Major Incidents or Breaches

  • Japanese cloud and data center provider Sakura Internet disclosed a breach in which hackers accessed its sales management system, exposing contract and membership information for up to 1.36 million accounts [15].
  • US healthcare IT company CareCloud revealed a data breach impacting more than 3.7 million patients [16].
  • A database belonging to the people-search tool ClarityCheck was left exposed, containing over 9 million image files of individuals’ faces [26].
  • Over 14,500 Dahua IP cameras were compromised in a campaign using credential attacks, authentication bypasses, and P2P exploitation, with most affected devices located in Ukraine and Russia [8][17].
  • Nearly 2,000 hacked WordPress sites were used as infrastructure for the StopAndProtect malware operation, facilitating malware distribution and data theft globally [10].
  • The Cl0p ransomware group publicly named over 40 victims from its PTC Windchill campaign, including major firms such as Shell, Philips, Fiserv, Zebra, Mindray, and Largan Precision [35].

Newly Discovered Vulnerabilities

  • A critical vulnerability in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload PHP files and execute remote code [4].
  • A remote Spectre attack against Cloudflare Workers enabled leakage of JWT tokens from co-located Workers at a rate of 12 bits per second in a production environment [5].
  • Four critical vulnerabilities affecting macOS, Microsoft SharePoint, VMware vCenter, and Microsoft IKE are under active exploitation, with CISA adding them to the Known Exploited Vulnerabilities catalog [11][36].
  • A critical remote code execution flaw in the Windows Internet Key Exchange (IKE) Extension is being actively exploited in the wild [22].
  • CVE-2026-19478, a critical GitLab vulnerability, can be exploited without authentication to modify or delete public projects and user data and has seen exploitation shortly after disclosure [30].
  • Google released a Chrome desktop update fixing 15 security issues, including two critical buffer overflow vulnerabilities [42][38].
  • Oracle’s August 2026 security update addressed over 1,000 vulnerabilities, including more than 460 remotely exploitable bugs across two dozen products [37].
  • Recent updates for Chrome and Firefox addressed vulnerabilities that could lead to code execution, privilege escalation, sandbox escape, and information disclosure [38].

Notable Threat Actor Activity

  • North Korean threat actor Famous Chollima is impersonating recruiters on LinkedIn to target users with ClickFix attacks [1].
  • The SilkParasite cyber espionage campaign, attributed to a Chinese-nexus group linked to FamousSparrow, is targeting Central Asian government entities using seven different remote access tool (RAT) families, including five newly identified RATs [7][25].
  • US authorities charged 17 Iranian nationals associated with the Mabna Institute for stealing $3.4 billion in intellectual property from American organizations over several years; rewards of $10 million are offered for information on five individuals [19][34].
  • A rogue ransomware affiliate is posing as a recovery service (“Ransom Busters”), contacting victims prior to public disclosure and fraudulently offering decryption services to steal payments [14].

Trends, Tools, or Tactics of Interest

  • There has been a 155-fold increase in password spraying attacks in the first half of 2026, with attackers exploiting gaps in multi-factor authentication and legacy authentication protocols; one campaign generated over 81 million login attempts in two weeks [20].
  • Threat actors are leveraging AI-generated scripts to exploit Siemens S7 Series PLCs in US critical infrastructure, as highlighted by a joint advisory from US cybersecurity agencies [18][31].
  • The “Kriminal” AI platform, while officially prohibiting illicit activity, provides guardrail-free social engineering, offensive cybercrime, and OSINT tools to users in exchange for cryptocurrency, raising concerns in the security community [24].
  • Researchers highlighted the emergence of “Phishing 3.0,” where adversaries deploy autonomous agents to interact with and bypass security agents, representing a shift from traditional payload-based phishing to agent-versus-agent tactics [9].
  • Forty-one deceptive download sites have been identified that initially display legitimate links before redirecting users elsewhere, undermining common download safety checks [39].
  • Scammers are using fake cryptocurrency anti-money laundering (AML) checker sites to trick users into granting wallet access, resulting in theft [41].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA and other agencies have urged immediate patching of actively exploited vulnerabilities in Microsoft, VMware, and Apple products, warning that these flaws enable remote code execution, authentication bypass, and device takeover [36].
  • Microsoft reminded customers that Windows 11 24H2 Home and Pro editions will reach end of support in two months, after which they will no longer receive updates [23].

[1]: North Korean Hackers Target LinkedIn Users With Fake Job Offers
[4]: Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
[5]: Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
[7]: SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
[8]: Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
[9]: Phishing 3.0: The Fight Moves to Agent Versus Agent
[10]: StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
[11]: Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
[14]: Rogue ransomware affiliate poses as recovery firm to steal payments
[15]: Sakura Internet hack exposes data of up to 1.36 million accounts
[16]: Healthtech firm CareCloud data breach impacts 3.7 million patients
[17]: Hackers compromise 14,500 Dahua web cameras in 35-day campaign
[18]: US warns of AI-powered attacks on Siemens PLCs in critical infrastructure
[19]: US charges Iranian hackers over $3.4 billion intellectual property theft
[20]: Password spraying attacks surge 155x as hackers exploit MFA gaps
[22]: Critical RCE flaw in Windows IKE Extension now actively exploited
[23]: Windows 11 24H2 Home and Pro reach end of support in 2 months
[24]: No-Filter ‘Kriminal’ AI Platform Raises Cybercrime Concerns
[25]: SilkParasite Threatens Central Asian Orgs With Flurry of RATs
[26]: Reverse-Lookup Service Exposed Millions of Photos of People’s Faces
[30]: Critical GitLab Flaw Exploited Shortly After Disclosure
[31]: Hackers Using AI to Target Siemens PLCs in Critical US Sectors
[34]: US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them
[35]: Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign
[36]: CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities
[37]: 943 Patches Rolled Out With Oracle’s August 2026 Security Update
[38]: Chrome, Firefox Updates Patch Dozens of Vulnerabilities
[39]: 41 deceptive download sites show a real link, then send you somewhere else
[41]: Scammers are using fake crypto AML checkers to drain your wallet
[42]: Update Chrome now: Two critical vulnerabilities fixed

Sources#

  1. Sakura Internet hack exposes data of up to 1.36 million accounts - bleepingcomputer.com
  2. Healthtech firm CareCloud data breach impacts 3.7 million patients - bleepingcomputer.com
  3. Reverse-Lookup Service Exposed Millions of Photos of People’s Faces - wired.com
  4. Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P - thehackernews.com
  5. Hackers compromise 14,500 Dahua web cameras in 35-day campaign - bleepingcomputer.com
  6. StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data - thehackernews.com
  7. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign - securityweek.com
  8. Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code - thehackernews.com
  9. Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second - thehackernews.com
  10. Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation - thehackernews.com
  11. CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities - securityweek.com
  12. Critical RCE flaw in Windows IKE Extension now actively exploited - bleepingcomputer.com
  13. Critical GitLab Flaw Exploited Shortly After Disclosure - securityweek.com
  14. Update Chrome now: Two critical vulnerabilities fixed - malwarebytes.com
  15. Chrome, Firefox Updates Patch Dozens of Vulnerabilities - securityweek.com
  16. 943 Patches Rolled Out With Oracle’s August 2026 Security Update - securityweek.com
  17. North Korean Hackers Target LinkedIn Users With Fake Job Offers - blog.knowbe4.com
  18. SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs - thehackernews.com
  19. SilkParasite Threatens Central Asian Orgs With Flurry of RATs - darkreading.com
  20. US charges Iranian hackers over $3.4 billion intellectual property theft - bleepingcomputer.com
  21. US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them - securityweek.com
  22. Rogue ransomware affiliate poses as recovery firm to steal payments - bleepingcomputer.com
  23. Password spraying attacks surge 155x as hackers exploit MFA gaps - bleepingcomputer.com
  24. US warns of AI-powered attacks on Siemens PLCs in critical infrastructure - bleepingcomputer.com
  25. Hackers Using AI to Target Siemens PLCs in Critical US Sectors - securityweek.com
  26. No-Filter 'Kriminal' AI Platform Raises Cybercrime Concerns - darkreading.com
  27. Phishing 3.0: The Fight Moves to Agent Versus Agent - thehackernews.com
  28. 41 deceptive download sites show a real link, then send you somewhere else - malwarebytes.com
  29. Scammers are using fake crypto AML checkers to drain your wallet - malwarebytes.com
  30. Windows 11 24H2 Home and Pro reach end of support in 2 months - bleepingcomputer.com