The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Researchers chain an unauthenticated identity-assumption flaw in SharePoint Server into remote code execution, with AI doing much of the work
CVE-2026-55040 (CVSS 9.1) lets a remote attacker with no valid account assume any chosen user's identity on SharePoint Server Subscription Edition, 2019, and 2016, provided they know the target's Active Directory SID or user principal name. SharePoint Online is not affected. Rapid7 chained that to…
Also covered by SecurityWeek
-
Microsoft ships roughly 400 fixes, one Windows zero-day under attack and a potentially wormable DNS bug
CVE-2026-68820 is a use-after-free in afd.sys, the WinSock kernel driver. A low-privileged local attacker wins a race condition and lands at SYSTEM with no user interaction. Check Point ties the exploitation to Lazarus and its Operation Dream Job campaign, deploying the FudModule rootkit…
Also covered by BleepingComputer
-
ICE access to credit-header and credit-card-derived data draws fresh scrutiny
Reporting details how ICE obtains credit-header and transaction-adjacent data through commercial data brokers, including a Thomson Reuters contract reported at roughly $125 million providing access via the CLEAR platform, without a warrant. The mechanism is the third-party doctrine: data…
-
DeadLock ransomware disables Defender, backups, and event logs before encrypting
DeadLock is a Rust-based encryptor whose pre-encryption routine systematically disables Windows Defender, backup software, and event logging before it touches files. Analysts also describe a decentralized recovery infrastructure for victim negotiation, which complicates takedown. It arrives in the…
-
Zscaler details Abyssos, a modular C++ RAT with hidden VNC and browser-session hijacking
Abyssos is a post-compromise framework first observed in late June 2026 that bundles credential theft, clipboard interception, remote shell, UAC bypass, file operations, and hidden VNC into one modular implant with AES-GCM encrypted command and control. Its browser-session hijacking works by…
-
OpenAI ships GPT-5.6-Cyber days after pausing Astra over critical cyber-capability findings
On Aug 7 OpenAI paused its unreleased Astra model after evaluations suggested it may have crossed the Critical cybersecurity threshold in the company's Preparedness Framework, the level at which a model can autonomously find and exploit zero days in hardened systems without human direction. On Aug…
-
Red Hat ACM confused-deputy flaw gives namespace editors full cluster-admin, CVSS 9.9
CVE-2026-10090 (CVSS 9.9) affects the Application Subscription controller in Red Hat Advanced Cluster Management for Kubernetes. A user with only namespace-scoped edit rights can create a Channel pointing at an attacker-controlled Helm repository and a Subscription referencing it; the controller…
-
SAP August 2026 Patch Day: two CVSS 10.0 flaws, plus a manufacturing-platform command execution bug
SAP Commerce Cloud (CVE-2026-58231, CVSS 10.0) lets an unauthenticated attacker abuse a default authentication client and reach functions lacking input validation, enabling arbitrary code execution and compromise of internal components. SAP NetWeaver Application Server ABAP (CVE-2026-34265, CVSS…
Also covered by The Hacker News
-
Siemens SIMATIC IoT2050 Advanced: unauthenticated Node-RED code execution, CVSS 10.0
All versions of the SIMATIC IoT2050 Advanced gateway (6ES7647-0BA00-1YA2) below V4.3.4.1 running Industrial OS with Node-RED installed fail to enforce authentication on the Node-RED HTTP interface. An unauthenticated remote attacker can reach programming nodes capable of running system commands…
-
Pass-the-Passkey: new attack family replays WebAuthn assertions to defeat phishing-resistant MFA
Researchers disclosed a family of attacks that impersonate enterprise users in Windows 11 and Microsoft Entra ID without ever extracting a private key from hardware. Windows 11 was logging complete WebAuthn assertion responses to an operational event log, and Entra ID was not enforcing challenge…
-
Joint federal advisory: Gunra ransomware bypasses MFA through Fortinet SSL-VPN and Schneider Electric flaws
FBI, CISA, DC3, NSA, the Secret Service, and South Korea's National Police Agency issued a joint #StopRansomware advisory on Gunra, a Conti-derived RaaS operation that has matured through 2026. Gunra actors modified authentication processing files on a corporate VDI portal so that one specific…
-
Inotiv pharmaceutical/life-sciences ransomware (Qilin) confirmed
Inotiv, a pharmaceutical and drug-research firm, disclosed a ransomware attack affecting 9,542 individuals with theft of personal information. The Qilin group claimed responsibility and alleged exfiltration of more than 162,000 files, a figure not independently verified at time of reporting.
