Major Incidents or Breaches

  • Aesto Health disclosed a data breach affecting over 9.5 million patients, exposing sensitive health information[20].
  • Novocure reported a cyberattack in mid-August that exposed data of more than 1,400 US cancer patients and an undisclosed number of employees[23].
  • A new dark web identity theft service is selling digital scans of over 153 million driver’s licenses from the US and Canada, with the FBI investigating a possible link to a breach at idscan.net[35][50].
  • The US Department of Justice, in coordination with international law enforcement, dismantled the Sality peer-to-peer botnet, disrupting malware payload delivery[10][17][42].
  • Attackers compromised the update infrastructure of Virtualizor VPS management software via BGP hijacking, serving malicious updates using a valid TLS certificate[22][39].
  • An attack on the Philippines Nuclear Agency leveraged old, unpatched vulnerabilities in ownCloud, resulting in the theft of reactor databases, personnel records, and credential stores[26].

Newly Discovered Vulnerabilities

  • SonicWall SMA 1000 series VPN appliances are affected by two chained zero-day vulnerabilities (CVE-2026-83549 and CVE-2026-83548) that allow unauthenticated remote code execution, which have been exploited in active attacks[5][18][43].
  • GeoNetwork patched two vulnerabilities that can be chained for unauthenticated remote code execution, affecting government and agency geospatial portal backends[6].
  • Sangoma Switchvox enterprise VoIP platform is being actively exploited via a critical vulnerability that allows unauthenticated remote code execution and reverse shell deployment[9].
  • JFrog Artifactory is impacted by CVE-2026-82329, an authentication bypass flaw enabling admin-level access, which is being exploited days after disclosure[11][27].
  • Langflow, an open-source AI application framework, is subject to active exploitation of CVE-2026-0768, an unauthenticated remote code execution vulnerability used to steal OpenAI and AWS credentials and tokens[21][29].
  • Chrome and Firefox have released updates to address multiple vulnerabilities, including use-after-free, sandbox escape, and privilege escalation bugs; two critical Chrome flaws allow code execution via malicious websites[41][49].
  • Nearly 22,000 Microsoft Exchange servers remain exposed online and unpatched against a high-severity authentication bypass vulnerability that allows mailbox hijacking[25].

Notable Threat Actor Activity

  • A Russian national extradited from Cyprus has been charged in the US for operating a malware campaign that used 255 fake freelancer accounts to deliver malware-laced Excel attachments, infecting over 80,000 freelancers with TVRAT and DarkVNC[7][16].
  • The Iranian threat group Nimbus Manticore has been linked to two new malware families and is using recruiter-themed social engineering to deliver cross-platform remote access trojans via coding tests[14].
  • The financially motivated Breeze Comet group (formerly UNC5669) has been targeting Brazilian financial, retail, and e-commerce sectors with fraudulent transactions through Brazilian payment systems since 2024[12].
  • Phishing actors are abusing the Faronics Deploy endpoint-management platform to install ScreenConnect remote support software for gaining remote administrative control[19].
  • Chinese-speaking actors have weaponised Brazilian government sites for SEO poisoning campaigns, redirecting users to phishing and malicious content[3][48].
  • The ClickFix campaign has compromised 31 organisations, dynamically updating its command-and-control infrastructure via the Polygon blockchain using EtherHiding[31].
  • Thirteen malicious Composer theme packages were found on Packagist, injecting JavaScript to target unpatched iPhones and steal cryptocurrency wallet seeds via Vietnamese streaming sites[13].

Trends, Tools, or Tactics of Interest

  • Phishing remains the leading initial access vector for cyberattacks, according to recent industry reporting[2].
  • Cloaked SEO poisoning attacks, termed “Chameleon SEO poisoning,” surged by 40 percent in Q2 2026, leveraging search engine manipulation to spread phishing pages[3].
  • Adversaries have begun exploiting AI development and deployment platforms, with attacks on AI frameworks like Langflow increasing in frequency and sophistication[21][29].
  • Researchers demonstrated the use of Anthropic’s Claude AI to port a pre-authentication RCE exploit between different WAGO PLC models, highlighting the potential for AI-assisted exploit development[8][47].
  • Ransomware groups are increasingly seeking insider assistance to bypass improved external security controls, with a rise in insider-facilitated attacks[28].
  • Attackers are abusing legitimate administrative and endpoint management tools, such as Faronics Deploy, to install remote access software and maintain persistence[19].
  • Threat actors are using blockchain technologies, such as Polygon, to dynamically update and obfuscate command-and-control servers, as seen in the ClickFix campaign[31].

Regulatory or Policy Developments Affecting the Security Industry

  • The US Coast Guard has established an Office of Maritime Cybersecurity Policy, centralising cybersecurity policy for US ports, vessels, and maritime facilities[46].
  • Anthropic announced the Enterprise Frontier Safeguards (EFS) system, combining zero data retention with automated misuse monitoring for enterprise AI deployments[38].

Sources#

  1. Aesto Health says data breach affects over 9.5 million patients - bleepingcomputer.com
  2. Novocure data breach affects more than 1,400 cancer patients - bleepingcomputer.com
  3. FBI Probes Service Selling 153M+ Drivers Licenses - krebsonsecurity.com
  4. 153M+ driver’s licenses for sale on new dark web platform - malwarebytes.com
  5. Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads - thehackernews.com
  6. Sality botnet infrastructure dismantled in joint global takedown - bleepingcomputer.com
  7. 23-Year-Old Sality P2P Botnet Disrupted - securityweek.com
  8. Hackers push malicious Virtualizor update in BGP hijacking attack - bleepingcomputer.com
  9. Malicious Virtualizor Update Served via BGP Hijacking - securityweek.com
  10. Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency - darkreading.com
  11. Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain - thehackernews.com
  12. SonicWall warns of actively exploited SMA1000 zero-day flaws - bleepingcomputer.com
  13. SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks - securityweek.com
  14. GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends - thehackernews.com
  15. Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials - thehackernews.com
  16. Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure - thehackernews.com
  17. Attackers Pounce on Critical Artifactory Flaw Following Disclosure - darkreading.com
  18. Critical Langflow flaw exploited to steal OpenAI and AWS keys - bleepingcomputer.com
  19. Critical Langflow Flaw Exploited as Attacks on AI Platform Rise - darkreading.com
  20. Chrome and Firefox Updates Patch Dozens of Vulnerabilities - securityweek.com
  21. Two critical Chrome flaws put users at risk on malicious websites - malwarebytes.com
  22. Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks - bleepingcomputer.com
  23. Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands - thehackernews.com
  24. US charges Russian for infecting 80,000 freelancers with malware - bleepingcomputer.com
  25. Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests - thehackernews.com
  26. Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems - thehackernews.com
  27. Hackers abuse Faronics Deploy admin tool to install ScreenConnect - bleepingcomputer.com
  28. Warning: Chameleon SEO Poisoning Spreads Phishing Pages - blog.knowbe4.com
  29. Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon - research.checkpoint.com
  30. ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain - darkreading.com
  31. 13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds - thehackernews.com
  32. CyberheistNews Vol 16 #35 [New Report] Phishing Is Still the No. 1 Initial Threat Access Vector - blog.knowbe4.com
  33. Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another - thehackernews.com
  34. Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars - securityweek.com
  35. Stronger Security Drives Ransomware Groups to Recruit From Within - darkreading.com
  36. Coast Guard Establishes Office of Maritime Cybersecurity Policy - securityweek.com
  37. Anthropic Details Response to Security Incidents, Unveils Enterprise Safeguards - securityweek.com