The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
NASA AIT-GUI flaw chain lets unauthenticated attackers issue spacecraft commands, CVSS 9.4
Cycode disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, rated 9.4 on CVSS v3.1 and affecting versions 2.5.1 and earlier, fixed in 2.5.2. The endpoints in question relay operator commands to a spacecraft and instrument…
-
Manic Android malware relays data off offline phones through nearby infected devices
ThreatFabric documented Manic, an Android threat active since at least February 2026 that targets Ukrainian banks, government and identity services, and messaging apps, plus Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused…
-
CDN Tsunami: HTTP/3 to HTTP/1.1 translation abused for up to 350x DoS amplification
Researchers disclosed two denial-of-service techniques, collectively named CDN Tsunami, that abuse how major CDNs convert client-facing HTTP/3 traffic into HTTP/1.1 requests to origin servers, amplifying a low-bandwidth request stream by up to 350x against the origin. The attacks were evaluated…
-
Elementor Pro flaw lets unauthenticated attackers upload PHP and execute code, CVE-2026-32475
CVE-2026-32475 (CVSS 9.0) is an unrestricted dangerous-file-upload flaw in the Elementor Pro WordPress plugin. Patchstack found that the Forms module's File Upload field runs its extension check and its file-move step in two separate loops that handle empty file entries differently. Submitting two…
-
Zimbra command injection under active exploitation, CVE-2026-73570
CERT Polska reports active exploitation of CVE-2026-73570 (CVSS 8.9), an OS command injection flaw in Zimbra Collaboration's SNMP monitoring path that lets unauthenticated remote attackers run arbitrary commands as the zimbra user. Exposure requires SNMP trap notifications enabled via the…
-
Citrix patches NetScaler authentication bypass, exploitation expected
Citrix released fixes for CVE-2026-19490, a critical authentication bypass in NetScaler ADC and NetScaler Gateway that lets unauthenticated remote attackers bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), with…
-
Rust arrayref crate poisoned in build-time supply-chain attack, DPRK infrastructure overlap
An attacker compromised the maintainer account behind arrayref, a Rust crate with more than 53 million downloads in the past 90 days, and published a version that pulls in a typosquatted dependency named proc-macro1. That dependency's build script downloads and runs a remote binary, so merely…
-
CISA adds actively exploited MLflow SSRF to KEV, CVE-2026-64849
CISA added CVE-2026-64849, a server-side request forgery vulnerability in MLflow Server, to the Known Exploited Vulnerabilities catalog on August 19 based on evidence of active exploitation. MLflow is a widely deployed open-source platform for managing machine learning experiment tracking, model…
-
GitLab CVE-2026-19478 exploited in the wild within days of disclosure
The flaw is a code injection reachable through a GraphQL directive, rated CVSS 9.4, allowing an unauthenticated attacker to modify or delete public GitLab projects with no credentials, no user interaction, and no unusual configuration. watchTowr reproduced it within minutes of disclosure and…
-
Seven arrested in Germany, Spain, Bulgaria, and Brazil over the 2023 Commerzbank account drain
Germany's BKA charged three suspects picked up in Europe, to be prosecuted in Spain and Bulgaria, and Brazil's federal police arrested four more under Operação Klonen, executing 21 search and seizure warrants. Over four days in November 2023, the group exploited a vulnerability at a payment…
-
Automotive electronics distributor Alpine Electronics Europe surfaces on a leak-site tracker
Alpine Electronics Europe, which distributes automotive electronics and audio products, appeared on a ransomware leak-site tracker on August 15. No mainstream outlet has covered it, the company has not confirmed anything, and neither the actor's claims nor the data have been verified. Treat this…
-
Saturday leak-site wave hits a foundry, a car dealership group, and a barcode manufacturer
At least twelve organizations were posted to ransomware leak sites on August 15. Storm listed Integra Castings, a Canadian iron foundry and division of The CTD Group, and Canadian law firm Tapper Cuddy LLP. Clop claimed Zebra.com, saying it exfiltrated databases and CAD files, and also listed UK…
-
SAP Commerce Cloud maximum-severity flaw drew exploitation attempts three days after the patch, with no public proof of concept
CVE-2026-58231 is rated CVSS 10.0 and allows an unauthenticated attacker to abuse a default authentication client and submit crafted input to functions lacking sufficient validation, leading to arbitrary code execution and compromise of internal components. Defused Cyber saw exploitation attempts…
-
Apple macOS Screen Sharing flaw goes from patch to live exploitation, with AI closing the gap in four hours
The Dutch National Cyber Security Centre reported active abuse of CVE-2026-65400 (CVSS 9.8), a critical authentication flaw in the macOS Screen Sharing component that Apple patched on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. In every case NCSC-NL saw, port 5900 was…
-
July cybersecurity M&A hit 21 deals as Team8 raises another $365 million
SecurityWeek's monthly roundup counted 21 cybersecurity acquisitions announced in July 2026, with deals from Barracuda, CrowdStrike, Cyera, Okta, Palo Alto Networks, and Qualcomm. Separately, Israeli venture firm Team8 secured an additional $365 million, bringing it to nearly $2 billion in total…
-
Okta details Work Panel, the console behind industrial-scale vishing
Okta published a look inside Work Panel, a multi-tenant platform that packages everything needed to run a vishing-driven account takeover operation against identity providers, including Okta itself. Registering a phishing domain, cloning a target brand, and standing up an isolated phishing site…
-
Cursor CLI ran untrusted repository code before the trust prompt, and inside an enabled sandbox
Cursor fixed a flaw where a cloned repository could execute arbitrary commands on a developer's machine before the workspace-trust dialog appeared, and outside the sandbox even when the sandbox had been explicitly enabled with --sandbox. The command lived in a normal tracked file…
-
WordPress 7.0.4 fixes a remote code execution flaw reachable by Author-level users
WordPress 7.0.4 patches a remote code execution vulnerability that an attacker with Author-level permissions or higher can trigger through malicious PostScript files. This is a post-authentication issue, so it requires an existing account, which lowers the urgency relative to a pre-auth bug but…
-
GhostJacking turns AI agents into the intruder using nothing but a poisoned log entry
GhostJacking builds on the earlier Agentjacking technique. An attacker plants text in something an AI agent reads, such as a log line or a monitoring alert, and the agent acts on it: running code on a developer machine, escalating privileges, pivoting to cloud infrastructure, exfiltrating data (in…
-
PATCHCORD backdoor hits Afghan telecom and South Asian critical infrastructure
A previously undocumented C/C++ backdoor called PATCHCORD is being delivered to Afghan telecom providers and South Asian critical infrastructure organizations through sector-specific lures, including fake VPN installers impersonating Afghan Telecom and telecom management tools. Acronis also found…
-
Dragos counts 1,140 ransomware incidents against industrial organizations in Q2, up 12 percent
Dragos identified 1,140 ransomware incidents affecting industrial organizations worldwide in Q2 2026, a 12 percent increase over Q1. Manufacturing was hit hardest with 747 incidents, 65 percent of the total. ICS-adjacent organizations, meaning engineering firms, system integrators, and equipment…
-
White House authorizes private firms to run offensive operations against foreign cybercrime groups
A National Security Presidential Memorandum signed August 12 directs the National Coordination Center to stand up a program letting approved private security companies conduct cyber operations against foreign criminal organizations behind ransomware, phishing, financial fraud, sextortion, and…
-
Fortinet patches authentication bypasses in FortiWeb and FortiManager
CVE-2026-26035 in FortiWeb is an improper authentication flaw that lets a remote unauthenticated attacker log into the GUI or CLI with a random username and password. It only applies when the wildcard setting for administrator accounts is enabled, which is not the default, and the workaround is to…
-
Mindgard raises $30 million for AI system security
AI security startup Mindgard closed a $30 million round to expand product, engineering, sales, and marketing. The raise continues a steady flow of capital into AI-model and AI-application security tooling.
-
Signal ships Automatic Key Verification, WhatsApp adds scam alerts
Signal introduced Automatic Key Verification, which complements its manual safety-number system and is intended to detect interception without requiring users to compare codes in person. WhatsApp separately announced a scam alert feature that warns users about likely fraudulent contacts.