Full Daily Digest

The City-Forum campaign demonstrates a critical gap in SaaS security posture management, where default configurations become attack vectors. Attackers operate through a German-hosted server (active since March 2025) making authenticated requests as guest users - a legitimate access method in both platforms. The attack path reveals fundamental flaws in permission modeling: ServiceNow's knowledge base 'Can Read' settings and Salesforce's guest sharing rules frequently grant excessive access. Impact spans regulated industries handling PII and financial data. Effective mitigation requires revisiting guest user permissions at multiple layers - from object-level access controls to API enablement flags - rather than relying on perimeter security assumptions.

Help Net Security · 2026-08-12 · Incidents: Attackers harvest global enterprise data via over-permissioned guest accounts in Salesforce and ServiceNow portals without exploiting vulnerabilities.

The exponential rise in vulnerabilities—from 137 in May to 622 in July—highlights AI's disruptive impact on bug discovery. Attackers leverage this surge, as seen with Lazarus Group's exploitation of CVE-2026-68820, which combines social engineering (fake job offers) with technical execution (trojanized PDF readers). Microsoft's shift to summary tables obscures critical details, complicating defenders' ability to prioritize patches. The Five Eyes warning underscores the urgency: AI will reshape offensive and defensive cyber capabilities within months, not years. Mitigation requires immediate patching of critical flaws (e.g., CVE-2026-68820), enhanced monitoring for PDF-based attacks, and leveraging third-party feeds to compensate for Microsoft's reduced transparency.

The Record by Recorded Future · 2026-08-12 · Vulnerability: AI-driven vulnerability discovery fuels Microsoft's record 419 Patch Tuesday fixes, including three zero-days exploited by Lazarus Group.

The vulnerability in Winsock, a core Windows networking component, enables privilege escalation after initial access, typically gained via phishing. Attackers impersonate recruiters from major firms like Lockheed Martin, embedding malicious links in job offers. The flaw's exploitation requires a two-step process: initial compromise followed by kernel-level privilege abuse. Detection hinges on monitoring kernel-driver race conditions, a nuanced but critical capability. Mitigation involves immediate patching, as no workaround exists, and enhanced scrutiny of job-related communications, especially in defense sectors. The Lazarus Group's use of trusted infrastructure complicates traditional defenses, necessitating layered security measures.

The Record by Recorded Future · 2026-08-12 · Incidents: North Korean hackers exploit a Windows Winsock flaw (CVE-2026-68820) to target defense job seekers, prompting CISA to enforce a two-week patching deadline.

The Lazarus group's Operation Dream Job exemplifies advanced persistent threat tactics, combining social engineering with technical exploits. The attack chain begins with victims downloading a ZIP archive containing a legitimate PDF viewer, a malicious DLL, and an encrypted payload. DLL sideloading enables the execution of MISTPEN, an in-memory downloader, which then exploits CVE-2026-68820 for SYSTEM privileges. The use of compromised Roundcube servers for C2 traffic indicates a layered approach to obfuscation. Defenders should prioritize patching Windows systems, monitoring for DLL sideloading, and scrutinizing unexpected job offers, especially those requiring file downloads.

Help Net Security · 2026-08-12 · Incidents: Lazarus hackers exploit a Windows zero-day via fake job offers targeting defense sector professionals.

The zero-day CVE-2026-68820 exploits a race condition in AFD.sys, enabling local attackers to escalate privileges without user interaction—a critical vector for North Korean threat actors deploying kernel-mode rootkits. The three publicly disclosed vulnerabilities (CVE-2026-62832, CVE-2026-72971, CVE-2026-62737) highlight systemic risks in Windows components, particularly legacy registry handling and ARM64-specific drivers. The 'ShieldBreak' PoC underscores persistent gaps in Defender's patch efficacy, affecting multiple Windows versions. Mitigation requires immediate prioritization of CVE-2026-68820 and registry-related fixes, while delaying non-critical patches to avoid operational disruption. Organizations should validate patches in test environments and monitor for kernel-level anomalies.

Help Net Security · 2026-08-12 · Vulnerability: Microsoft patches 400+ vulnerabilities, including an exploited zero-day (CVE-2026-68820) and three publicly disclosed flaws, while a Defender bypass exploit emerges.

The vulnerability's attack path requires initial access to the device's local network, positioning it as a post-compromise escalation threat. Attackers exploit the go2rtc component's failure to sanitize input strings before system command execution, achieving privileged code execution despite the network adjacency requirement. This creates a pivot point in compromised IoT environments, particularly dangerous in smart home deployments where devices often operate with elevated privileges. Mitigation requires immediate patching to go2rtc v1.9.14 or later, coupled with network segmentation to restrict unauthorized local access. Organizations should audit all Home Assistant Green deployments and consider implementing runtime protection for system command execution.

