Cybersecurity Brief – 2026-08-26

Wed, 26 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Nutex Health, a healthcare and services provider, confirmed a data breach involving unauthorized access and data exfiltration from company servers, with sensitive information exposed^[18]^[31].
The Los Angeles County Museum of Art (LACMA) disclosed that a breach last year exposed customer and employee social security and medical data^[14].
Over 270 Zimbra Collaboration Suite servers have been compromised in ongoing attacks exploiting a high-severity remote code execution vulnerability^[22].
Norway’s shared government digital infrastructure suffered significant disruption due to a large-scale distributed denial-of-service (DDoS) attack, impacting public sector services^[17].

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability in Gitea (CVE-2026-60004) is being actively exploited in the wild. The vulnerability was patched in Gitea version 1.27.1, but attackers are deploying miner-like payloads on unpatched instances^[3]^[32].
Two severe unauthenticated authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress are under active exploitation, allowing attackers to gain admin access^[13]^[35].
A high-severity flaw in Marimo notebook software was patched after it was found to allow attacker-supplied Model Context Protocol (MCP) command execution in specially crafted notebooks^[8].
Researchers disclosed a weakness in NVIDIA NemoClaw and its integration with the Ollama API that enables unauthenticated attackers to take control of local AI agent instances and plant persistent malicious instructions^[6]^[26].

Notable Threat Actor Activity

A commercial phishing-as-a-service toolkit, Mirage2FA, has targeted over 4,500 organisations in the US and EU since 2024, abusing Microsoft 365 login flows to bypass two-factor authentication^[9].
Threat actors are abusing npm and its mirrors to host clusters of malicious packages that redirect users to fake Cloudflare CAPTCHA phishing pages^[10]^[15].
A new campaign uses FTP banners as dead drop resolvers to deliver two novel remote access trojans (E4del and PINHOLE RAT), leveraging FTP banner text as a covert command and control channel^[11].
Iranian cyber actors have been sanctioned by the US government for their role in critical infrastructure breaches^[5].
A newly identified phishing-as-a-service platform, AnonyMousKIT, employs AI voice agents to call Apple device theft victims, attempting to phish for passcodes and two-factor authentication codes to bypass Apple’s Activation Lock^[4]^[16].

Trends, Tools, or Tactics of Interest

Phishing remains the leading initial access vector, responsible for more than half of observed cyberattacks in Q2 2026. Microsoft reported observing 7.6 billion phishing emails during this period^[1]^[2].
Attackers are increasingly targeting identity verification and account recovery processes, rather than just login credentials, to compromise accounts^[19].
Prompt injection attacks are being used to manipulate AI-powered email summarizers and assistants by embedding malicious or hidden instructions in otherwise benign-looking content, including encrypted text^[25]^[41].
AI model poisoning is an emerging concern, with vulnerabilities in local AI agent serving platforms allowing attackers to persistently corrupt models via malicious web content^[6]^[26].
WhatsApp has introduced support for multiple passkeys and stronger two-step verification to enhance account security across iOS and Android^[7]^[21]^[36].
Law enforcement agencies from 22 countries arrested 58 individuals and identified 263 suspects in a global crackdown on cybercrime networks coordinated by African crime groups^[23].

Regulatory or Policy Developments Affecting the Security Industry

The US Department of the Treasury announced new sanctions targeting Iranian cyber actors involved in attacks on critical infrastructure^[5].
Nigeria launched new financing, procurement, and infrastructure policies to support sovereign cloud initiatives aimed at strengthening national cybersecurity and technical capabilities^[24].
The Linux Foundation will govern TRACE, an open standard for AI runtime attestation, with contributions from AMD, Intel, Microsoft, OPAQUE, and TII^[33].
Taiwan charged nine individuals, including staff from Nvidia and Super Micro, for illegal exports of AI servers to China, highlighting ongoing regulatory scrutiny in the AI infrastructure supply chain^[40].

Sources

Hospital operator Nutex Health says data stolen in cyberattack - bleepingcomputer.com
Sensitive Information Exposed in Nutex Health Data Breach - securityweek.com
LACMA data breach last year exposed social security and medical data - bleepingcomputer.com
Hackers breached over 270 Zimbra servers in ongoing attacks - bleepingcomputer.com
Massive DDoS attack disrupts Norway’s government digital services - bleepingcomputer.com
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload - thehackernews.com
CISA Warns of Exploited Gitea Vulnerability - securityweek.com
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access - thehackernews.com
WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities - securityweek.com
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode - thehackernews.com
A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw - thehackernews.com
Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw - darkreading.com
Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows - thehackernews.com
24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages - thehackernews.com
Hackers abuse npm mirrors to host phishing redirect pages - bleepingcomputer.com
E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands - thehackernews.com
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches - thehackernews.com
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes - thehackernews.com
AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes - bleepingcomputer.com
Report: Phishing Remains the Primary Initial Access Vector - blog.knowbe4.com
CyberheistNews Vol 16 #34 Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026 - blog.knowbe4.com
From Fake Workers to Account Recovery: The Growing Identity Verification Risk - bleepingcomputer.com
Hidden Prompts Trick AI Into False Email Summaries - darkreading.com
Grok fooled into stealing user chat, location data, and more - malwarebytes.com
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android - thehackernews.com
WhatsApp adds stronger two-step verification, multiple passkeys - bleepingcomputer.com
WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update - securityweek.com
Police arrests dozens of suspects in global cybercrime crackdown - bleepingcomputer.com
Nigeria Looks to Sovereign Cloud for Cyber, National Security - darkreading.com
Linux Foundation to Govern TRACE, an Open Standard for AI Runtime Attestation - securityweek.com
Taiwan Charges 9 Over Illegal AI Server Exports to China, Including Nvidia and Super Micro Staff - securityweek.com

CVE-2026-61979 on DanSec Daily

Cybersecurity Brief – 2026-08-26

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources