Cyber Threat Digest — Cyber Attacks

Hackers breached a small Polish energy plant via private APN last year

Mon, 10 Aug 2026 23:07:21 +0000

Hackers breached a heat-and-power plant facility in Poland, which supplies heat to about 50,000 residents, using a private APN (Access Point Name) to access an OT (Operational Technology) network. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.80)

My Homelab Got Hacked – A Postmortem

Mon, 10 Aug 2026 23:04:18 +0000

Article URL: https://phunky.cafe/my-homelab-got-hacked/ Comments URL: https://news.ycombinator.com/item?id=49251087 Points: 6 # Comments: 0

Source: Hacker News (attack filter)

Classification: cyber_attacks (confidence 0.42; also threat_intel 0.36)

BdThemes plugins supply-chain hack creates rogue WordPress admins

Mon, 10 Aug 2026 21:12:10 +0000

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create rogue admin accounts. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.37; also threat_intel 0.59)

OpenAI releases ChatGPT 5.6 Cyber, but it's only for approved users

Mon, 10 Aug 2026 19:24:40 +0000

OpenAI has developed a new model called "GPT 5.6 Cyber," designed for vulnerability research, penetration testing, incident response, and remediation. [...]

Source: BleepingComputer

Tags: Security, Artificial Intelligence

Classification: cyber_attacks (confidence 0.70; also vulnerabilities 0.52)

CISA Advisory: #StopRansomware: Gunra Ransomware

Mon, 10 Aug 2026 19:02:46 +0000

Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom... Source

Source: DataBreaches.net

Tags: Malware

Classification: cyber_attacks (confidence 0.99; also threat_intel 0.91)

New StormEncryptor ransomware used by former Medusa affiliate

Mon, 10 Aug 2026 17:42:00 +0000

A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.98; also threat_intel 0.59)

China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

Mon, 10 Aug 2026 16:38:37 +0000

Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware, the Microsoft Threat Intelligence Team said. "StormEncryptor is written in C++ and appends the file name extension .encrypted

Source: The Hacker News

Classification: cyber_attacks (confidence 0.98; also threat_intel 0.88, vulnerabilities 0.53)

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors

Mon, 10 Aug 2026 15:00:29 +0000

A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a box exposed. Trusting the default. That pretty much covers the mood this week. Old bugs are back, supply chains are getting stranger, and some exploit paths are so short you wonder what was supposed to stop them in the first place. That’s only part of it. Here’s

Source: The Hacker News

Classification: cyber_attacks (confidence 0.93; also vulnerabilities 0.87, threat_intel 0.56)

Someone hacked the X algorithm with fable and shows how it works

Mon, 10 Aug 2026 14:47:54 +0000

Article URL: https://thomasunise.com/x-algorithm Comments URL: https://news.ycombinator.com/item?id=49244428 Points: 3 # Comments: 0

Source: Hacker News (attack filter)

Classification: cyber_attacks (confidence 0.42; also threat_intel 0.36)

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

Mon, 10 Aug 2026 14:34:32 +0000

CISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.90; also vulnerabilities 0.91)

OpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack Concerns

Mon, 10 Aug 2026 14:33:36 +0000

The current GPT-5.6-Sol has been assigned a ‘high’ cybersecurity threshold, but Astra could reach the maximum ‘critical’ threshold. The post OpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack Concerns appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Artificial Intelligence, AI, Astra, cybersecurity AI, OpenAI, OpenAI Astra

Classification: cyber_attacks (confidence 0.79)

Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds

Mon, 10 Aug 2026 14:19:36 +0000

The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure. The post Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Application Security, Supply Chain Security

Classification: cyber_attacks (confidence 0.35)

Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC

Mon, 10 Aug 2026 14:07:48 +0000

Remote, unauthenticated attackers could exploit the bugs to cause a denial-of-service (DoS) condition. The post Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Vulnerabilities, Cisco, ClamAV, DoS, Patch, PoC, public PoC, vulnerability

Classification: cyber_attacks (confidence 0.35; also vulnerabilities 1.00)

CVE-2026-68130: In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroy_previous_session() until

Mon, 10 Aug 2026 13:19:58 +0000

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroy_previous_session() until after NTLM authentication In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM. Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development

Mon, 10 Aug 2026 13:19:58 +0000

North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun running artificial intelligence (AI) offline on its own servers, connecting document-search tools to files in its possession, and collecting the software parts needed to build AI into its malware. South Korean security firm Genians says it uncovered the

Source: The Hacker News

Classification: cyber_attacks (confidence 0.35; also threat_intel 0.98)

CVE-2026-59090 (CVSS 8.4 HIGH): A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem`

Mon, 10 Aug 2026 13:19:51 +0000

CVSS 8.4 HIGH. A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-19278 (CVSS 6.8 MEDIUM): A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator

Mon, 10 Aug 2026 13:17:58 +0000

CVSS 6.8 MEDIUM. A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad

Mon, 10 Aug 2026 12:59:34 +0000

An AI agent executes instructions that an attacker has planted in the log or alert that records a blocked request word for word. The post ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Artificial Intelligence, AI, Ghostjacking

Classification: cyber_attacks (confidence 0.56)

Member of The Com sent to prison for blackmail, sextortion

Mon, 10 Aug 2026 12:56:28 +0000

A member of "The Com," a loose-knit online cybercrime collective that targets children and teenagers, has been sentenced to two years in prison for blackmail and sextortion offenses against nearly 120 victims worldwide. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.37)

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Mon, 10 Aug 2026 12:25:04 +0000

Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed, abused a cloud-synced passkey system from malware already on the victim's machine, and used a

Source: The Hacker News

Classification: cyber_attacks (confidence 0.79; also threat_intel 0.74)

CVE-2026-64941: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an

Mon, 10 Aug 2026 12:17:19 +0000

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validate_local_url!/2 in lib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. It rejects a leading // and any backslash, but not ASCII tab, LF or CR. Browsers strip those three characters before parsing a URL, so a value such as /<TAB>/example.com passes validation as a path and is then resolved as the scheme-relative URL //example.com. The live navigation functions share the guard but are not affected, because the client expands their target against the current origin. push_patch/2 is also affected before 0.7.0, which is when that expansion was added. This issue affects phoenix_live_view: from 0.5.0 before 1.0.19, from 1.1.0-rc.0 before 1.1.33, and from 1.2.0-rc.0 before 1.2.9.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

Valve notifies Steam hardware customers of a data breach

Mon, 10 Aug 2026 11:47:55 +0000

Video game publisher and digital distribution giant Valve is notifying Steam hardware customers in Europe that hackers stole their data after hacking its shipping partner, CEVA Logistics. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.93)

New Jersey, Alabama Join States Targeted in Water Cyberattacks

Mon, 10 Aug 2026 11:44:26 +0000

Hackers linked to Iran targeted industrial control systems (ICS) at water facilities in at least a dozen US states. The post New Jersey, Alabama Join States Targeted in Water Cyberattacks appeared first on SecurityWeek .

Source: SecurityWeek

Tags: ICS/OT, ICS, OT, Water

Classification: cyber_attacks (confidence 0.86)

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Mon, 10 Aug 2026 11:33:41 +0000

The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning instrumentation, electronics, transport, energy, IT, and software development sectors. Russian cybersecurity vendor Kaspersky said it detected the attacks in July 2026. The activity involves exploiting a vulnerability chain

Source: The Hacker News

Classification: cyber_attacks (confidence 0.35; also vulnerabilities 0.89, threat_intel 0.82)

CVE-2026-72593 (CVSS 9.8 CRITICAL): A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to

Mon, 10 Aug 2026 11:17:32 +0000

CVSS 9.8 CRITICAL. A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, CRITICAL

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-72592 (CVSS 9.8 CRITICAL): An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to

Mon, 10 Aug 2026 11:17:32 +0000

CVSS 9.8 CRITICAL. An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, CRITICAL

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-72588 (CVSS 5.3 MEDIUM): A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to

Mon, 10 Aug 2026 11:17:31 +0000

CVSS 5.3 MEDIUM. A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99, threat_intel 0.53)

CVE-2026-72587 (CVSS 6.1 MEDIUM): A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to

Mon, 10 Aug 2026 11:17:31 +0000

CVSS 6.1 MEDIUM. A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-72586 (CVSS 7.5 HIGH): A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to

Mon, 10 Aug 2026 11:17:31 +0000

CVSS 7.5 HIGH. A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-72582 (CVSS 7.5 HIGH): A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to

Mon, 10 Aug 2026 11:17:31 +0000

CVSS 7.5 HIGH. A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99, threat_intel 0.53)

CVE-2026-72580 (CVSS 9.8 CRITICAL): An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute

Mon, 10 Aug 2026 11:17:30 +0000

CVSS 9.8 CRITICAL. An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, CRITICAL

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-72579 (CVSS 7.5 HIGH): An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can

Mon, 10 Aug 2026 11:17:30 +0000

CVSS 7.5 HIGH. An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-72578 (CVSS 8.8 HIGH): A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker

Mon, 10 Aug 2026 11:17:30 +0000

CVSS 8.8 HIGH. A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-72577 (CVSS 9.8 CRITICAL): Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary

Mon, 10 Aug 2026 11:17:30 +0000

CVSS 9.8 CRITICAL. Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, CRITICAL

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-72575 (CVSS 9.1 CRITICAL): An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read,

Mon, 10 Aug 2026 11:17:30 +0000

CVSS 9.1 CRITICAL. An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, CRITICAL

