Major Incidents or Breaches

  • A database belonging to the people finder service ClarityCheck was found exposed, leaking 9 million images of individuals’ faces [57].
  • Operation CameraSwarm compromised 14,000 Dahua IP cameras across Ukraine and Russia, with a focus on Russian and CIS telecom networks [46].
  • The Grandoreiro banking trojan has resurfaced in a new campaign targeting Mexico, following a previous law enforcement takedown [36].
  • A new Android malware named Manic is actively targeting Ukrainian banks, government, and identity services, as well as Russian and European financial institutions. It can exfiltrate data from offline devices by leveraging nearby infected devices [19][28].
  • A critical vulnerability in the Elementor Pro WordPress plugin enables attackers to upload executable files for remote code execution on affected servers [24].
  • A set of 40 malicious Mozilla Firefox extensions, posing as Web3 wallet products, have been identified stealing cryptocurrency wallet secrets [22].
  • A researcher discovered new Android malware distributed via legitimate DoFun head unit software, serving ads and building a proxy botnet [1].
  • A new report indicates that one in four data breaches now involve AI-enabled attacks, marking a 56 percent increase from the previous year [3].

Newly Discovered Vulnerabilities

  • GitLab vulnerability CVE-2026-19478 (CVSS 9.4) is under active exploitation, allowing attackers to exploit affected instances shortly after disclosure [6].
  • Microsoft Entra ID is affected by a critical remote code execution vulnerability (CVSS 10.0) that has been exploited in the wild [7].
  • Malicious versions of three Rust crates, including arrayref, were published after a maintainer account compromise, introducing build-time malware that executed on developers’ systems [8][23].
  • A critical vulnerability in the MLflow open-source AI engineering platform is being exploited to steal cloud credentials by allowing HTTP requests to internal endpoints [27][48].
  • Citrix NetScaler ADC and NetScaler Gateway are affected by two security flaws, including a critical authentication bypass. Exploitation is expected and admins are urged to patch immediately [14][26][52].
  • Zimbra Collaboration Suite (ZCS) is being actively exploited via a now-patched critical remote code execution vulnerability [15][29][44].
  • Atlassian and Splunk have issued patches for dozens of critical and high-severity vulnerabilities that could enable arbitrary code execution, privilege escalation, and data access [47].
  • Cisco has patched critical vulnerabilities in Crosswork and Secure Workload products, which could result in remote code execution, authentication bypass, and path traversal [49].
  • A critical flaw in the isolated-vm open-source JavaScript sandbox allows attackers to escape the sandbox and potentially achieve remote code execution [13].
  • NASA’s AIT-GUI operator console contains a chain of flaws allowing unauthenticated attackers to issue spacecraft commands [20].

Notable Threat Actor Activity

  • Suspected Russian cyber espionage groups have been observed abusing legitimate authentication flows, including Google OAuth and WhatsApp linking, to hijack accounts of individuals in academia, aerospace and defense, government, and NGOs [9].
  • The Head Mare hacktivist group has exploited vulnerabilities in TrueConf software to deploy PhantomCore malware [43].
  • Pakistan-linked threat actor Transparent Tribe has refreshed its toolset for cyberattacks targeting Afghan organizations, with limited success against Indian government agencies [35].

Trends, Tools, or Tactics of Interest

  • AI-generated exploit scripts are being used in active threats targeting US critical infrastructure, specifically Siemens S7 PLCs [11].
  • Attackers are exploiting trusted components, such as signed drivers and legitimate applications, to evade detection and blend malware into environments [10][53].
  • The Manic Android malware introduces a fallback data exfiltration mechanism using proximity to other infected devices, enabling data theft even from offline phones [19][28].
  • The ToxicPanda 2.0 and GoldDigger Android banking malware families have expanded their capabilities to include on-device fraud and a broader set of remote commands [21].
  • Researchers have demonstrated a “Zombie Card” attack that revives expired Visa contactless cards for in-store purchases by rewriting expiration data at the point of sale [16].
  • Two new denial-of-service (DoS) attacks exploit how major CDNs translate HTTP/3 to HTTP/1.1, resulting in amplification up to 350 times [18].
  • AI is increasingly being leveraged to personalize phishing attacks, making them harder for traditional email filters to detect [25].
  • The CUSTODY framework has been released to constrain AI agents in enterprise networks, following OpenAI-related incidents [31].
  • OpenAI has overhauled model security with new features such as sandboxing, 30-minute alerting, and training pauses in response to recent security incidents [51].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has issued warnings and urged immediate patching for actively exploited vulnerabilities in MLflow and TrueConf [27][43].
  • Twitch has introduced an opt-out option for users who do not want their content used for Amazon AI training [55].

[1]: https://securelist.com/android-head-unit-malware/121106/ [3]: https://blog.knowbe4.com/report-one-quarter-of-breaches-are-enabled-by-ai-driven-attacks [6]: https://thehackernews.com/2026/08/gitlab-cve-2026-19478-comes-under.html [7]: https://thehackernews.com/2026/08/microsoft-entra-id-flaw-cvss-100.html [8]: https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html [9]: https://thehackernews.com/2026/08/suspected-russian-hackers-abuse-google.html [13]: https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html [14]: https://thehackernews.com/2026/08/critical-netscaler-flaw-can-bypass.html [15]: https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html [16]: https://thehackernews.com/2026/08/zombie-card-attack-can-revive-expired.html [18]: https://thehackernews.com/2026/08/cdn-tsunami-attack-abuses-http3.html [19]: https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html [20]: https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html [21]: https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html [22]: https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html [23]: https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/ [24]: https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/ [25]: https://www.bleepingcomputer.com/news/security/how-msps-can-catch-phishing-attacks-email-filters-miss/ [26]: https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible/ [27]: https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-mlflow-vulnerability/ [28]: https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/ [29]: https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks/ [31]: https://darkreading.com/perimeter/new-custody-framework-constrains-ai-agents-inside-network [35]: https://darkreading.com/cyberattacks-data-breaches/pakistan-transparent-tribe-afghan-cyberattacks [36]: https://darkreading.com/cyberattacks-data-breaches/grandoreiro-resurfaces-mexico-campaign [43]: https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-trueconf-vulnerabilities/ [44]: https://www.securityweek.com/hackers-target-zimbra-servers-in-active-exploitation-campaign/ [46]: https://www.securityweek.com/threat-actor-hacks-14000-ip-cameras-in-ukraine-and-russia/ [47]: https://www.securityweek.com/atlassian-splunk-patch-dozens-of-critical-high-severity-vulnerabilities/ [48]: https://www.securityweek.com/mlflow-vulnerability-exploited-for-cloud-credential-theft/ [49]: https://www.securityweek.com/cisco-patches-critical-crosswork-secure-workload-vulnerabilities/ [51]: https://www.securityweek.com/openai-overhauls-model-security-with-sandboxing-30-minute-alerts-and-training-pauses/ [52]: https://www.securityweek.com/exploitation-expected-for-critical-authentication-bypass-patched-in-citrix-netscaler/ [53]: https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/ [55]: https://www.malwarebytes.com/blog/ai/2026/08/twitch-wants-your-content-for-amazon-ai-training-heres-how-to-opt-out [57]: https://www.malwarebytes.com/blog/privacy/2026/08/9-million-images-of-peoples-faces-exposed-by-reverse-lookup-service

Sources#

  1. 9 million images of people’s faces exposed by reverse lookup service - malwarebytes.com
  2. Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia - securityweek.com
  3. 'Grandoreiro' Malware Resurfaces With Mexico Campaign - darkreading.com
  4. Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices - thehackernews.com
  5. New Manic Android malware can exfiltrate data through nearby devices - bleepingcomputer.com
  6. Critical Elementor Pro bug exposes WordPress sites to RCE attacks - bleepingcomputer.com
  7. 40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets - thehackernews.com
  8. The invisible passenger in your car - securelist.com
  9. Report: One-Quarter of Breaches Are Enabled by AI-Driven Attacks - blog.knowbe4.com
  10. GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure - thehackernews.com
  11. Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution - thehackernews.com
  12. Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads - thehackernews.com
  13. Hackers poison arrayref Rust crate to push infostealer malware - bleepingcomputer.com
  14. CISA warns of hackers exploiting critical MLflow vulnerability - bleepingcomputer.com
  15. MLflow Vulnerability Exploited for Cloud Credential Theft - securityweek.com
  16. Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers - thehackernews.com
  17. Citrix urges admins to patch new NetScaler flaws as soon as possible - bleepingcomputer.com
  18. Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler - securityweek.com
  19. Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution - thehackernews.com
  20. Critical Zimbra RCE flaw now actively exploited in attacks - bleepingcomputer.com
  21. Hackers Target Zimbra Servers in Active Exploitation Campaign - securityweek.com
  22. Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities - securityweek.com
  23. Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities - securityweek.com
  24. Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE - thehackernews.com
  25. NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands - thehackernews.com
  26. Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts - thehackernews.com
  27. CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities - securityweek.com
  28. Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks - darkreading.com
  29. AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure - thehackernews.com
  30. ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More - thehackernews.com
  31. BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - research.checkpoint.com
  32. ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud - thehackernews.com
  33. Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments - thehackernews.com
  34. CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification - thehackernews.com
  35. How MSPs can catch phishing attacks email filters miss - bleepingcomputer.com
  36. New CUSTODY Framework Constrains AI Agents Inside the Network - darkreading.com
  37. OpenAI Overhauls Model Security With Sandboxing, 30-Minute Alerts, and Training Pauses - securityweek.com
  38. Twitch wants your content for Amazon AI training. Here’s how to opt out - malwarebytes.com