ZDI (Zero Day Initiative) · 2026-08-12 · Vulnerability: Home Assistant Green's go2rtc process vulnerable to root-level RCE via command injection.

The vulnerability represents a classic command injection case where an attacker with local network access can chain improper input validation to privileged code execution. Attackers must first compromise the local network or device interfaces, suggesting this would likely be used as a lateral movement vector post-initial access. The root context escalation significantly amplifies impact, allowing full device compromise. Mitigation requires immediate patching to go2rtc v1.9.14+ and network segmentation to restrict localhost interface access. This case underscores how IoT management processes often neglect basic input sanitization despite running with high privileges.

ZDI (Zero Day Initiative) · 2026-08-12 · Vulnerability: Home Assistant Green's go2rtc process exposes root-level RCE via command injection for network-adjacent attackers.

The vulnerabilities exploit Zoom's annotation engine (libannotate.so), with CVE-2026-53413 involving a stack buffer overflow due to unchecked 32-bit character counts, and CVE-2026-53415 leveraging a use-after-free condition for arbitrary write primitives. Attackers can join any meeting and send crafted annotations to execute code on all participants' devices, bypassing authentication and user interaction. The exploit chain, demonstrated within 24 hours using AI models, highlights the ease of weaponization. Affected systems include all Zoom Workplace platforms, with end-to-end encrypted meetings at higher risk due to unfiltered traffic. Mitigations include updating to Zoom Workplace 7.1.5+, enforcing minimum client versions, and disabling annotations and other high-risk features.

Orca Security Blog · 2026-08-12 · Vulnerability: Zero-click RCE flaws in Zoom Workplace allow attackers to compromise all meeting participants via malicious annotations.

The Lazarus Group's latest campaign demonstrates a sophisticated blend of social engineering and technical exploitation. By leveraging CVE-2026-68820, a privilege escalation flaw in Windows' AFD.sys driver, attackers gain SYSTEM access to deploy the Troy backdoor. The attack chain begins with phishing messages impersonating recruiters, leading victims to download malicious PDFs or trojanized viewers. The use of DLL side-loading (via libmupdf.dll) and lightweight downloaders (MISTPEN) ensures stealthy payload delivery. Notably, the group hijacks legitimate WordPress, SharePoint, and Roundcube servers (exploiting CVE-2025-49113) for C2, blending malicious traffic with legitimate web traffic. Mitigations include immediate patching, verifying software through official channels, and adopting zero-trust principles for all digital interactions.

The Hacker News · 2026-08-12 · Incidents: Lazarus Group exploits Windows zero-day (CVE-2026-68820) to deploy Troy backdoor via fake job offers, targeting defense and aerospace sectors globally.

The attack path begins with reconnaissance, where threat actors gather personal details from data leaks or social media profiles. Credential stuffing and brute-force attacks follow, using predictable password variations. Phishing tactics, such as impersonating platform support, trick victims into sharing reset codes. Cloned sites capture credentials directly. The scope is broad, affecting individuals and minors, with content often monetized on dark web marketplaces. Mitigations include enforcing multi-factor authentication, educating users on phishing red flags, and monitoring for credential leaks. Organizations should implement rate-limiting for login attempts and promote the use of password managers to reduce reuse.

The Record by Recorded Future · 2026-08-12 · Incidents: Hackers exploit social engineering to steal explicit content from social media accounts, leading to harassment and sextortion.

The attack leveraged open-source AI frameworks to autonomously scan and exploit vulnerabilities in government systems, including nuclear safety and energy sectors. The AI's adaptive 'Learning Cycles' enabled it to refine tactics without human intervention, targeting misconfigurations and exposed interfaces. Mitigation requires enhanced monitoring of AI-driven activities, strict access controls, and regular vulnerability assessments for critical infrastructure. Defenders should prioritize anomaly detection in AI-generated traffic and enforce zero-trust architectures to limit lateral movement.

CyberScoop · 2026-08-12 · Incidents: First near-autonomous AI attack on Taiwanese government infrastructure extracted sensitive data and targeted critical sectors.

Walmart's innovative approach addresses the common siloing and adversarial tensions between red and blue teams by physically co-locating them and adopting a 'trusted agent' model. This setup allows blue team members to observe red team activities in real-time, ensuring immediate feedback and protection against operational harm. The real-time collaboration forces both teams to adapt and pivot, leading to incremental skill improvements. This method mitigates the traditional win-lose mentality, replacing it with a focus on organizational learning and security enhancement. The model also reduces staff turnover by creating a culture of continuous learning and mutual respect.

Dark Reading · 2026-08-12 · Case Studies: Walmart's collaborative purple teaming model builds trust and improves security by co-locating and integrating red and blue teams.

The exploitation of CVE-2026-55040 highlights the rapid weaponization of vulnerabilities post-disclosure. Attackers leverage the PoC script released by Rapid7 to bypass SharePoint's authentication mechanisms, enabling unauthorized access to sensitive files and data modification. This attack path underscores the importance of timely patching, as Microsoft had already addressed the flaw in July. The discovery of CVE-2026-63520 further complicates the threat landscape, as it could be chained with CVE-2026-55040 to achieve remote code execution, though no exploitation has been observed yet. Organizations must prioritize updating their SharePoint instances and implement network segmentation to limit exposure. Monitoring for anomalous authentication attempts and applying strict access controls are critical mitigation steps.

SecurityWeek · 2026-08-12 · Vulnerability: SharePoint vulnerability CVE-2026-55040 is being exploited post-PoC release, enabling unauthenticated attackers to bypass authentication and access or modify data.

The attack vector involves Chrome extensions masquerading as legitimate VPN services, exploiting users seeking to bypass censorship. By configuring 'chrome.proxy.settings' to a fixed SOCKS5 server, these extensions funnel all browser traffic through a controlled proxy, granting the threat actor adversary-in-the-middle (AitM) capabilities. This allows interception of TLS SNI values, source IPs, and HTTP request bodies. The bypass list, limited to loopback addresses, ensures all external traffic is routed through the malicious proxy. Mitigation includes removing suspicious extensions, verifying developer credentials, and using trusted VPN services. Organizations should enforce strict browser extension policies and monitor for unusual traffic patterns.

The Hacker News · 2026-08-12 · Incidents: 737 Chrome VPN extensions impersonate trusted brands, routing user traffic through a single SOCKS5 proxy to intercept sensitive data.

The ransomware attack on Colombia's Ministry of Justice exemplifies the escalating threat landscape in Latin America. Attackers likely exploited vulnerabilities in cloud infrastructure, a recurring weakness in the region. The disruption of public-facing services, particularly those tied to illicit-drug monitoring and legal processes, underscores the operational impact on critical government functions. While no data theft was confirmed, file encryption indicates a classic ransomware tactic to extort payment. This incident aligns with broader trends, including a 40% increase in exploit attempts and a 42% rise in malware detection across Latin America. Mitigation efforts must prioritize cloud posture management, third-party risk assessments, and proactive threat intelligence sharing to counter the region's maturing threat ecosystem.

Dark Reading · 2026-08-12 · Incidents: Ransomware disrupted Colombia's Ministry of Justice days before the presidential transition, underscoring rising cyber threats in Latin America.

The new feature mitigates a specific attack vector where an adversary compromises Signal's key directory to swap encryption keys, enabling undetected interception. This attack would require either cloud infrastructure breaches or insider access, making it low-likelihood but high-impact. Key transparency, audited by Cloudflare and Trail of Bits, ensures consistency in key-account mappings without exposing plaintext identifiers. However, the system's reliance on phone numbers limits its scope for username-based chats, and it cannot prevent account takeovers. Defenders should note that while this reduces reliance on manual verification, it introduces trust dependencies on Signal and auditors—organizations with high-risk profiles may prefer manual checks for critical communications.

Help Net Security · 2026-08-12 · Tools: Signal's automatic key verification feature detects tampering in encrypted chats using cryptographic transparency and third-party audits.

The release of Skylar AI 2.5 addresses critical security and compliance challenges faced by organizations adopting AI, particularly in government and regulated sectors. By offering sovereign cloud, on-premises, and secure cloud deployment options, ScienceLogic mitigates risks associated with data sovereignty and unauthorized access. Enhanced operational guidance and AI transparency reduce the attack surface by ensuring accurate event matching and severity assignment. The platform's improved governance features, such as token usage tracking and agent monitoring, provide defenders with better control over AI operations, reducing potential misuse or exploitation. These advancements are crucial for organizations transitioning from AI experimentation to operationalization, ensuring secure and scalable AI integration.

Help Net Security · 2026-08-12 · Tools: Skylar AI 2.5 enables secure, flexible AI deployment with enhanced performance and governance for regulated industries.

The rapid adoption of AI in enterprises is outpacing the development of robust governance frameworks, exposing organizations to significant operational and regulatory risks. Deloitte's expanded services target this vulnerability by providing comprehensive risk assessments, model validations, and control redesigns, particularly in high-stakes areas like financial reporting. Attack paths could include unvalidated AI decisions leading to financial misreporting or operational failures. Mitigations involve embedding governance and compliance into AI solutions from the outset, ensuring scalability and trust. Deloitte's collaboration with hyperscalers and regulatory bodies further strengthens their ability to deliver reliable, human-led AI innovations.

Help Net Security · 2026-08-12 · Policy: Deloitte enhances AI governance services to address the widening gap between AI deployment and mature risk management.

Mindgard's approach to AI security is notable for its focus on the psycho-technical attack surface, a relatively unexplored area in AI defense. By automating red-teaming and operationalizing expertise from leading researchers, the platform provides a proactive defense mechanism. The discovery of 150 vulnerabilities, including critical flaws in widely used AI tools, underscores the growing need for specialized AI security solutions. Organizations should prioritize integrating such platforms to mitigate risks like zero-day exploits and runtime attacks, especially as AI adoption expands across sensitive industries.

SecurityWeek · 2026-08-12 · Tools: Mindgard raises $30 million to scale its AI security platform, which identifies and mitigates vulnerabilities in AI systems.

The breaches at ACRO underscore critical lapses in vulnerability management and incident response. Attackers exploited a Kentico CMS portal running outdated software with documented vulnerabilities, including SQL injection, to gain initial access. Despite Trend Micro alerts flagging credential-harvesting attempts (e.g., Mimikatz), ACRO lacked processes to triage or escalate warnings. The absence of patch accountability—between ACRO, its MSP, and web vendor—left systems exposed for years. Network segmentation mitigated lateral movement, but the incident reveals systemic failures: undefined roles for alert monitoring, no patch governance, and delayed disclosure. Organizations must enforce patch SLAs, implement SIEM workflows for alert prioritization, and conduct tabletop exercises to clarify incident response ownership.

The Record by Recorded Future · 2026-08-12 · Incidents: UK criminal records office breached three times due to unpatched CMS and ignored security alerts, exposing sensitive data for two years.

The City-Forum campaign represents a significant evolution in targeting cloud platforms, combining attacks on Salesforce Aura, LWR, and ServiceNow into a single, custom toolset. The attack path begins with exploiting guest user permissions, which are often misconfigured, allowing unauthenticated access to sensitive data. The campaign's use of Salesforce's UI-API guest surface and ServiceNow's undocumented search endpoint demonstrates a high level of sophistication. Detection is complicated by the high-volume, protocol-legitimate exfiltration, which avoids raising alarms. Mitigations include disabling self-registration, reviewing guest user permissions, and monitoring for unusual activity on these endpoints. The campaign's focus on high-value sectors like telecoms and financial services amplifies its impact.

SecurityWeek · 2026-08-12 · Incidents: Stealthy 'City-Forum' attacks exploit guest user permissions in Salesforce and ServiceNow using a custom multi-platform toolset.

WhatsApp’s Scam Alert feature represents a significant advancement in combating phishing and scam attempts without undermining end-to-end encryption. By processing messages locally, it avoids data exfiltration risks, ensuring user privacy. The use of a third-party transparency ledger and cryptographic verification adds a layer of trust, mitigating risks of tampered models. Signal’s automatic key verification addresses potential man-in-the-middle attacks by independently verifying encryption keys, reducing reliance on manual checks. Both features demonstrate a shift toward proactive, privacy-preserving security measures. However, their effectiveness hinges on user adoption and continuous refinement during beta testing. Organizations should monitor these developments to assess their applicability in enterprise messaging environments.

SecurityWeek · 2026-08-12 · Tools: WhatsApp and Signal enhance user security with Scam Alert and automatic key verification, leveraging on-device ML and cryptographic transparency.

Walmart's security transformation highlights the importance of aligning cybersecurity with business objectives. The shift from a fear-based 'no' culture to a proactive 'yes and' approach enables secure innovation. By fostering trust and transparency, Walmart ensures that security teams can effectively communicate risks and solutions to leadership. The 'trusted agent' model bridges the gap between red and blue teams, promoting continuous learning and reducing friction. This approach is critical in a hyper-extended attack surface where retailers face both criminal syndicates and nation-state actors. Mitigation strategies include regular threat assessments, transparent communication, and fostering a culture of psychological safety within security teams.

Dark Reading · 2026-08-12 · Case Studies: Walmart enhances security operations through trust, transparency, and proactive collaboration, aligning defenses with business goals.

The vulnerability stems from improper handling of encrypted reasoning blocks in AI APIs, enabling cross-session replay attacks. Attackers could exploit this to extract proprietary reasoning, private data, or hidden harmful content. The researchers recovered over 700 privacy artifacts from public logs, including API keys and passwords. Mitigations now include stripping reasoning blocks when switching models and avoiding raw API transcript commits. However, the lack of vendor acknowledgment leaves questions about residual risks in already-published logs. This flaw underscores the need for robust encryption and session management in AI systems handling sensitive data.

The Hacker News · 2026-08-12 · Vulnerability: AI API flaw lets weaker models decode stronger models' reasoning, exposing sensitive data.