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-72574 (CVSS 6.1 MEDIUM): A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to

Mon, 10 Aug 2026 11:17:30 +0000

CVSS 6.1 MEDIUM. A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-72573 (CVSS 8.8 HIGH): An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to

Mon, 10 Aug 2026 11:17:30 +0000

CVSS 8.8 HIGH. An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-72572 (CVSS 7.5 HIGH): A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and

Mon, 10 Aug 2026 11:17:29 +0000

CVSS 7.5 HIGH. A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download, enabling directory traversal via ../ sequences to access sensitive system files.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-72571 (CVSS 7.5 HIGH): A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker

Mon, 10 Aug 2026 11:17:29 +0000

CVSS 7.5 HIGH. A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-72570 (CVSS 5.4 MEDIUM): A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to

Mon, 10 Aug 2026 11:17:29 +0000

CVSS 5.4 MEDIUM. A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-72569 (CVSS 9.1 CRITICAL): A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to

Mon, 10 Aug 2026 11:17:29 +0000

CVSS 9.1 CRITICAL. A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, CRITICAL

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-72568 (CVSS 7.1 HIGH): An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial

Mon, 10 Aug 2026 11:17:29 +0000

CVSS 7.1 HIGH. An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-72565 (CVSS 9.8 CRITICAL): A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass

Mon, 10 Aug 2026 11:17:28 +0000

CVSS 9.8 CRITICAL. A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, CRITICAL

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-72564 (CVSS 9.6 CRITICAL): An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to

Mon, 10 Aug 2026 11:17:28 +0000

CVSS 9.6 CRITICAL. An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, CRITICAL

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-66485: GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function

Mon, 10 Aug 2026 11:17:27 +0000

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-61899: Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets

Mon, 10 Aug 2026 11:17:27 +0000

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

Metabase Patches Vulnerability Exploited as Zero-Day

Mon, 10 Aug 2026 11:03:55 +0000

The security defect allows unauthenticated, remote attackers to gain administrative access to Metabase instances. The post Metabase Patches Vulnerability Exploited as Zero-Day appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Vulnerabilities, exploited, Metabase, Zero-Day

Classification: cyber_attacks (confidence 0.35; also vulnerabilities 1.00)

The OpenAI and Hugging Face breach story told from the perspective of the AI

Mon, 10 Aug 2026 10:52:23 +0000

Article URL: https://www.youtube.com/watch?v=RE4IDWjfOZc Comments URL: https://news.ycombinator.com/item?id=49242015 Points: 3 # Comments: 0

Source: Hacker News (attack filter)

Classification: cyber_attacks (confidence 0.42; also threat_intel 0.36)

CVE-2026-66915: Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.7 - An unauthenticated attacker could execute

Mon, 10 Aug 2026 10:17:33 +0000

Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.7 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-44630: Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to

Mon, 10 Aug 2026 10:17:32 +0000

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

The dumbest ransomware I've ever seen

Mon, 10 Aug 2026 10:04:59 +0000

Article URL: https://mrunix.me/posts/ransomware/ Comments URL: https://news.ycombinator.com/item?id=49241642 Points: 3 # Comments: 0

Source: Hacker News (attack filter)

Classification: cyber_attacks (confidence 0.76; also threat_intel 0.36)

Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility

Mon, 10 Aug 2026 10:01:52 +0000

CERT.PL said this appears to be the first instance of a private APN being used as an attack vector. The post Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility appeared first on SecurityWeek .

Source: SecurityWeek

Tags: ICS/OT, Malware & Threats, energy, Featured, ICS, OT, PLC, Poland, power grid, SCADA

Classification: cyber_attacks (confidence 0.69; also threat_intel 0.69)

IT threat evolution in Q2 2026. Non-mobile statistics

Mon, 10 Aug 2026 10:00:37 +0000

The report presents key trends and statistics on malware that targeted personal computers running Windows and macOS, as well as internet of things (IoT) devices, during Q2 2026.

Source: Securelist (Kaspersky GReAT)

Tags: Malware reports, Linux, Microsoft Windows, Malware Statistics, Apple MacOS, Antivirus Technologies, Trojan, Internet of Things, Mirai, RaaS, Honeypot, Miner

Classification: cyber_attacks (confidence 0.89; also threat_intel 0.94)

IT threat evolution in Q2 2026. Mobile statistics

Mon, 10 Aug 2026 10:00:09 +0000

This report contains mobile threat statistics for Q2 2026, along with noteworthy discoveries and quarterly trends: the Anatsa banker and a transition to droppers.

Source: Securelist (Kaspersky GReAT)

Tags: Malware reports, Google Android, Adware, Mobile Malware, Malware Statistics, Trojan Banker, Trojan, Trojan Clicker, Trojan-Dropper, Google Play, Mamont, Triada

Classification: cyber_attacks (confidence 0.53; also threat_intel 0.88)

Critical Progress LoadMaster flaw now actively exploited in attacks

Mon, 10 Aug 2026 09:49:37 +0000

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.70; also vulnerabilities 0.99)

CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability

Mon, 10 Aug 2026 09:31:51 +0000

The critical-severity flaw allows unauthenticated, remote attackers to execute arbitrary commands. The post CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Vulnerabilities, CISA KEV, exploited, Kemp LoadMaster, Progress Software

Classification: cyber_attacks (confidence 0.35; also vulnerabilities 0.99)

CVE-2026-21084: Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive

Mon, 10 Aug 2026 09:17:22 +0000

Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-21083: Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive

Mon, 10 Aug 2026 09:17:22 +0000

Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-21082: Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive

Mon, 10 Aug 2026 09:17:21 +0000

Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-21080: Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to

Mon, 10 Aug 2026 09:17:21 +0000

Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-21079: Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept

Mon, 10 Aug 2026 09:17:21 +0000

Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-21077: Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive

Mon, 10 Aug 2026 09:17:21 +0000

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-21076: Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive

Mon, 10 Aug 2026 09:17:21 +0000

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-21075: Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to

Mon, 10 Aug 2026 09:17:21 +0000

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-21074: Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands

Mon, 10 Aug 2026 09:17:20 +0000

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-21073: Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch

Mon, 10 Aug 2026 09:17:20 +0000

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21072: Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write

Mon, 10 Aug 2026 09:17:20 +0000

Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21071: Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to

Mon, 10 Aug 2026 09:17:20 +0000

Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21070: Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access

Mon, 10 Aug 2026 09:17:20 +0000

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21068: Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to

Mon, 10 Aug 2026 09:17:20 +0000

Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-21067: Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds

Mon, 10 Aug 2026 09:17:19 +0000

Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21066: Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write

Mon, 10 Aug 2026 09:17:19 +0000

Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21065: Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write

Mon, 10 Aug 2026 09:17:19 +0000

Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21064: Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device

Mon, 10 Aug 2026 09:17:19 +0000

Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21063: Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers

Mon, 10 Aug 2026 09:17:19 +0000

Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

Corporate Data Stolen in Levi Strauss Cyberattack

Mon, 10 Aug 2026 08:55:44 +0000

Using social engineering, a threat actor accessed the computers of three employees and exfiltrated data from them. The post Corporate Data Stolen in Levi Strauss Cyberattack appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Data Breaches, data breach, Levi Strauss

Classification: cyber_attacks (confidence 1.00; also threat_intel 0.62)

CVE-2026-21062: Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard

Mon, 10 Aug 2026 08:16:48 +0000

Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21061: Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM

Mon, 10 Aug 2026 08:16:48 +0000

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21060: Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data

Mon, 10 Aug 2026 08:16:48 +0000

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-21058: Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file

Mon, 10 Aug 2026 08:16:47 +0000

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

CVE-2026-12570 (CVSS 5.5 MEDIUM): A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading

Mon, 10 Aug 2026 07:16:44 +0000

CVSS 5.5 MEDIUM. A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models from public repositories or malicious model registries, posing a risk to machine learning pipelines that process untrusted models.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

Blender MCP maintainer GitHub account hacked

Mon, 10 Aug 2026 00:58:29 +0000

Article URL: https://twitter.com/sidahuj/status/2086445625147793503 Comments URL: https://news.ycombinator.com/item?id=49238028 Points: 24 # Comments: 4

Source: Hacker News (attack filter)

Classification: cyber_attacks (confidence 0.42; also threat_intel 0.36)

CVE-2026-70395: Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to

Sun, 09 Aug 2026 19:17:02 +0000

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies. This issue affects ash: from 1.52.0-rc.11 before 3.31.1.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-69659: Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node

Sun, 09 Aug 2026 18:16:43 +0000

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node. This issue affects ash: from 1.17.0 before 3.31.1.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

KR: 3Pro TV Data Breach Exposes 460,000 Records, Including 2,979 Bank Accounts

Sun, 09 Aug 2026 12:58:02 +0000

Park Hyo-jung reports: More than 460,000 pieces of personal data, including bank account and credit card information, were exposed in a breach at South Korean financial media outlet 3Pro TV. E-Broadcasting, the company that operates 3Pro TV, posted a notice on the outlet’s website saying it had confirmed that “an external actor illegally accessed the... Source

Source: DataBreaches.net

Tags: Business Sector, Hack, Non-U.S.

Classification: cyber_attacks (confidence 0.95; also threat_intel 0.58)

Ransomware gangs skip the CEO, head straight for the 40-something IT manager

Sun, 09 Aug 2026 12:24:57 +0000

Carly Page reports: Turns out the fastest way to get a company to consider paying a ransom isn’t calling the CEO – it’s targeting the 46-year-old IT manager. That’s according to Zscaler, whose ThreatLabz researchers tracked 351 victims across 334 organizations caught up in a single ransomware campaign over the course of a month. The data... Source

Source: DataBreaches.net

Tags: Commentaries and Analyses, Malware

Classification: cyber_attacks (confidence 0.95; also threat_intel 0.89)

CVE-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

Sun, 09 Aug 2026 08:02:14 +0000

Information published.

