Cybersecurity Brief – 2026-08-20

Thu, 20 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Japanese cloud and data center provider Sakura Internet disclosed a breach in which hackers accessed its sales management system, exposing contract and membership information for up to 1.36 million accounts ^[15].
US healthcare IT company CareCloud revealed a data breach impacting more than 3.7 million patients ^[16].
A database belonging to the people-search tool ClarityCheck was left exposed, containing over 9 million image files of individuals’ faces ^[26].
Over 14,500 Dahua IP cameras were compromised in a campaign using credential attacks, authentication bypasses, and P2P exploitation, with most affected devices located in Ukraine and Russia ^[8]^[17].
Nearly 2,000 hacked WordPress sites were used as infrastructure for the StopAndProtect malware operation, facilitating malware distribution and data theft globally ^[10].
The Cl0p ransomware group publicly named over 40 victims from its PTC Windchill campaign, including major firms such as Shell, Philips, Fiserv, Zebra, Mindray, and Largan Precision ^[35].

Newly Discovered Vulnerabilities

A critical vulnerability in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload PHP files and execute remote code ^[4].
A remote Spectre attack against Cloudflare Workers enabled leakage of JWT tokens from co-located Workers at a rate of 12 bits per second in a production environment ^[5].
Four critical vulnerabilities affecting macOS, Microsoft SharePoint, VMware vCenter, and Microsoft IKE are under active exploitation, with CISA adding them to the Known Exploited Vulnerabilities catalog ^[11]^[36].
A critical remote code execution flaw in the Windows Internet Key Exchange (IKE) Extension is being actively exploited in the wild ^[22].
CVE-2026-19478, a critical GitLab vulnerability, can be exploited without authentication to modify or delete public projects and user data and has seen exploitation shortly after disclosure ^[30].
Google released a Chrome desktop update fixing 15 security issues, including two critical buffer overflow vulnerabilities ^[42]^[38].
Oracle’s August 2026 security update addressed over 1,000 vulnerabilities, including more than 460 remotely exploitable bugs across two dozen products ^[37].
Recent updates for Chrome and Firefox addressed vulnerabilities that could lead to code execution, privilege escalation, sandbox escape, and information disclosure ^[38].

Notable Threat Actor Activity

North Korean threat actor Famous Chollima is impersonating recruiters on LinkedIn to target users with ClickFix attacks ^[1].
The SilkParasite cyber espionage campaign, attributed to a Chinese-nexus group linked to FamousSparrow, is targeting Central Asian government entities using seven different remote access tool (RAT) families, including five newly identified RATs ^[7]^[25].
US authorities charged 17 Iranian nationals associated with the Mabna Institute for stealing $3.4 billion in intellectual property from American organizations over several years; rewards of $10 million are offered for information on five individuals ^[19]^[34].
A rogue ransomware affiliate is posing as a recovery service (“Ransom Busters”), contacting victims prior to public disclosure and fraudulently offering decryption services to steal payments ^[14].

Trends, Tools, or Tactics of Interest

There has been a 155-fold increase in password spraying attacks in the first half of 2026, with attackers exploiting gaps in multi-factor authentication and legacy authentication protocols; one campaign generated over 81 million login attempts in two weeks ^[20].
Threat actors are leveraging AI-generated scripts to exploit Siemens S7 Series PLCs in US critical infrastructure, as highlighted by a joint advisory from US cybersecurity agencies ^[18]^[31].
The “Kriminal” AI platform, while officially prohibiting illicit activity, provides guardrail-free social engineering, offensive cybercrime, and OSINT tools to users in exchange for cryptocurrency, raising concerns in the security community ^[24].
Researchers highlighted the emergence of “Phishing 3.0,” where adversaries deploy autonomous agents to interact with and bypass security agents, representing a shift from traditional payload-based phishing to agent-versus-agent tactics ^[9].
Forty-one deceptive download sites have been identified that initially display legitimate links before redirecting users elsewhere, undermining common download safety checks ^[39].
Scammers are using fake cryptocurrency anti-money laundering (AML) checker sites to trick users into granting wallet access, resulting in theft ^[41].

Regulatory or Policy Developments Affecting the Security Industry

CISA and other agencies have urged immediate patching of actively exploited vulnerabilities in Microsoft, VMware, and Apple products, warning that these flaws enable remote code execution, authentication bypass, and device takeover ^[36].
Microsoft reminded customers that Windows 11 24H2 Home and Pro editions will reach end of support in two months, after which they will no longer receive updates ^[23].

Sources

Sakura Internet hack exposes data of up to 1.36 million accounts - bleepingcomputer.com
Healthtech firm CareCloud data breach impacts 3.7 million patients - bleepingcomputer.com
Reverse-Lookup Service Exposed Millions of Photos of People’s Faces - wired.com
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P - thehackernews.com
Hackers compromise 14,500 Dahua web cameras in 35-day campaign - bleepingcomputer.com
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data - thehackernews.com
Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign - securityweek.com
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code - thehackernews.com
Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second - thehackernews.com
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation - thehackernews.com
CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities - securityweek.com
Critical RCE flaw in Windows IKE Extension now actively exploited - bleepingcomputer.com
Critical GitLab Flaw Exploited Shortly After Disclosure - securityweek.com
Update Chrome now: Two critical vulnerabilities fixed - malwarebytes.com
Chrome, Firefox Updates Patch Dozens of Vulnerabilities - securityweek.com
943 Patches Rolled Out With Oracle’s August 2026 Security Update - securityweek.com
North Korean Hackers Target LinkedIn Users With Fake Job Offers - blog.knowbe4.com
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs - thehackernews.com
SilkParasite Threatens Central Asian Orgs With Flurry of RATs - darkreading.com
US charges Iranian hackers over $3.4 billion intellectual property theft - bleepingcomputer.com
US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them - securityweek.com
Rogue ransomware affiliate poses as recovery firm to steal payments - bleepingcomputer.com
Password spraying attacks surge 155x as hackers exploit MFA gaps - bleepingcomputer.com
US warns of AI-powered attacks on Siemens PLCs in critical infrastructure - bleepingcomputer.com
Hackers Using AI to Target Siemens PLCs in Critical US Sectors - securityweek.com
No-Filter 'Kriminal' AI Platform Raises Cybercrime Concerns - darkreading.com
Phishing 3.0: The Fight Moves to Agent Versus Agent - thehackernews.com
41 deceptive download sites show a real link, then send you somewhere else - malwarebytes.com
Scammers are using fake crypto AML checkers to drain your wallet - malwarebytes.com
Windows 11 24H2 Home and Pro reach end of support in 2 months - bleepingcomputer.com

Sakura Internet on DanSec Daily

Cybersecurity Brief – 2026-08-20

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources