting, so we are issuing a rapid follow-up to highlight this activity. APT blog PROOFPOINT

1.8.26

 Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor Zscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging vishing techniques through Microsoft Teams and deploying a variety of tools including a Go-based backdoor that we named GoGRPC. Malware blog Zscaler

1.8.26

 The AI era of cybercrime has arrived: The 2026 Cybercrime in the age of AI report New research reveals how AI is rewiring cybercrime today, and how you can prepare for what’s coming tomorrow. AI blog THREATDOWN

1.8.26

 XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens Dive into a covert Linux XMRig campaign exploiting trusted access, weaponizing PAM to create forensic smokescreens, and deploying self-unlinking payloads. Exploit blog GROUP-IB

1.8.26

 Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks In February 2026, Socket.dev published research on a multi-stage npm supply chain worm operating under the internal flag SANDWORM_MODE. The campaign spanned 19 malicious packages in total across two unique publisher aliases and demonstrated a new class of supply chain attacks that targeted AI-augmented development workflows. AI blog CROWDSTRIKE

1.8.26

 CrowdStrike Joins the Open Secure AI Alliance to Advance AI Safety and Security CrowdStrike is an inaugural partner in the Open Secure AI Alliance, a new industry coalition built on a simple premise: securing the AI era requires open models, shared tools, and a massively distributed community of defenders. AI blog CROWDSTRIKE

1.8.26

 Inside Astaroth's New Spambot Component Operators of the Astaroth botnet introduced a new spambot component, a sign of their evolving operations and an expanding LATAM eCrime ecosystem. BotNet blog CROWDSTRIKE

1.8.26

 Falcon AIDR Now Protects Copilot Studio Agents and Claude Code New feature releases extend AI visibility, detection, and response capabilities to Microsoft Copilot Studio and Claude Code. AI blog CROWDSTRIKE

1.8.26

 Chaos in Teams vishing Sophos analysts investigated a Microsoft Teams voice phishing (vishing) campaign tracked as STAC4749 that used a consistent set of IT-themed cloud domains and personas to gain remote access to victims’ systems. Between February and June 2026, Sophos analysts observed the threat actors targeting dozens of North American organizations. Phishing blog SOPHOS

1.8.26

 Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise For years, the cybersecurity industry's understanding of software supply chain compromise has been anchored by a few watershed events, including Russian cyber espionage actor ICE RELIC’s (formerly known as APT29) 2020 compromise of SolarWinds and North Korean cyber espionage actor UNC4736's 2023 compromise of 3CX. APT blog GTI

1.8.26

 Announcing InfraTrust, the source of intelligence on security risks across hardware infrastructure Today we’re excited to announce InfraTrust, a global hardware infrastructure security knowledgebase making mission critical infrastructure security data available faster, so you have it when you need it to defend your enterprise. InfraTrust is a searchable, continuously updated source of security advisories and risk data from major enterprise hardware infrastructure vendors. Cyber blog Eclypsium

1.8.26

 APTs Top the List of Most Active Threat Actors in H1 2026 These are the most active threat actors in H1 2026 as APT groups lead global cyber operations, followed by ransomware and hacktivist campaigns. APT blog Cyble

1.8.26

 Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape Cyble breaks down how dark web ecosystems are evolving in 2026 with ransomware, initial access brokers, AI-driven attacks, and underground threat activity. CyberCrime blog Cyble

1.8.26

 Fake invoices are moving from inboxes to shopping apps Scammers are using order-tracking apps to place fake receipts where users expect to see real purchases, then pushing them to call fake support numbers. GENDIGITAL

1.8.26

 Email threat landscape: Q2 2026 trends and insights  In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage attack chains. Cyber blog Microsoft blog

1.8.26

 Why the Open Secure AI Alliance Matters: Open Frontier Models, Open Deployment Flexibility TrendAI joins Nvidia as an inaugural partner in the Open Secure AI Alliance, advancing open models, harnesses, and research to strengthen cyber defense. AI blog Trend Micro

1.8.26

 Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave Between January and June 2026, TrendAI™ tracked more than 35,000 fake sites exploiting the 2026 FIFA World Cup, spanning counterfeit merchandise shops, cloned ticket pages, and bogus free-streaming sites, which together drew roughly 1.48 million visits from Japan. Hacking blog Trend Micro

