Major Incidents or Breaches

  • Wesco, a global supply chain and distribution company, is investigating a cybersecurity incident following claims by the ExfilSquad group of data theft from the company [30].
  • Mozilla revoked and updated the cryptographic signing key for Firefox and Thunderbird Linux releases after an unencrypted copy was accidentally committed to a private code repository, potentially impacting the integrity of downloads [17][31].
  • Fake CCleaner websites are distributing multi-stage malware that installs the GhostDesk spyware extension in Chrome browsers [54].
  • Attackers are using fake branded download pages to trick Windows users into installing legitimate remote-access software, which is then abused for unauthorized access [60].

Newly Discovered Vulnerabilities

  • SAP patched a maximum-severity flaw in Commerce Cloud (Data Hub Adapter) that allowed unauthenticated remote code execution [6][52].
  • Microsoft addressed nearly 400 vulnerabilities in its August Patch Tuesday, including a Windows kernel driver zero-day (afd.sys) under active attack for privilege escalation to SYSTEM, with three zero-days in total patched [9][28][37][40][42][48].
  • A proof-of-concept exploit named ShieldBreak was released, demonstrating a Microsoft Defender patch bypass that grants SYSTEM access [7].
  • Cisco Secure Firewall ASA and FTD vulnerabilities (CVE-2026-20349) are being actively exploited in the wild to trigger remote denial-of-service attacks, with patches released [8][25][47].
  • SonicWall patched critical vulnerabilities in its discontinued GMS platform that allowed unauthenticated remote code execution and data exposure [46].
  • Researchers disclosed an AI-assisted exploit chain for Microsoft SharePoint that enables unauthenticated remote code execution, now being used in ransomware attacks [13][34].
  • Zoom patched a vulnerability in the annotation tool that allowed meeting participants to hijack other attendees’ clients and execute code remotely [11][39][50].
  • Ivanti EPM updates addressed flaws that could leak credentials for external SQL connections or crash agent services [44].
  • Adobe released urgent patches for ColdFusion and Campaign Classic to fix critical code execution and denial-of-service vulnerabilities [49].
  • ClamAV vulnerabilities affecting Cisco Secure Endpoint Connector can be exploited for denial-of-service attacks, with public exploits available [35].
  • Siemens, Schneider, and Phoenix Contact released security updates addressing vulnerabilities in ICS and OT products [45].

Notable Threat Actor Activity

  • The Head Mare APT group is exploiting unpatched TrueConf server vulnerabilities to deliver PhantomCore and PhantomGraph backdoors to video conference participants via malicious installers [1].
  • Project CAV3RN is targeting Israeli organizations using Google Apps Script as a command-and-control relay and DNS-based channel selection, leveraging a modular .NET NativeAOT framework to evade detection [2].
  • The Russian Sandworm-linked group UAC-0145 is conducting social engineering campaigns targeting IT workers with fake job interviews, distributing a trojanized WireGuard VPN client capable of executing commands [12][24].
  • Researchers hired three suspected North Korean IT workers by creating a fake cryptocurrency startup, observing operational security tactics such as the use of virtual machines and attempts to exfiltrate data [18].
  • Gunra ransomware is targeting critical infrastructure globally, exploiting vulnerabilities in Fortinet and Schneider Electric products, and bypassing multi-factor authentication using leaked Conti code [21][36][38].
  • DeadLock ransomware is using decentralized, blockchain-based infrastructure (Polygon smart contracts) to facilitate victim communications and data leaks, making disruption more difficult [14][23].
  • Malicious SIM cards have been shown to execute attacker-controlled code within cellular IoT device modems, affecting sectors such as electric vehicle charging and industrial automation [16].

Trends, Tools, or Tactics of Interest

  • The Kimwolf v7 Android and IoT botnet has been updated to generate HTTP/2 DDoS traffic that closely mimics legitimate browsing, enhancing operational resilience and evasion [10].
  • DDoS attacks exceeding 1 Tbps increased fivefold in the last quarter, with over 800 network-layer attacks mitigated [33].
  • Malicious LiteLLM releases on PyPI, linked to the Trivy hack, carried credential-stealing code and potentially exposed sensitive data from over 2,100 organizations [5].
  • Attackers can split instructions across malicious MCP servers to covertly exfiltrate secrets from AI coding agents without triggering obvious alerts [20].
  • Researchers demonstrated that Windows Plug and Play USB auto-install can be abused to chain vendor software installation components, achieving SYSTEM-level access on fully updated Windows 11 machines [19].
  • AI tools are increasingly being used both for vulnerability discovery (e.g., in the Zoom and SharePoint exploits) and as a target for exploitation, with risks from vague task delegation and broad access in enterprise environments [13][32][39].
  • OpenAI launched GPT-5.6-Cyber, a model with reduced safeguards designed for cybersecurity tasks such as exploit development and incident response [15].

Regulatory or Policy Developments Affecting the Security Industry

  • U.S. and South Korean authorities issued joint warnings to government and critical infrastructure organizations regarding Gunra ransomware activity exploiting known vulnerabilities [21][36].
  • CISA published advisories on vulnerabilities in ICS and OT products from Siemens, Schneider, and Phoenix Contact [45].
  • Google reported that Chrome’s anti-abuse systems have reduced unwanted Android notifications by more than 7 billion per day in Q1 2026 [22].

Sources#

  1. Wesco confirms security incident after ExfilSquad claims data theft - bleepingcomputer.com
  2. Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo - thehackernews.com
  3. Mozilla updates GPG signing key for Firefox releases after exposure - bleepingcomputer.com
  4. Fake CCleaner installs GhostDesk Chrome spyware - malwarebytes.com
  5. Fake popular sites offer a free app, instead take over PCs - malwarebytes.com
  6. SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code - thehackernews.com
  7. SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities - securityweek.com
  8. Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack - thehackernews.com
  9. Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days - bleepingcomputer.com
  10. Microsoft's Patch Tuesday Deluge Continues With August Updates - darkreading.com
  11. Microsoft Plugs Nearly 400 Security Holes - krebsonsecurity.com
  12. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th) - isc.sans.edu
  13. August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day - securityweek.com
  14. ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access - thehackernews.com
  15. Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS - thehackernews.com
  16. Cisco warns of ASA and FTD VPN flaw exploited to crash devices - bleepingcomputer.com
  17. Cisco Patches Firewall Zero-Day Exploited for DoS Attacks - securityweek.com
  18. SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform - securityweek.com
  19. Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE - thehackernews.com
  20. CISA: Microsoft SharePoint flaw now exploited in ransomware attacks - bleepingcomputer.com
  21. Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client - thehackernews.com
  22. A Zoom Screen-Sharing Bug Let Anyone Take Over Other Devices on a Call - wired.com
  23. Zoom Patches Zero-Click Code Execution Vulnerability - securityweek.com
  24. Ivanti EPM Update Patches Remotely Exploitable Flaws - securityweek.com
  25. Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws - securityweek.com
  26. Cisco warns of high-severity ClamAV flaws with public exploits - bleepingcomputer.com
  27. ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact - securityweek.com
  28. Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants - securelist.com
  29. Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection - securelist.com
  30. Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands - thehackernews.com
  31. Sandworm hackers target IT pros with trojanized WireGuard VPN client - bleepingcomputer.com
  32. Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers - thehackernews.com
  33. Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks - thehackernews.com
  34. US and South Korea warn of Gunra ransomware targeting govt agencies - bleepingcomputer.com
  35. Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA - darkreading.com
  36. DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt - thehackernews.com
  37. DeadLock ransomware uses blockchain to resist infrastructure takedown - bleepingcomputer.com
  38. A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices - thehackernews.com
  39. Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing - thehackernews.com
  40. DDoS attacks over 1 Tbps surged fivefold in the second quarter - bleepingcomputer.com
  41. Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations - thehackernews.com
  42. Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets - thehackernews.com
  43. Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 - thehackernews.com
  44. Vague Task, Total Access: When AI Delegation Becomes a Security Risk - bleepingcomputer.com
  45. OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development - thehackernews.com
  46. Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse - bleepingcomputer.com