Major Incidents or Breaches

  • Ceva Logistics experienced a cyberattack that disrupted operations at eight European warehouses, resulting in shipment delays for multiple customers [39].
  • Over 2,500 organizations were impacted by a supply chain attack on LiteLLM, which was compromised via the Trivy hack to distribute information-stealing malware [41].
  • The Colombian Justice Ministry was hit by a ransomware attack days before a presidential transition, continuing the trend of attacks on critical infrastructure in Latin America [26].
  • A long-running data theft campaign, dubbed “City-Forum,” has targeted Salesforce Experience Cloud and ServiceNow customer portals using custom tooling to steal data exposed to anonymous users. This campaign has been active since at least March 2025 and affects organizations across multiple sectors [12][24][38].
  • The FBI issued a warning about cybercriminals targeting online accounts to steal sexually explicit images and videos from adults and children [18].

Newly Discovered Vulnerabilities

  • Microsoft SharePoint vulnerability CVE-2026-55040 is being actively exploited following the public release of proof-of-concept code. This vulnerability allows attackers to bypass authentication and potentially gain access to sensitive data [5][20][35].
  • A Windows zero-day vulnerability (CVE-2026-68820) exploited by the Lazarus Group has been used to gain SYSTEM access and deploy a new backdoor, with defense-sector firms among the targets [6][17].
  • A new zero-day exploit for Microsoft Defender, named “ShieldBreak,” was released after the August 2026 Patch Tuesday, allowing any user to spawn a shell with SYSTEM privileges [22][34].
  • Adobe patched three CVSS 10.0 vulnerabilities in ColdFusion, Commerce, and Campaign Classic, which could lead to arbitrary code execution if exploited. Attempts to exploit the critical Adobe Commerce flaw (CVE-2026-71362) to hijack customer accounts have already been detected [10][14].
  • VMware vCenter’s critical vulnerability CVE-2026-593 is being actively exploited to gain persistent remote access [11].
  • Over 80 vulnerabilities were patched by Intel and AMD, including high-severity issues leading to privilege escalation and code execution [40].
  • Zoom patched critical “Zoomsday” vulnerabilities that could allow a participant to run malicious code on another participant’s device during a meeting [42].
  • Belgium’s eID authentication system was fully compromised due to severe vulnerabilities in a key browser extension, exposing citizen accounts to remote code execution [23].
  • August Patch Tuesday from Microsoft addressed 421 flaws, including three zero-days and 62 critical vulnerabilities, with numerous Office remote code execution bugs [43].
  • Researchers disclosed “Plug and Pwn” attacks that exploit Windows Plug and Play to install vulnerable vendor software and gain SYSTEM privileges via fake USB devices [16].

Notable Threat Actor Activity

  • The North Korean Lazarus Group exploited a Windows zero-day vulnerability to target defense firms as part of Operation Dream Job, deploying a new backdoor [6][17].
  • The Armored Likho group launched a new cyber-espionage campaign using the “Still Toolkit” to steal Telegram data and eavesdrop on victims, masquerading as fundraising efforts [1].

Trends, Tools, or Tactics of Interest

  • Over 737 Chrome VPN and proxy extensions were discovered routing user traffic through SOCKS5 proxies controlled by a single provider, mainly targeting Russian-speaking users. These extensions impersonated legitimate VPN and proxy services [7][15].
  • Attackers are exploiting unauthenticated guest access on Salesforce and ServiceNow portals to enumerate and exfiltrate exposed data in the “City-Forum” campaign [12][24][38].
  • New Android malware “WindRelay” is being used alongside the SpyNote RAT to steal live credit card data via NFC relay attacks and facilitate fraudulent loan applications [13].
  • Fake remote workers are exploiting gaps in hiring processes, device delivery, and account access to gain entry to organizations using false identities [19].
  • Enterprise defense trends show attackers increasingly using stealthy methods that avoid detection by making little to no noise, as highlighted in Picus Labs’ Blue Report 2026 [9].
  • A newly disclosed flaw in OpenAI, Anthropic, and Google APIs allowed weaker AI models to recover internal reasoning and secrets from session logs, including API keys [8].
  • Research from PortSwigger explores whether AI systems can autonomously invent new attack techniques beyond vulnerability discovery [33].
  • Security researchers demonstrated that a coin-sized device could be used to physically compromise a Boeing 737, opening exterior hatches and redirecting the autopilot or sabotaging the flight plan in under 60 seconds [28].
  • The “Plug and Pwn” attack vector highlights the risk of malicious USB devices being used to gain privileged access on Windows systems [16].

Regulatory or Policy Developments Affecting the Security Industry

  • Signal introduced Automatic Key Verification, a new security feature to help users ensure their encrypted chats have not been intercepted, aiming to thwart man-in-the-middle attacks [21][37].

[1]: https://securelist.com/armored-likho-still-toolkit/121033/ [5]: https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html [6]: https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html [7]: https://thehackernews.com/2026/08/737-chrome-vpn-extensions-caught.html [8]: https://thehackernews.com/2026/08/openai-anthropic-google-api-flaw-let.html [9]: https://thehackernews.com/2026/08/enterprise-defenses-recovered-at-edge.html [10]: https://thehackernews.com/2026/08/adobe-patches-three-cvss-100-coldfusion.html [11]: https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html [12]: https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/ [13]: https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/ [14]: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/ [15]: https://www.bleepingcomputer.com/news/security/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy/ [16]: https://www.bleepingcomputer.com/news/security/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access/ [17]: https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/ [18]: https://www.bleepingcomputer.com/news/security/fbi-warns-of-hackers-targeting-online-accounts-to-steal-explicit-photos/ [19]: https://www.bleepingcomputer.com/news/security/the-threat-hiding-in-your-hiring-process-how-fake-remote-workers-get-in/ [20]: https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/ [21]: https://www.bleepingcomputer.com/news/security/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks/ [22]: https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldbreak-zero-day-grants-system-privileges/ [23]: https://www.darkreading.com/application-security/belgium-eid-authentication-citizen-accounts-rce [24]: https://www.darkreading.com/cyberattacks-data-breaches/long-running-data-theft-campaign-salesforce-servicenow [26]: https://www.darkreading.com/cyberattacks-data-breaches/ransomware-hits-colombian-justice-ministry-presidential-transition [28]: https://www.wired.com/story/this-coin-sized-device-can-hack-a-boeing-737/ [33]: https://portswigger.net/blog/can-ai-invent-new-attack-techniques-new-research-from-james-kettle-and-portswigger-research [34]: https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak/ [35]: https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/ [37]: https://www.securityweek.com/whatsapp-unveils-new-scam-alert-feature/ [38]: https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/ [39]: https://www.securityweek.com/ceva-logistics-operations-disrupted-by-cyberattack/ [40]: https://www.securityweek.com/chipmaker-patch-tuesday-intel-amd-fix-over-80-vulnerabilities-combined/ [41]: https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/ [42]: https://www.malwarebytes.com/blog/bugs/2026/08/zoomsday-flaws-could-let-one-zoom-participant-attack-another [43]: https://www.malwarebytes.com/blog/bugs/2026/08/patch-tuesday-update-now-to-fix-421-flaws-including-three-zero-days

Sources#

  1. Ceva Logistics Operations Disrupted by Cyberattack - securityweek.com
  2. Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack - securityweek.com
  3. Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition - darkreading.com
  4. "City-Forum" data-theft attacks target Salesforce, ServiceNow portals - bleepingcomputer.com
  5. Long-running Data Theft Campaign Targeting Salesforce, ServiceNow - darkreading.com
  6. Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset - securityweek.com
  7. FBI: Hackers target online accounts to steal nude photos - bleepingcomputer.com
  8. Attackers Exploit SharePoint Authentication Bypass After Public PoC Release - thehackernews.com
  9. Hackers leverage new Microsoft SharePoint exploit in attacks - bleepingcomputer.com
  10. SharePoint Vulnerability Exploited Shortly After PoC Release - securityweek.com
  11. Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor - thehackernews.com
  12. Lazarus hackers exploited Windows zero-day to target defense firms - bleepingcomputer.com
  13. New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges - bleepingcomputer.com
  14. Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’ - securityweek.com
  15. Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws - thehackernews.com
  16. Hackers exploit critical Adobe Commerce flaw to hijack customer accounts - bleepingcomputer.com
  17. Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access - thehackernews.com
  18. Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined - securityweek.com
  19. “Zoomsday” flaws could let one Zoom participant attack another - malwarebytes.com
  20. Belgium's eID Authentication Opens Citizen Accounts to RCE - darkreading.com
  21. Patch Tuesday: Update now to fix 421 flaws, including three zero-days - malwarebytes.com
  22. Plug and Pwn attack uses fake USB devices for Windows SYSTEM access - bleepingcomputer.com
  23. Armored Likho expands its cyber-espionage toolkit - securelist.com
  24. 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One - thehackernews.com
  25. Hundreds of fake Chrome VPN extensions route traffic through a proxy - bleepingcomputer.com
  26. Android malware combo takes out loans and relays victims' credit cards - bleepingcomputer.com
  27. The Threat Hiding in Your Hiring Process: How Fake Remote Workers Get In - bleepingcomputer.com
  28. Enterprise Defenses Recovered at the Edge and Collapsed Inside - thehackernews.com
  29. OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning - thehackernews.com
  30. Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research - portswigger.net
  31. This Coin-Sized Device Can Hack a Boeing 737 - wired.com
  32. Signal adds new security feature to thwart man-in-the-middle attacks - bleepingcomputer.com
  33. WhatsApp Unveils New Scam Alert Feature - securityweek.com