1.8.26

 The Signs Were There: What the First Autonomous Ransomware Case Confirms An AI agent has run a ransomware intrusion on its own for the first time, from break-in to data destruction. The autonomous attacks TrendAI™ Research predicted are beginning to arrive, and defending against them shifts from blocking known indicators to detecting behavior. AI blog Trend Micro

1.8.26

 13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan We analyzed a sustained tech support scam campaign that sent more than 13 million emails to Japanese addresses, with workplace-themed lures suggesting a possible expansion toward enterprise targets. Spam blog Trend Micro

1.8.26

 Inside the OpenAI – Hugging Face Incident: The AI Breach With No Human Attacker Behind It OpenAI’s own models broke out of a test sandbox and into Hugging Face’s servers to solve an evaluation, with no human attacker involved. The incident showed how keeping agentic AI safe now depends on how it’s contained, not just on how it’s trained. AI blog Trend Micro

1.8.26

 Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure TrendAI™ Research breaks down what changed in CISA’s updated advisory on an ongoing PLC exploitation, why this activity might be more dangerous than a similar campaign in 2023, and how organizations can take action now to protect themselves. ICS blog Trend Micro

1.8.26

 Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass Device code phishing abuses a legitimate authentication feature designed for devices with limited input capabilities. This article breaks down how the technique works, examines a recent observed case, and outlines the layered security measures organizations can implement. Phishing blog Trend Micro

1.8.26

 DbGate JSON Script Runner Unauthenticated Remote Code Execution SonicWall Capture Labs threat research team became aware of the threat CVE-2026-47668, assessed its impact, and developed mitigation measures. The flaw, also known as the DbGate JSON Script Runner Unauthenticated Remote Code Execution, is a critical vulnerability affecting the DbGate web-based database manager (dbgate/dbgate, distributed on npm as dbgate-serve) in all versions up to and including 7.1.8 Vulnerebility blog SonicWall

1.8.26

 The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version After months of dormancy, the attackers behind the XCSSET malware released version 40 (v40), targeting the macOS ecosystem. This version’s advanced architecture hides its core logic in memory space, reducing its digital footprint. Malware blog Palo Alto

1.8.26

 Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. They targeted infrastructure using seven vulnerabilities, combining autonomous AI-driven enumeration with manual exploitation that achieved confirmed impact. AI blog Palo Alto

1.8.26

 IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains Talos IR's Q2 report highlights a significant surge in phishing-based initial access and the weaponization of legitimate remote management tools. Learn how to sharpen your defenses. Cyber blog CISCO TALOS

1.8.26

 Black Hat special: Rewind and revisit Amy looks back at the incredible journeys that brought past guests to the world of threat intelligence. Cyber blog CISCO TALOS

1.8.26

 Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN. Ransom blog CISCO TALOS

1.8.26

 Preview: Cisco Talos at Black Hat USA 2026 Here’s some of the ways Talos is showing up at Black Hat, alongside our friends at Cisco and Splunk. Cyber blog CISCO TALOS

1.8.26

 You were onto something with “It’s the Climb,” Miley Amy hikes Virginia’s most difficult trail and muses on the persistent challenges of cybersecurity. The two aren't dissimilar. Cyber blog CISCO TALOS

1.8.26

 Don’t swing at everything Thorsten explores Q2 2026 stats, the artificial buffer zone of 2026, and why smart, prioritized patching is more critical than ever. Cyber blog CISCO TALOS

1.8.26

 Begun, the Patch Wars have Long foretold, the Great Patching has begun and it’s a doozy. Buckle in as Joe takes you through the story. Cyber blog CISCO TALOS

1.8.26

 The Hunter's Paradox: Is it time to embrace automated threat hunting? Humans can no longer keep up with the volume and velocity of security data on their own, but AI can't be fully trusted. David discusses the merits of both and muses on what the future might look like. Cyber blog CISCO TALOS

1.8.26

 Beyond the screenshot: Why you should verify what you see The screenshot may look convincing, but it doesn’t necessarily prove that the payment, booking or conversation is genuine Cyber blog Eset