Source: Microsoft Security Update Guide

Tags: CVE

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.90)

CVE-2026-17011: The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST

Sun, 09 Aug 2026 06:18:10 +0000

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

City of Suisun declares local emergency after cyberattack downs 911 dispatch system

Sat, 08 Aug 2026 23:05:28 +0000

Katie Chavez reports: Suisun City officials declared a state of emergency Saturday, Aug. 8, after a cyberattack took out the city’s emergency dispatch line and other key systems. City officials said that “malicious software infected and compromised IT systems” at about 5:45 a.m. on Friday. The cybersecurity issue forced the city to shut down its... Source

Source: DataBreaches.net

Tags: Government Sector

Classification: cyber_attacks (confidence 0.89; also threat_intel 0.51)

CVE-2026-71502: CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue

Sat, 08 Aug 2026 22:16:34 +0000

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application's configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue. Vue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application's nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception. The malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful expl

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.98)

Thomas Wolf thread on the AISI incident

Sat, 08 Aug 2026 19:13:51 +0000

Article URL: https://twitter.com/Thom_Wolf/status/2085084718320464230 Comments URL: https://news.ycombinator.com/item?id=49224910 Points: 3 # Comments: 0

Source: Hacker News (threat intel filter)

Classification: cyber_attacks (confidence 0.36; also threat_intel 0.42)

Hackers breach TrueConf to trojanize client installers with backdoors

Sat, 08 Aug 2026 14:16:23 +0000

The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.80; also vulnerabilities 0.69, threat_intel 0.68)

City of Coweta refuses to pay ransom after system-wide cyberattack

Sat, 08 Aug 2026 12:40:22 +0000

An update on the ransomware attack affecting the City of Coweta: the city manager has been through a ransomware attack before with another city, and reports that after they paid, they were reinfected weeks later, so Coweta will not be paying any ransom demands. Threat actors who don’t keep their word do spoil it for... Source

Source: DataBreaches.net

Tags: Government Sector, Malware, U.S.

Classification: cyber_attacks (confidence 0.99; also threat_intel 0.94)

Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data

Sat, 08 Aug 2026 11:30:00 +0000

The RovoBlast attack method identified by Varonis researchers could have been exploited to steal Confluence, Jira and SharePoint data. The post Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Artificial Intelligence, Vulnerabilities, AI, Atlassian, data theft, Featured, Rovo

Classification: cyber_attacks (confidence 0.83; also vulnerabilities 0.83)

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

Sat, 08 Aug 2026 08:54:50 +0000

Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor, an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was

Source: The Hacker News

Classification: cyber_attacks (confidence 0.56)

CVE-2026-48524 PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

Sat, 08 Aug 2026 08:40:45 +0000

Information published.

Source: Microsoft Security Update Guide

Tags: CVE

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.90)

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

Sat, 08 Aug 2026 08:03:57 +0000

New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. PortSwigger researcher Gareth

Source: The Hacker News

Classification: cyber_attacks (confidence 0.56)

CVE-2026-16955: The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and

Sat, 08 Aug 2026 07:17:11 +0000

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-16953: The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before

Sat, 08 Aug 2026 07:17:11 +0000

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Sat, 08 Aug 2026 06:58:31 +0000

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain

Source: The Hacker News

Classification: cyber_attacks (confidence 0.35; also vulnerabilities 0.99)

N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

Sat, 08 Aug 2026 06:57:43 +0000

N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management (RMM) product. "We are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques," the company said. "This is not a duplicate of our

Source: The Hacker News

Classification: cyber_attacks (confidence 0.62; also vulnerabilities 0.81, threat_intel 0.62)

Hacked Amazon Echo Dot 2 and can run LLMs locally

Sat, 08 Aug 2026 00:28:37 +0000

Article URL: https://www.reddit.com/r/homeassistant/s/X13006g0tS Comments URL: https://news.ycombinator.com/item?id=49217748 Points: 1 # Comments: 0

Source: Hacker News (attack filter)

Classification: cyber_attacks (confidence 0.42; also threat_intel 0.36)

CVE-2026-46409 (CVSS 9.6 CRITICAL): OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to

Fri, 07 Aug 2026 23:17:03 +0000

CVSS 9.6 CRITICAL. OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with `permission_presets.bash=true`, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, CRITICAL

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00, threat_intel 0.53)

US cloud ‘kill switch’ is as dangerous as ransomware, European businesses fear

Fri, 07 Aug 2026 23:08:16 +0000

Emma Woollacott reports: European firms are more concerned about a potential US government-imposed ‘kill switch’ for cloud services than almost anything else. In a survey of 1,500 businesses in the UK, France, and Germany, Proton found that with many having built their operations around a small number of US-based providers, they’re worried that access to those platforms could be... Source

Source: DataBreaches.net

Tags: Non-U.S.

Classification: cyber_attacks (confidence 0.92)

Inside the Modern SOC: The Identity Front Door

Fri, 07 Aug 2026 23:00:01 +0000

Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respond. The post Inside the Modern SOC: The Identity Front Door appeared first on Unit 42 .

Source: Palo Alto Unit 42

Tags: Inside the Modern SOC, Insights, AI, identity, social engineering, Unit 42 Incident Response Report

Classification: cyber_attacks (confidence 0.93; also threat_intel 0.37)

CVE-2026-59717 (CVSS 4.3 MEDIUM): Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the

Fri, 07 Aug 2026 21:17:29 +0000

CVSS 4.3 MEDIUM. Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-46358: OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth

Fri, 07 Aug 2026 21:17:28 +0000

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.68; also vulnerabilities 0.97)

CVE-2026-11425 (CVSS 4.4 MEDIUM): Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that

Fri, 07 Aug 2026 21:17:27 +0000

CVSS 4.4 MEDIUM. Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.68; also vulnerabilities 0.99)

City of Coweta hit with system-wide ransomware attack, has backup

Fri, 07 Aug 2026 20:26:50 +0000

KTUL in Oklahoma reports: The City of Coweta says they are currently responding to a ransomware attack. According to officials, on Werdnesday, August 5, the City experienced at system-wide attack and immediately contacted their contracted IT provider and additional cycbersecurity professionals to secure their systems to prevent any further intrusion and to begin a recovery... Source

Source: DataBreaches.net

Tags: Government Sector, Malware

Classification: cyber_attacks (confidence 0.98; also threat_intel 0.84)

CVE-2026-19017 (CVSS 6.8 MEDIUM): Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read

Fri, 07 Aug 2026 20:16:50 +0000

CVSS 6.8 MEDIUM. Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.68; also vulnerabilities 0.99)

Metabase SQLi zero-day exploited in customer data-theft attacks

Fri, 07 Aug 2026 20:14:46 +0000

A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. [...]

Source: BleepingComputer

Tags: Security, Software

Classification: cyber_attacks (confidence 0.80; also vulnerabilities 0.97)

Computer maker Framework notifies 'all customers' of a data breach

Fri, 07 Aug 2026 20:04:04 +0000

Article URL: https://techcrunch.com/2026/08/07/computer-maker-framework-notifies-all-customers-of-a-data-breach/ Comments URL: https://news.ycombinator.com/item?id=49215565 Points: 2 # Comments: 1

Source: Hacker News (attack filter)

Classification: cyber_attacks (confidence 0.76; also threat_intel 0.36)

Unlimited Technology Systems breach impacts 3.8 million people

Fri, 07 Aug 2026 19:30:41 +0000

Healthcare software company Unlimited Technology Systems reported that more than 3.8 million people were impacted by a data breach incident that occurred in October 2025. [...]

Source: BleepingComputer

Tags: Security, Healthcare

Classification: cyber_attacks (confidence 0.86)

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

Fri, 07 Aug 2026 18:29:08 +0000

ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host and then fetches a macOS malware payload that's compatible with the computer's CPU architecture. "

Source: The Hacker News

Classification: cyber_attacks (confidence 0.56; also threat_intel 0.35)

CVE-2026-64638: WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted

Fri, 07 Aug 2026 18:17:20 +0000

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99, threat_intel 0.53)

CVE-2026-47363 (CVSS 6.3 MEDIUM): In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts

Fri, 07 Aug 2026 18:17:16 +0000

CVSS 6.3 MEDIUM. In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-47361 (CVSS 6.4 MEDIUM): In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission

Fri, 07 Aug 2026 18:17:15 +0000

CVSS 6.4 MEDIUM. In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller's identity or ownership of the conversation. This requires a malicious application co-installed on the victim's device. Impact: A co-installed application can silently dismiss the victim's Bits AI chat notification. No chat content is exposed; conversation data remains server-authentication gated and is never returned to the caller.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-44965 (CVSS 5.5 MEDIUM): In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities

Fri, 07 Aug 2026 18:17:14 +0000

CVSS 5.5 MEDIUM. In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) are exported with no permission guard. Each accepts a caller-supplied AppWidgetManager.EXTRA_APPWIDGET_ID and, when no deep-link destination is resolved, uses it to load the matching widget's stored session and automatically log in as that user. Because Android widget IDs are small sequential integers, a co-installed application can brute-force this value to find one that matches a widget configured on the victim's device. This requires: A malicious application co-installed on the victim's device. At least one of the six widgets configured on the victim's home screen. An active Datadog session cached locally. Impact: The matching configuration activity opens in the foreground under the victim's session and renders live infrastructure data. Exposure is limited to a visual side channel (e.g., screen recording or accessibility services); the calling application cannot programmatically read the rendered d

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-44964 (CVSS 6.5 MEDIUM): In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported

Fri, 07 Aug 2026 18:17:14 +0000

CVSS 6.5 MEDIUM. In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process. This requires: A malicious application co-installed on the victim's device. An active Datadog session in the Android app. Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

Fri, 07 Aug 2026 18:16:13 +0000

A recent wave of cyber attacks targeting financial services, private equity, and professional services has been attributed to a data extortion group known as UNC6671. "UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via

Source: The Hacker News

Classification: cyber_attacks (confidence 0.90; also threat_intel 0.82)

Boston Children’s Hospital named in North Korean hacking operation

Fri, 07 Aug 2026 17:37:17 +0000

Naomi Diaz reports: Boston Children’s Hospital is among roughly a dozen organizations publicly named by security researcher Vangelis Stykas as impacted by a large-scale North Korean hacking operation, Wired reported Aug. 5. The hospital disputes that its own systems were breached, saying the issue traced to a former contractor’s personal device. Mr. Stykas, chief technology officer at... Source

Source: DataBreaches.net

Tags: Commentaries and Analyses, cyberwar, Health Data, U.S.

Classification: cyber_attacks (confidence 0.49)

CVE-2026-20348 (CVSS 7.5 HIGH): A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS

Fri, 07 Aug 2026 17:17:03 +0000

CVSS 7.5 HIGH. A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-20347 (CVSS 7.5 HIGH): A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a

Fri, 07 Aug 2026 17:17:03 +0000

CVSS 7.5 HIGH. A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-O files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted Mach-O file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-20346 (CVSS 7.5 HIGH): A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS

Fri, 07 Aug 2026 17:17:03 +0000

CVSS 7.5 HIGH. A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-20345 (CVSS 7.5 HIGH): A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS

Fri, 07 Aug 2026 17:17:03 +0000

CVSS 7.5 HIGH. A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted GPT file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-20339 (CVSS 7.5 HIGH): A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a

Fri, 07 Aug 2026 17:17:02 +0000

CVSS 7.5 HIGH. A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-20338 (CVSS 7.5 HIGH): A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS

Fri, 07 Aug 2026 17:17:02 +0000

CVSS 7.5 HIGH. A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-20337 (CVSS 7.5 HIGH): A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS

Fri, 07 Aug 2026 17:17:02 +0000

CVSS 7.5 HIGH. A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

Tell HN: Tally Data Breach

Fri, 07 Aug 2026 17:16:45 +0000

Received a notice from tally.so notifying that someone accessed their user database. I asked which “hash” they used and whether passwords were salted. I have not heard back yet. — On August 3, an attacker gained unauthorized access to Metabase, the analytics service we use to see how Tally is used. Through that they reached your email address, and your password as a cryptographic hash. A hash is one-way, so it can't be turned back into your password. They didn't reach your forms, or the answers people submitted to them. Those are stored separately. Comments URL: https://news.ycombinator.com/item?id=49213500 Points: 7 # Comments: 3

Source: Hacker News (attack filter)

Classification: cyber_attacks (confidence 0.85; also threat_intel 0.36)

Levi Strauss & Co. says hackers stole corporate data in cyberattack

Fri, 07 Aug 2026 15:48:20 +0000

Levi Strauss & Co. (Levi's) says that hackers used social engineering on three of its employees to gain access to and steal corporate data stored on their machines. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.90)

In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street

Fri, 07 Aug 2026 14:26:42 +0000

Noteworthy stories that might have slipped under the radar: ban on Chinese data center tech, QuickFox VPN supply chain attack, IEH Corporation mailbox breached via phishing. The post In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Artificial Intelligence, Malware & Threats, In Other News

Classification: cyber_attacks (confidence 0.93; also threat_intel 0.79)

Real emails, hijacked payments: Two H1 2026 attack chains

Fri, 07 Aug 2026 14:00:10 +0000

Gen's H1 2026 Threat Report examines two separate attack chains. One used compromised business inboxes and browser manipulation in a banking-malware campaign, while the other used clipboard hijacking to redirect cryptocurrency payments. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.70; also threat_intel 0.72)

AU: Hackers leak sensitive Victorian court data to dark web

Fri, 07 Aug 2026 13:39:06 +0000

Kristian Silva and Danny The personal information of Victorian court users has been posted on the dark web, sparking a police investigation. Names, emails and job titles of people who attended online hearings in regional courts were posted on an underground hacking forum in July. A user has claimed responsibility in a post. […] Court... Source

Source: DataBreaches.net

Tags: Government Sector, Hack, Non-U.S.

