CVE-2026-71362 on DanSec Daily

Cybersecurity Brief – 2026-08-14

Fri, 14 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Trezor disclosed a data breach affecting nearly 14,000 customers after its shipping and logistics provider, ShipMonk, was compromised. Exposed data includes names, addresses, email addresses, and phone numbers, increasing the risk of targeted phishing attacks against Trezor users ^[12]^[20].
A former data analyst contractor for Brightly Software was sentenced to two years in prison after stealing company data and attempting to extort $2.5 million from his employer ^[4].
Apple sent new “Threat Notification” alerts to users who were targeted by mercenary spyware attacks, indicating ongoing campaigns leveraging sophisticated surveillance tools against high-risk individuals ^[5].
The Jewelbug hacker group has been observed breaching government webmail accounts for espionage purposes while simultaneously conducting cryptocurrency fraud operations ^[8]^[17].
Ukrainian authorities shut down 94 fraudulent call centers involved in investment scams and bank account access fraud, seizing millions in cash ^[6].

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being actively exploited to deploy reverse SSH tools, providing attackers persistence and remote access. The vulnerability is the subject of a global threat campaign, and patching alone may not fully mitigate the threat ^[11]^[16]^[29].
An unpatched SQL injection vulnerability in GeoServer is being exploited in the wild, allowing attackers to achieve remote code execution ^[21].
WordPress 7.0.4 patched a remote code execution vulnerability that could be exploited by users with Author-level or higher permissions via malicious Postscript files ^[25].
Adobe Commerce released a patch for CVE-2026-71362, a vulnerability that saw exploitation attempts immediately after disclosure ^[24].
Fortinet released patches for authentication flaws in FortiWeb and FortiManager that could allow attackers to log in with arbitrary credentials or impersonate FortiGate appliances ^[27].
Microsoft patched the LegacyHive Windows zero-day vulnerability, which was disclosed after the July 2026 Patch Tuesday ^[9].

Notable Threat Actor Activity

The Iran-linked APT42 group is conducting AI-assisted spear phishing campaigns targeting US organizations, leveraging artificial intelligence to enhance the effectiveness of their attacks ^[3].
Akira ransomware affiliates have been observed disabling endpoint detection and response (EDR) by rebooting compromised systems into Safe Mode with Networking, enabling data theft even when encryption fails ^[7].
Initial access brokers are using vishing (voice phishing) attacks through Microsoft Teams to gain entry for ransomware gangs ^[2].
The Jewelbug group is simultaneously engaged in state espionage and financially motivated cybercrime, including cryptocurrency theft ^[8]^[17].

Trends, Tools, or Tactics of Interest

The rise of “Shadow AI” is being identified as a new dimension of Shadow IT, with employees using unapproved AI tools and services in the workplace, increasing organizational risk ^[1].
AI coding tools are introducing unvetted or hallucinated open source dependencies at a pace that exceeds current security review capabilities, raising supply chain risks ^[13].
Multiple “AI watermark remover” tools have appeared online following the introduction of watermarking in Anthropic’s Claude model, though most cannot reliably remove watermarks, highlighting rapid attempts to circumvent AI content authenticity measures ^[10].
AmnesiaStealer, a Rust-based macOS infostealer, is capable of harvesting passwords, keychain data, browser information, and cookies, expanding the threat landscape for macOS users ^[22].
New Android malware combines social engineering, a remote access trojan, and NFC relay capabilities to enable real-time fraudulent use of victims’ bank cards ^[31].
WhatsApp has rolled out a “Scam Alert” feature using a local machine learning model to flag potential scam messages for users ^[15].

Regulatory or Policy Developments Affecting the Security Industry

The White House issued a memo instructing the National Coordination Center to establish a program allowing private security companies to apply for approval to conduct offensive hack-back operations against foreign cybercrime gangs. Contracts may require a $1 million bond to ensure compliance with operational requirements ^[14]^[28].
Over 3,000 lawsuits have been filed by parents against Meta, TikTok, Google, and Snap, challenging the design of social media platforms and their impact on youth safety ^[32].

Sources

Trezor discloses data breach affecting nearly 14,000 customers - bleepingcomputer.com
14,000 Trezor Customers Impacted by Data Breach at ShipMonk - securityweek.com
Data analyst sent to prison for stealing data, extorting employer - bleepingcomputer.com
Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks - bleepingcomputer.com
Hackers breach govt webmail while running parallel crypto fraud - bleepingcomputer.com
'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft - darkreading.com
Ukraine shuts down 94 fraudulent call centers, seize millions in cash - bleepingcomputer.com
Critical VMware vCenter RCE flaw exploited for reverse SSH access - bleepingcomputer.com
Global Threat Campaign Hits Critical VMware vCenter Flaw - darkreading.com
Critical VMware vCenter Vulnerability in Attackers’ Crosshairs - securityweek.com
Hackers Exploiting Unpatched GeoServer Zero-Day - securityweek.com
WordPress 7.0.4 Patches Remote Code Execution Vulnerability - securityweek.com
Adobe Commerce Bug Targeted Immediately After Disclosure - securityweek.com
Fortinet Patches Authentication Flaws in FortiWeb and FortiManager - securityweek.com
Microsoft patches LegacyHive Windows zero-day vulnerability - bleepingcomputer.com
Iranian APT Launches AI-Assisted Spear Phishing Attacks - blog.knowbe4.com
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt - bleepingcomputer.com
Warning: Vishing Attacks Open the Door to Ransomware Gangs - blog.knowbe4.com
Shadow AI: The New Frontier of Shadow IT - blog.knowbe4.com
Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion - bleepingcomputer.com
AI 'watermark removers' flood the web. Almost none can prove they work. - bleepingcomputer.com
AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions - securityweek.com
New Android malware lets criminals use your bank card in real time - malwarebytes.com
WhatsApp rolls out new feature that flags potential scam messages - bleepingcomputer.com
White House taps security firms for offensive hack-back operations - bleepingcomputer.com
White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs - securityweek.com
Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits - malwarebytes.com

Cybersecurity Brief – 2026-08-13

Thu, 13 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Ceva Logistics experienced a cyberattack that disrupted operations at eight European warehouses, resulting in shipment delays for multiple customers ^[39].
Over 2,500 organizations were impacted by a supply chain attack on LiteLLM, which was compromised via the Trivy hack to distribute information-stealing malware ^[41].
The Colombian Justice Ministry was hit by a ransomware attack days before a presidential transition, continuing the trend of attacks on critical infrastructure in Latin America ^[26].
A long-running data theft campaign, dubbed “City-Forum,” has targeted Salesforce Experience Cloud and ServiceNow customer portals using custom tooling to steal data exposed to anonymous users. This campaign has been active since at least March 2025 and affects organizations across multiple sectors ^[12]^[24]^[38].
The FBI issued a warning about cybercriminals targeting online accounts to steal sexually explicit images and videos from adults and children ^[18].

Newly Discovered Vulnerabilities

Microsoft SharePoint vulnerability CVE-2026-55040 is being actively exploited following the public release of proof-of-concept code. This vulnerability allows attackers to bypass authentication and potentially gain access to sensitive data ^[5]^[20]^[35].
A Windows zero-day vulnerability (CVE-2026-68820) exploited by the Lazarus Group has been used to gain SYSTEM access and deploy a new backdoor, with defense-sector firms among the targets ^[6]^[17].
A new zero-day exploit for Microsoft Defender, named “ShieldBreak,” was released after the August 2026 Patch Tuesday, allowing any user to spawn a shell with SYSTEM privileges ^[22]^[34].
Adobe patched three CVSS 10.0 vulnerabilities in ColdFusion, Commerce, and Campaign Classic, which could lead to arbitrary code execution if exploited. Attempts to exploit the critical Adobe Commerce flaw (CVE-2026-71362) to hijack customer accounts have already been detected ^[10]^[14].
VMware vCenter’s critical vulnerability CVE-2026-593 is being actively exploited to gain persistent remote access ^[11].
Over 80 vulnerabilities were patched by Intel and AMD, including high-severity issues leading to privilege escalation and code execution ^[40].
Zoom patched critical “Zoomsday” vulnerabilities that could allow a participant to run malicious code on another participant’s device during a meeting ^[42].
Belgium’s eID authentication system was fully compromised due to severe vulnerabilities in a key browser extension, exposing citizen accounts to remote code execution ^[23].
August Patch Tuesday from Microsoft addressed 421 flaws, including three zero-days and 62 critical vulnerabilities, with numerous Office remote code execution bugs ^[43].
Researchers disclosed “Plug and Pwn” attacks that exploit Windows Plug and Play to install vulnerable vendor software and gain SYSTEM privileges via fake USB devices ^[16].

Notable Threat Actor Activity

The North Korean Lazarus Group exploited a Windows zero-day vulnerability to target defense firms as part of Operation Dream Job, deploying a new backdoor ^[6]^[17].
The Armored Likho group launched a new cyber-espionage campaign using the “Still Toolkit” to steal Telegram data and eavesdrop on victims, masquerading as fundraising efforts ^[1].

Trends, Tools, or Tactics of Interest

Over 737 Chrome VPN and proxy extensions were discovered routing user traffic through SOCKS5 proxies controlled by a single provider, mainly targeting Russian-speaking users. These extensions impersonated legitimate VPN and proxy services ^[7]^[15].
Attackers are exploiting unauthenticated guest access on Salesforce and ServiceNow portals to enumerate and exfiltrate exposed data in the “City-Forum” campaign ^[12]^[24]^[38].
New Android malware “WindRelay” is being used alongside the SpyNote RAT to steal live credit card data via NFC relay attacks and facilitate fraudulent loan applications ^[13].
Fake remote workers are exploiting gaps in hiring processes, device delivery, and account access to gain entry to organizations using false identities ^[19].
Enterprise defense trends show attackers increasingly using stealthy methods that avoid detection by making little to no noise, as highlighted in Picus Labs’ Blue Report 2026 ^[9].
A newly disclosed flaw in OpenAI, Anthropic, and Google APIs allowed weaker AI models to recover internal reasoning and secrets from session logs, including API keys ^[8].
Research from PortSwigger explores whether AI systems can autonomously invent new attack techniques beyond vulnerability discovery ^[33].
Security researchers demonstrated that a coin-sized device could be used to physically compromise a Boeing 737, opening exterior hatches and redirecting the autopilot or sabotaging the flight plan in under 60 seconds ^[28].
The “Plug and Pwn” attack vector highlights the risk of malicious USB devices being used to gain privileged access on Windows systems ^[16].

Regulatory or Policy Developments Affecting the Security Industry

Signal introduced Automatic Key Verification, a new security feature to help users ensure their encrypted chats have not been intercepted, aiming to thwart man-in-the-middle attacks ^[21]^[37].

Sources

Ceva Logistics Operations Disrupted by Cyberattack - securityweek.com
Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack - securityweek.com
Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition - darkreading.com
"City-Forum" data-theft attacks target Salesforce, ServiceNow portals - bleepingcomputer.com
Long-running Data Theft Campaign Targeting Salesforce, ServiceNow - darkreading.com
Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset - securityweek.com
FBI: Hackers target online accounts to steal nude photos - bleepingcomputer.com
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release - thehackernews.com
Hackers leverage new Microsoft SharePoint exploit in attacks - bleepingcomputer.com
SharePoint Vulnerability Exploited Shortly After PoC Release - securityweek.com
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor - thehackernews.com
Lazarus hackers exploited Windows zero-day to target defense firms - bleepingcomputer.com
New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges - bleepingcomputer.com
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’ - securityweek.com
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws - thehackernews.com
Hackers exploit critical Adobe Commerce flaw to hijack customer accounts - bleepingcomputer.com
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access - thehackernews.com
Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined - securityweek.com
“Zoomsday” flaws could let one Zoom participant attack another - malwarebytes.com
Belgium's eID Authentication Opens Citizen Accounts to RCE - darkreading.com
Patch Tuesday: Update now to fix 421 flaws, including three zero-days - malwarebytes.com
Plug and Pwn attack uses fake USB devices for Windows SYSTEM access - bleepingcomputer.com
Armored Likho expands its cyber-espionage toolkit - securelist.com
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One - thehackernews.com
Hundreds of fake Chrome VPN extensions route traffic through a proxy - bleepingcomputer.com
Android malware combo takes out loans and relays victims' credit cards - bleepingcomputer.com
The Threat Hiding in Your Hiring Process: How Fake Remote Workers Get In - bleepingcomputer.com
Enterprise Defenses Recovered at the Edge and Collapsed Inside - thehackernews.com
OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning - thehackernews.com
Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research - portswigger.net
This Coin-Sized Device Can Hack a Boeing 737 - wired.com
Signal adds new security feature to thwart man-in-the-middle attacks - bleepingcomputer.com
WhatsApp Unveils New Scam Alert Feature - securityweek.com