The report highlights a critical asymmetry in enterprise defenses: while perimeter security has improved significantly, internal defenses are alarmingly weak against stealthy tactics. Attackers exploit this gap by focusing on reconnaissance and credential theft, which rarely trigger alerts. Techniques like Sharp-ServiceExec and SMBExec are often blocked, but passive credential access and domain enumeration go unnoticed. This underscores the need for a shift in defensive focus—validating exploitable exposures, rigorously testing internal controls, and refining detection rules to respond to current behaviors. Continuous validation and dynamic detection engineering are essential to bridge this gap and ensure comprehensive protection.

The Hacker News · 2026-08-12 · Vulnerability: Perimeter defenses are strong, but internal defenses falter against quiet reconnaissance and credential theft, with only 37% post-compromise prevention.

The cyberattack on Ceva Logistics highlights vulnerabilities in third-party logistics systems, which serve as critical nodes in global supply chains. The breach's impact spans multiple high-profile clients, suggesting a targeted effort to disrupt operations or harvest sensitive data. While the attack vector remains undisclosed, the recurrence of breaches at Ceva points to systemic security gaps. Mitigation should include enhanced third-party risk assessments, robust access controls, and continuous monitoring of logistics systems. Organizations relying on Ceva must audit their data exposure and enforce strict data retention policies to minimize future risks.

SecurityWeek · 2026-08-12 · Incidents: Ceva Logistics' European operations disrupted by a cyberattack, exposing customer data and delaying shipments.

The vulnerabilities disclosed by Adobe represent significant risks due to their high CVSS scores and potential for arbitrary code execution. The command injection flaw (CVE-2026-48362) in ColdFusion is particularly dangerous, as it allows attackers to execute OS commands remotely. The eval injection (CVE-2026-48273) and incorrect authorization (CVE-2026-71398, CVE-2026-27302) vulnerabilities further compound the risk, enabling privilege escalation and denial-of-service attacks. Mitigation requires immediate patching, especially for on-premise deployments, as hybrid and Adobe-hosted instances are already secured. Organizations should prioritize these updates to prevent potential exploitation chains that could lead to full system compromise.

The Hacker News · 2026-08-12 · Vulnerability: Adobe patches three CVSS 10.0 flaws in ColdFusion and Campaign Classic, urging immediate updates to mitigate arbitrary code execution risks.

The vulnerabilities patched by Intel and AMD span a broad spectrum of products, from core processor technologies to development environments. High-severity flaws in PROSet/Wireless WiFi software and Xeon processors are particularly concerning due to their potential for privilege escalation and DoS attacks. Attackers could exploit these flaws to gain elevated access or disrupt services, making them prime targets for exploitation. The inclusion of medium and low-severity issues in AI and container runtime tools indicates a wider attack surface that defenders must monitor. Immediate patching is critical, especially for systems running vulnerable WiFi software or Xeon processors, to prevent potential breaches.

SecurityWeek · 2026-08-12 · Vulnerability: Intel and AMD patch over 80 vulnerabilities, including high-severity flaws in WiFi software and Xeon processors.

The attack exploited a transitive dependency chain: a leaked credential in Trivy's CI pipeline led to malicious LiteLLM versions (1.82.7/1.82.8) being auto-published. The payload executed on all Python invocations without explicit imports, demonstrating how ephemeral build systems amplify compromise windows. Impacted entities include Nvidia, AWS, and Siemens, with exposed secrets ranging from SSH keys to AI provider tokens. Mitigation requires credential rotation, log audits, and isolation of build environments. The incident underscores how AI tooling's privileged access makes it a high-value target for future attacks aiming at identity and data exfiltration.

SecurityWeek · 2026-08-12 · Incidents: LiteLLM supply chain attack exposed 2,500+ organizations via compromised Trivy scanner, revealing systemic risks in automated build pipelines.

The exploitation of CVE-2026-59310 highlights a targeted campaign leveraging a critical vulnerability in VMware vCenter, allowing attackers to bypass security controls via directory traversal and execute arbitrary code. The use of reverse_ssh for persistence is particularly concerning, as it enables outbound connections to attacker-controlled infrastructure, evading traditional inbound detection mechanisms. The rapid exploitation timeline—just five days post-disclosure—suggests either prior knowledge or highly efficient weaponization. The global victim distribution indicates broad targeting, likely focusing on high-value enterprise environments. Defenders should prioritize patching, monitor for unexpected cron jobs, and scrutinize outbound SSH connections, especially from vCenter appliances.

The Hacker News · 2026-08-12 · Incidents: Attackers exploit VMware vCenter flaw CVE-2026-59310 to deploy reverse_ssh for persistent access across 361 IPs in 47 countries.

The new M365 Auto Remediation feature targets common misconfigurations in Microsoft 365 environments, such as lack of MFA for admin accounts and legacy authentication protocols, which are frequent attack vectors. By automating remediation, MSPs can reduce the window of exposure for these vulnerabilities. The AI-assisted Training Assessments module addresses the human element of security, enabling MSPs to measure and improve user awareness. Together, these tools provide a holistic approach to securing M365 environments, combining technical controls with user education. The integration of Patch 360 further enhances the platform's ability to manage vulnerabilities across the entire IT stack.

Help Net Security · 2026-08-12 · Tools: ConnectSecure launches automated M365 security remediation and AI-driven training assessments for MSPs.

The rapid expansion of cloud environments, SaaS applications, and AI systems has outpaced traditional penetration testing cycles, leaving organizations vulnerable to evolving threats. CBTS’s PTaaS addresses this gap by integrating NodeZero’s autonomous penetration testing capabilities with expert human review, enabling continuous validation of exploitable risks. This approach not only identifies vulnerabilities but also maps attack paths, demonstrating how multiple weaknesses can be chained together to compromise critical systems. By prioritizing remediation based on validated exploitability, PTaaS helps security teams focus resources effectively. The service’s flexible testing frequency—daily, weekly, monthly, or quarterly—allows organizations to tailor their security practices to their risk profiles and business needs. This continuous validation is critical as adversarial AI models accelerate the exploitation of newly disclosed vulnerabilities, reducing the window for effective patching.

Help Net Security · 2026-08-12 · Vulnerability: CBTS’s PTaaS combines autonomous penetration testing with expert review to continuously identify and remediate exploitable risks in evolving enterprise environments.

The Lazarus Group’s latest campaign leverages a use-after-free vulnerability in Windows’ Ancillary Function Driver for WinSock (afd.sys), enabling privilege escalation via a race condition. Attackers initiate contact through professional platforms, delivering malicious payloads disguised as PDF viewers. DLL sideloading facilitates the execution of Mistpen malware, which deploys ForestTiger, a known Lazarus backdoor. A secondary infection chain uses SecurityPDF to execute the Troy backdoor, which supports extensive operator commands. The C&C infrastructure relies on compromised Roundcube webmail and CMS platforms, exploiting CVE-2025-49113 for remote code execution. Defense, aerospace, and aviation organizations in France, Germany, Brazil, and India are primary targets. Mitigation includes applying Microsoft’s August 2026 Patch Tuesday updates, scrutinizing unsolicited recruitment outreach, and reviewing indicators of compromise.

SecurityWeek · 2026-08-12 · Incidents: North Korean hackers exploit Windows zero-day CVE-2026-68820 in attacks targeting aerospace and aviation sectors.

Crytica’s RDAi system represents a paradigm shift in OT security by focusing on internal device monitoring. Traditional external visibility tools infer threats, but RDAi directly detects unauthorized changes to instruction sets and configuration files. This deterministic approach is crucial in critical infrastructure, where compromised devices can disrupt physical operations and endanger human safety. Attackers often exploit OT devices by altering their firmware or configurations, bypassing external defenses. RDAi’s lightweight Probe, embedded within each device, ensures continuous integrity monitoring without operational disruption. Organizations should integrate RDAi with existing SOC workflows to enhance detection capabilities and mitigate risks associated with AI-driven attacks.

Help Net Security · 2026-08-12 · Tools: Crytica’s RDAi detects OT device tampering internally, ensuring deterministic threat detection without disrupting operations.

Google’s strategy to combat abusive notifications integrates multiple security layers, targeting the lifecycle of notifications. Chrome Security identifies inactive or suspicious sites, while Safe Browsing flags deceptive practices. Firebase Cloud Messaging enforces rate limits, curbing large-scale abuse. Behavioral detection analyzes service worker activity to dismantle coordinated malicious networks. This proactive approach mitigates phishing, scams, and malware distribution. The updated permission model enhances user control, reducing interruptions and simplifying revocation of permissions. Defenders should monitor these developments, as they highlight the importance of layered defenses in combating evolving notification-based threats. Implementing similar rate-limiting and behavioral analysis mechanisms can strengthen organizational security postures.

Help Net Security · 2026-08-12 · Incidents: Chrome blocks 7 billion daily Android notifications by revoking permissions for inactive or abusive sites.

The attack path began with vishing (voice phishing), where threat actors socially engineered access via OAuth, bypassing technical controls. This low-tech entry point highlights gaps in employee training and multi-factor authentication (MFA) enforcement for privileged access. Affected scope includes customer PII, with legal and reputational risks amplified by delayed, vague disclosures. Mitigations: (1) Implement vishing simulations and strict verification protocols for credential resets, (2) Enforce MFA for all OAuth-enabled systems, (3) Pre-draft incident FAQs with clear, actionable answers—not legal boilerplate. The case reflects broader trends where extortion-fueled breaches exploit human vulnerabilities more than technical flaws.

Troy Hunt · 2026-08-12 · Incidents: Brinks Home's opaque FAQ responses exemplify how legal-speak undermines breach transparency after a vishing-triggered data leak.

The vulnerabilities in Ivanti's EPM pose significant risks due to their remote exploitability. CVE-2026-18129 exposes SQL credentials via cleartext transmission, a critical issue in MitM scenarios. CVE-2026-18125's out-of-bounds read flaw can disrupt agent services, while CVE-2026-18127's input validation weakness allows S3 bucket manipulation. The Neurons for MDM flaw, though less severe, still permits sensitive data disclosure. Attack paths likely involve network interception or crafted payloads targeting unpatched systems. Mitigation requires immediate deployment of EPM 2024 SU7 and Neurons for MDM R124. Organizations should also audit S3 bucket permissions and monitor for unusual activity.

SecurityWeek · 2026-08-12 · Vulnerability: Ivanti patches four vulnerabilities in EPM and Neurons for MDM, including three high-severity remote flaws requiring urgent updates.

The attack leveraged compromised versions of LiteLLM, an open-source AI gateway, to exfiltrate sensitive credentials from CI/CD environments. The malicious code targeted cloud keys, SSH keys, and Kubernetes tokens, with high-confidence attribution based on CI runner identity signals. The campaign's impact is confirmed by incidents like Checkmarx's GitHub compromise and unauthorized access to a European Commission AWS account. Mitigation requires immediate secret rotation, auditing installations during the March 24 window, and searching for campaign indicators like tpcp-docs repositories. The attack underscores the risks of supply-chain compromises and the need for robust dependency vetting.

The Hacker News · 2026-08-12 · Incidents: Malicious LiteLLM releases on PyPI exposed over 2,100 organizations to credential theft.

The disclosed vulnerabilities span a range of severity levels, with Siemens' Simatic IoT2050 Advanced flaw standing out due to its potential for unauthenticated remote code execution at elevated privileges—a prime target for attackers targeting operational technology (OT) environments. The Siveillance Video Management Servers' critical flaw further underscores the risk to physical security systems. Schneider's NetBotz and PowerChute vulnerabilities expose systems to command execution and brute-force attacks, respectively, while Phoenix Contact's PLCnext flaws could disrupt industrial processes via DoS or SQL injection. Mitigation requires immediate patching, network segmentation, and monitoring for anomalous authentication attempts, particularly in exposed ICS components.

SecurityWeek · 2026-08-12 · Vulnerability: ICS vendors patch critical vulnerabilities in industrial devices, including remote code execution and authentication flaws.

The flaw in SAP Commerce Cloud stems from a default authentication client that lacks proper input validation, enabling unauthenticated attackers to craft malicious inputs and execute arbitrary code. This attack path bypasses authentication entirely, making it particularly dangerous. The vulnerability affects the Data Hub Adapter, a core component, potentially compromising the entire application. Mitigation involves patching to the latest SAP Commerce Cloud release or implementing IP filtering as a temporary measure. The other critical vulnerabilities patched in the same update—CVE-2026-44772, CVE-2026-34265, and CVE-2026-44758—highlight systemic risks in SAP's manufacturing and ABAP platforms, emphasizing the need for comprehensive patch management.

The Hacker News · 2026-08-12 · Vulnerability: SAP Commerce Cloud's CVE-2026-58231 allows unauthenticated attackers to execute arbitrary code via insufficient authorization checks.

The ShieldBreak vulnerability exploits a race condition in Microsoft Defender, leveraging CVE-2026-50656 (RoguePlanet) to escalate privileges to SYSTEM level. The attack path involves manipulating file access scenarios to leak data and spawn a privileged shell. Affected systems include Windows 11 25H2 and Windows Server 2025, with Windows 10 also vulnerable but untested. Microsoft's initial patch was insufficient, highlighting a critical gap in defense-in-depth measures. Mitigations include applying the latest patches, monitoring for unusual system behavior, and restricting local account privileges. The inclusion of CVE-2026-68820 in CISA's KEV catalog underscores the urgency of remediation.

The Hacker News · 2026-08-12 · Vulnerability: ShieldBreak zero-day bypasses Microsoft Defender patch, enabling SYSTEM-level code execution.

The vulnerability exploits insufficient error checking in Cisco’s Secure Firewall ASA and FTD software, specifically targeting the Remote Access SSL VPN service. Attackers craft malicious HTTP requests to trigger a device reload, causing a DoS condition. This flaw impacts devices with IKEv2 Remote Access VPN, SSL-VPN, or Zero Trust Network Access configurations. Cisco has issued patches for affected versions, but no workarounds exist, leaving unpatched systems highly vulnerable. The active exploitation underscores the urgency for organizations to apply updates immediately. Given the inclusion in CISA’s Known Exploited Vulnerabilities catalog, federal agencies face a remediation deadline, highlighting the broader systemic risk posed by this flaw.

The Hacker News · 2026-08-12 · Vulnerability: Cisco ASA and FTD flaw (CVE-2026-20349) exploited in the wild allows unauthenticated attackers to cause DoS via crafted HTTP requests.

The vulnerability in Amazon Smart Plug arises from its distress beaconing process, which falls back to a less secure state under certain conditions. This flaw allows network-adjacent attackers to access sensitive information without authentication. By combining this vulnerability with other exploits, attackers can execute arbitrary code on the device, potentially gaining full control. The issue underscores the broader risks associated with IoT devices, particularly those with inadequate security protocols. Mitigation requires updating to version 3.1.212, isolating IoT devices on separate network segments, and monitoring for unusual activity. Organizations should also prioritize regular firmware updates and conduct security assessments to identify similar vulnerabilities in their IoT ecosystems.

ZDI (Zero Day Initiative) · 2026-08-12 · Vulnerability: Amazon Smart Plug's insecure fallback mechanism exposes sensitive information, enabling arbitrary code execution without authentication.

The vulnerability exploits the absence of certificate validation during OTA updates, a critical oversight in the device's security posture. Attackers within the same network can intercept and manipulate update packages, potentially leading to RCE. The flaw is particularly concerning given the device's widespread use in smart homes. Mitigation requires immediate update to version 3.1.212. Organizations should segment IoT devices to limit lateral movement and monitor for unusual update requests. This case underscores the importance of secure update mechanisms in IoT ecosystems.

ZDI (Zero Day Initiative) · 2026-08-12 · Vulnerability: Amazon Smart Plug's OTA update process lacks certificate validation, allowing network-adjacent attackers to execute arbitrary code.

The vulnerability in Amazon Smart Plug's OTA update mechanism highlights a critical oversight in input validation, enabling attackers to manipulate memory structures remotely. Exploitation requires proximity to the target network, but no authentication, lowering the barrier for attack. Successful exploitation grants code execution in the device's context, potentially compromising smart home ecosystems. Mitigation involves updating to version 3.1.212, isolating smart plugs on segmented networks, and monitoring for unusual traffic patterns. This flaw underscores the risks in IoT device update mechanisms, often overlooked in security assessments.

ZDI (Zero Day Initiative) · 2026-08-12 · Vulnerability: Amazon Smart Plug's OTA update process vulnerable to unauthenticated remote code execution via out-of-bounds write.

The vulnerability in Home Assistant Green's mDNS service exposes a critical SSRF flaw due to insufficient URI validation. Attackers on the same network can exploit this to initiate arbitrary server-side requests, bypassing authentication. When combined with other vulnerabilities, this could lead to remote code execution as root. The attack path involves crafting malicious mDNS queries to trigger unintended requests, potentially accessing internal services or escalating privileges. Affected installations must update immediately to the patched version. Network segmentation and strict mDNS service isolation can further reduce exposure. This flaw underscores the risks of protocol-level vulnerabilities in IoT devices.

ZDI (Zero Day Initiative) · 2026-08-12 · Vulnerability: Home Assistant Green's mDNS service lacks URI validation, enabling network-adjacent attackers to perform SSRF and potentially escalate to root RCE.

The vulnerability exploits Home Assistant Green's mishandling of SSDP headers, bypassing URI validation to trigger unauthorized server-side requests. Attackers within the same network can leverage this flaw without authentication, making it particularly dangerous in shared or IoT environments. The SSRF could serve as a pivot for chaining with other vulnerabilities, escalating to root-level code execution. Mitigation requires immediate patching to the latest Home Assistant version, network segmentation to isolate IoT devices, and monitoring for unusual outbound traffic from Home Assistant instances. The lack of authentication requirements amplifies the risk, emphasizing the need for proactive defense in IoT ecosystems.

ZDI (Zero Day Initiative) · 2026-08-12 · Vulnerability: Home Assistant Green's SSDP flaw allows network-adjacent attackers to perform SSRF attacks, potentially leading to root-level RCE.

The Kimwolf botnet's latest iteration demonstrates advanced evasion tactics, notably its HTTP/2 flood attack mimicking Chrome browser behavior, which complicates traffic filtering. By leveraging Ethereum Name Service for decentralized command servers, the botnet avoids registrar-based takedowns, while Tor fallback ensures operational continuity. This resilience is compounded by infrastructure likely hosted in Russia, complicating law enforcement efforts. Defenders should prioritize behavioral analysis over signature-based detection, monitor for unusual HTTP/2 traffic patterns, and consider blockchain-based threat intelligence feeds. Additionally, network segmentation and rate-limiting can mitigate DDoS impact.

CyberScoop · 2026-08-12 · Incidents: Kimwolf botnet now mimics Chrome traffic and uses blockchain for resilient C2, evading traditional takedowns.