Classification: cyber_attacks (confidence 0.70; also threat_intel 0.73)

What Canvas learned from a massive cyberattack

Fri, 07 Aug 2026 13:39:00 +0000

Alcino Donadel reports: …. Instructure, the edtech company behind learning management system Canvas, suffered one of the largest data breaches in the U.S. this year after cybercriminals gained access through a third-party vendor—an increasingly common occurrence in higher ed. Higher education’s more meditative, governed approach to technological change is useful for reviewing rigor and long-term quality assurance, Pendleton... Source

Source: DataBreaches.net

Tags: Artificial Intelligence, Commentaries and Analyses, Education Sector, Subcontractor, U.S.

Classification: cyber_attacks (confidence 0.95; also threat_intel 0.51)

Unlimited Technology Systems Data Breach Affects 3.8 Million Patients

Fri, 07 Aug 2026 13:38:52 +0000

HIPAA Journal reports an update to the Unlimited Technology Systems breach that occurred between October 10 – 15, 2025, and was discovered on October 19, 2025: On July 23, 2026, the HIPAA Journal reported on a data breach at Unlimited Technology Systems, a Montgomery, Ohio-based provider of revenue cycle management services. At the time, the... Source

Source: DataBreaches.net

Tags: Hack, Health Data, Subcontractor, U.S.

Classification: cyber_attacks (confidence 0.92)

North Carolina Ports confirms cyberattack disrupting operations

Fri, 07 Aug 2026 13:34:40 +0000

The North Carolina Ports Authority has confirmed that a cyberattack disrupted IT systems and slowed operations at Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. [...]

Source: BleepingComputer

Tags: Security

Classification: cyber_attacks (confidence 0.80)

CVE-2026-56793 (CVSS 7.7 HIGH): Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An

Fri, 07 Aug 2026 13:16:52 +0000

CVSS 7.7 HIGH. Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

Fri, 07 Aug 2026 12:56:23 +0000

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page. Tracked as CVE-2026-64638 (CVSS score: 8.9), the high-severity

Source: The Hacker News

Classification: cyber_attacks (confidence 0.35; also vulnerabilities 0.95)

Vishing Extortion Group UNC6671 Rebrands After Making Millions

Fri, 07 Aug 2026 11:06:01 +0000

Initially calling itself BlackFile, the group has expanded operations to the Redact, Pink, Helix, and Falcon brands. The post Vishing Extortion Group UNC6671 Rebrands After Making Millions appeared first on SecurityWeek .

Source: SecurityWeek

Tags: Malware & Threats, cybercrime, UNC6671, vishing

Classification: cyber_attacks (confidence 0.79; also threat_intel 0.90)

CVE-2026-71559 (CVSS 7.5 HIGH): Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a

Fri, 07 Aug 2026 10:16:59 +0000

CVSS 7.5 HIGH. Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-54217: Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send

Fri, 07 Aug 2026 10:16:59 +0000

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-54216: Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By

Fri, 07 Aug 2026 10:16:58 +0000

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim’s browser when they click the link. This issue affects TeamDavid through Rollout 524.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.97)

CVE-2026-54212: Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer

Fri, 07 Aug 2026 10:16:58 +0000

Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, an unauthenticated attacker can cause the server to crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially lead to remote code execution and full compromise of the server. This issue affects TeamDavid through Rollout 524.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-54211: Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a buffer

Fri, 07 Aug 2026 10:16:58 +0000

Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

CVE-2026-54210: Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are

Fri, 07 Aug 2026 10:16:58 +0000

Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in a denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

Fri, 07 Aug 2026 10:09:54 +0000

PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. PortSwigger said a separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server. Kettle said HTTP Terminator tested 30,000 websites where

Source: The Hacker News

Classification: cyber_attacks (confidence 0.35; also threat_intel 0.82, vulnerabilities 0.78)

New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

Fri, 07 Aug 2026 09:32:57 +0000

Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026, the research found affected behavior across independently developed implementations, including Windows and

Source: The Hacker News

Classification: cyber_attacks (confidence 0.56)

CVE-2026-9169 (CVSS 8.8 HIGH): DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute

Fri, 07 Aug 2026 09:16:59 +0000

CVSS 8.8 HIGH. DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a required dependency is not found locally.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, HIGH

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-49008 (CVSS 6.5 MEDIUM): By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the

Fri, 07 Aug 2026 09:16:58 +0000

CVSS 6.5 MEDIUM. By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 0.99)

CVE-2026-18938 (CVSS 6.2 MEDIUM): A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit

Fri, 07 Aug 2026 09:16:58 +0000

CVSS 6.2 MEDIUM. A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.

Source: NIST NVD Recent CVEs

Tags: CVE, Vulnerability, MEDIUM

Classification: cyber_attacks (confidence 0.53; also vulnerabilities 1.00)