-
Fresh breach disclosures (Aug 10 discovery batch): law firm, French bank unit, Swedish supplier, others
New victim disclosures surfaced Aug 10 across sectors and regions: Barclay Damon (US law firm), BPCE International (unit of France's Groupe BPCE), Axson Teknik AB (Swedish technical/manufacturing supplier), aZaaS (Singapore enterprise tech), and ATMS & Co. LLP (Indian chartered accountancy)…
-
Iran-linked cyberattacks on US water utilities expand to at least 12 states; CISA still finding exposed PLCs
Suspected Iran-backed actors have hit operational technology at water and wastewater systems in at least a dozen states (Michigan, Minnesota, Georgia, New Jersey, South Dakota and others), with South Dakota and Georgia among the latest to disclose. Minnesota alone reported more than 30 community…
-
Metabase zero-day (CVSS 10.0) exploited in the wild, unauthenticated admin takeover
Metabase confirmed a critical unauthenticated SQL injection zero-day (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) in the public POST /api/session/resetpassword endpoint, affecting every release from v1.58 onward. Attackers inject SQL directly into the app database with no login and seize full admin access…
-
Levi Strauss confirms corporate data theft after social-engineering of employees
Levi Strauss & Co. says attackers used social engineering against three employees to gain access to their machines and steal corporate data. The company is investigating scope and impact. Coverage frames it as human-targeted access rather than a software exploit.
-
Valve warns European Steam hardware buyers of breach at shipping partner CEVA Logistics
A cyberattack on CEVA Logistics between July 29 and Aug 1 exposed data on Steam hardware customers in Europe; Valve learned on Aug 7 that customer information was likely compromised. Exposed fields include names, addresses, phone numbers, email addresses, and product type and price, but not…
-
North Korea's Kimsuky builds a self-hosted, offline AI lab on its own attack servers
Genians documented what it calls the first known case of a state-sponsored APT running a private, self-hosted large language model on the same infrastructure it uses to receive stolen data and issue commands. Operators stood up local model environments with Ollama, GPT4All, and Msty and pointed…
-
AnMed health system claimed by TheGentlemen ransomware group
TheGentlemen ransomware group has now formally claimed AnMed, the nonprofit health system serving upstate South Carolina and northeast Georgia, and set a 72-hour deadline before threatening to leak stolen data. The underlying attack, first disclosed July 26 as a "cybersecurity disruption involving…
-
Head Mare trojanizes TrueConf installers via unpatched servers (supply chain)
The Head Mare hacktivist group exploited vulnerabilities in unpatched TrueConf video-conferencing servers to swap client installers for backdoored versions. Users who pulled installers from compromised servers received malware.
-
Unlimited Technology Systems breach impacts 3.8 million (healthcare)
Healthcare software firm Unlimited Technology Systems reported that more than 3.8 million people were affected by a breach dating to an October 2025 incident. Disclosure timing keeps healthcare data-handling and vendor risk in focus.
-
North Carolina Ports confirms cyberattack disrupting operations
The North Carolina State Ports Authority confirmed a cyberattack disrupted IT systems and slowed operations at the Port of Wilmington, Port of Morehead City, and the Charlotte Inland Port. Logistics and cargo handling were affected.
-
CISA flags actively exploited N-able N-central auth bypass; MSP/RMM pivot risk
CVE-2026-18577 (CVSS 8.2), an incomplete fix for CVE-2026-18556, lets attackers bypass N-central authentication and abuse the built-in Take Control feature to pivot from the RMM server into managed endpoints and deploy persistence. FCEB agencies were told to remediate by Aug 6 and review Take…
-
Metabase max-severity SQLi exploited as zero-day; Framework and Tally breached
A critical SQL-injection flaw in Metabase business-intelligence software was exploited in the wild as a zero-day to breach customer instances and steal data. Confirmed victims include Framework and Tally. Organizations running self-hosted Metabase should treat this as urgent.
-
CERT Polska details novel private-APN pivot that sabotaged a second Polish energy facility
A three-month CERT Polska investigation into the December 29, 2025 attacks (30 wind and solar sites plus a CHP plant) uncovered a previously unseen vector: attackers used a private APN to reach the OT network, aided by a misconfiguration letting arbitrary devices in the APN talk to each other. The…