Cybersecurity Brief – 2026-09-02

Wed, 02 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Aesto Health disclosed a data breach affecting over 9.5 million patients, exposing sensitive health information^[20].
Novocure reported a cyberattack in mid-August that exposed data of more than 1,400 US cancer patients and an undisclosed number of employees^[23].
A new dark web identity theft service is selling digital scans of over 153 million driver’s licenses from the US and Canada, with the FBI investigating a possible link to a breach at idscan.net^[35]^[50].
The US Department of Justice, in coordination with international law enforcement, dismantled the Sality peer-to-peer botnet, disrupting malware payload delivery^[10]^[17]^[42].
Attackers compromised the update infrastructure of Virtualizor VPS management software via BGP hijacking, serving malicious updates using a valid TLS certificate^[22]^[39].
An attack on the Philippines Nuclear Agency leveraged old, unpatched vulnerabilities in ownCloud, resulting in the theft of reactor databases, personnel records, and credential stores^[26].

Newly Discovered Vulnerabilities

SonicWall SMA 1000 series VPN appliances are affected by two chained zero-day vulnerabilities (CVE-2026-83549 and CVE-2026-83548) that allow unauthenticated remote code execution, which have been exploited in active attacks^[5]^[18]^[43].
GeoNetwork patched two vulnerabilities that can be chained for unauthenticated remote code execution, affecting government and agency geospatial portal backends^[6].
Sangoma Switchvox enterprise VoIP platform is being actively exploited via a critical vulnerability that allows unauthenticated remote code execution and reverse shell deployment^[9].
JFrog Artifactory is impacted by CVE-2026-82329, an authentication bypass flaw enabling admin-level access, which is being exploited days after disclosure^[11]^[27].
Langflow, an open-source AI application framework, is subject to active exploitation of CVE-2026-0768, an unauthenticated remote code execution vulnerability used to steal OpenAI and AWS credentials and tokens^[21]^[29].
Chrome and Firefox have released updates to address multiple vulnerabilities, including use-after-free, sandbox escape, and privilege escalation bugs; two critical Chrome flaws allow code execution via malicious websites^[41]^[49].
Nearly 22,000 Microsoft Exchange servers remain exposed online and unpatched against a high-severity authentication bypass vulnerability that allows mailbox hijacking^[25].

Notable Threat Actor Activity

A Russian national extradited from Cyprus has been charged in the US for operating a malware campaign that used 255 fake freelancer accounts to deliver malware-laced Excel attachments, infecting over 80,000 freelancers with TVRAT and DarkVNC^[7]^[16].
The Iranian threat group Nimbus Manticore has been linked to two new malware families and is using recruiter-themed social engineering to deliver cross-platform remote access trojans via coding tests^[14].
The financially motivated Breeze Comet group (formerly UNC5669) has been targeting Brazilian financial, retail, and e-commerce sectors with fraudulent transactions through Brazilian payment systems since 2024^[12].
Phishing actors are abusing the Faronics Deploy endpoint-management platform to install ScreenConnect remote support software for gaining remote administrative control^[19].
Chinese-speaking actors have weaponised Brazilian government sites for SEO poisoning campaigns, redirecting users to phishing and malicious content^[3]^[48].
The ClickFix campaign has compromised 31 organisations, dynamically updating its command-and-control infrastructure via the Polygon blockchain using EtherHiding^[31].
Thirteen malicious Composer theme packages were found on Packagist, injecting JavaScript to target unpatched iPhones and steal cryptocurrency wallet seeds via Vietnamese streaming sites^[13].

Trends, Tools, or Tactics of Interest

Phishing remains the leading initial access vector for cyberattacks, according to recent industry reporting^[2].
Cloaked SEO poisoning attacks, termed “Chameleon SEO poisoning,” surged by 40 percent in Q2 2026, leveraging search engine manipulation to spread phishing pages^[3].
Adversaries have begun exploiting AI development and deployment platforms, with attacks on AI frameworks like Langflow increasing in frequency and sophistication^[21]^[29].
Researchers demonstrated the use of Anthropic’s Claude AI to port a pre-authentication RCE exploit between different WAGO PLC models, highlighting the potential for AI-assisted exploit development^[8]^[47].
Ransomware groups are increasingly seeking insider assistance to bypass improved external security controls, with a rise in insider-facilitated attacks^[28].
Attackers are abusing legitimate administrative and endpoint management tools, such as Faronics Deploy, to install remote access software and maintain persistence^[19].
Threat actors are using blockchain technologies, such as Polygon, to dynamically update and obfuscate command-and-control servers, as seen in the ClickFix campaign^[31].

Regulatory or Policy Developments Affecting the Security Industry

The US Coast Guard has established an Office of Maritime Cybersecurity Policy, centralising cybersecurity policy for US ports, vessels, and maritime facilities^[46].
Anthropic announced the Enterprise Frontier Safeguards (EFS) system, combining zero data retention with automated misuse monitoring for enterprise AI deployments^[38].

Sources

Aesto Health says data breach affects over 9.5 million patients - bleepingcomputer.com
Novocure data breach affects more than 1,400 cancer patients - bleepingcomputer.com
FBI Probes Service Selling 153M+ Drivers Licenses - krebsonsecurity.com
153M+ driver’s licenses for sale on new dark web platform - malwarebytes.com
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads - thehackernews.com
Sality botnet infrastructure dismantled in joint global takedown - bleepingcomputer.com
23-Year-Old Sality P2P Botnet Disrupted - securityweek.com
Hackers push malicious Virtualizor update in BGP hijacking attack - bleepingcomputer.com
Malicious Virtualizor Update Served via BGP Hijacking - securityweek.com
Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency - darkreading.com
Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain - thehackernews.com
SonicWall warns of actively exploited SMA1000 zero-day flaws - bleepingcomputer.com
SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks - securityweek.com
GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends - thehackernews.com
Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials - thehackernews.com
Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure - thehackernews.com
Attackers Pounce on Critical Artifactory Flaw Following Disclosure - darkreading.com
Critical Langflow flaw exploited to steal OpenAI and AWS keys - bleepingcomputer.com
Critical Langflow Flaw Exploited as Attacks on AI Platform Rise - darkreading.com
Chrome and Firefox Updates Patch Dozens of Vulnerabilities - securityweek.com
Two critical Chrome flaws put users at risk on malicious websites - malwarebytes.com
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks - bleepingcomputer.com
Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands - thehackernews.com
US charges Russian for infecting 80,000 freelancers with malware - bleepingcomputer.com
Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests - thehackernews.com
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems - thehackernews.com
Hackers abuse Faronics Deploy admin tool to install ScreenConnect - bleepingcomputer.com
Warning: Chameleon SEO Poisoning Spreads Phishing Pages - blog.knowbe4.com
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon - research.checkpoint.com
ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain - darkreading.com
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds - thehackernews.com
CyberheistNews Vol 16 #35 [New Report] Phishing Is Still the No. 1 Initial Threat Access Vector - blog.knowbe4.com
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another - thehackernews.com
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars - securityweek.com
Stronger Security Drives Ransomware Groups to Recruit From Within - darkreading.com
Coast Guard Establishes Office of Maritime Cybersecurity Policy - securityweek.com
Anthropic Details Response to Security Incidents, Unveils Enterprise Safeguards - securityweek.com

WAGO on DanSec Daily

Cybersecurity Brief – 2026-09-02

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources