Latest Cybersecurity News, page 40

DDark readinginRansomware·Aug 22high

Ransomware Attack Disrupts Colombian Justice Ministry Ahead of Presidential Transition

A ransomware attack has been reported against Colombia's Ministry of Justice, occurring days before a scheduled presidential transition. The incident adds to a pattern of increased ransomware activity targeting critical infrastructure and government-linked organizations across Latin America. Details regarding the ransomware variant, specific systems affected, and data exfiltration remain limited and unconfirmed.

11m

DDark readinginRansomware·Aug 22high

Gunra Ransomware Gang Exploits Fortinet Vulnerabilities, Bypasses MFA

The Gunra ransomware-as-a-service operation has been observed exploiting vulnerabilities in Fortinet firewall and VPN appliances to bypass multi-factor authentication and target critical infrastructure organizations. The attacks leverage leaked Conti ransomware code and known older flaws in Fortinet products, with reported successes against global critical infrastructure targets.

11m

DDark readinginCyber Attacks·Aug 22high

Multistate Water System Attacks Widen, Iran Suspected

Reports indicate that cyber attacks targeting ill-secured, Internet-exposed Programmable Logic Controllers (PLCs) at water systems are expanding across a dozen US states. Iranian threat actors are suspected, though attribution remains provisional. The intrusions exploit default credentials, known vulnerabilities, or misconfigurations in OT/ICS environments, raising concerns about potential disruption to water supply and treatment operations.

11m

DDark readinginZero-Day·Aug 22critical

Metabase Zero-Day Vulnerability Enables Remote Administrator Compromise

A maximum-severity vulnerability in the Metabase business-analytics platform has been identified as actively exploited in the wild. The flaw allows remote, unauthenticated administrator access to Metabase instances, potentially compromising downstream data pipelines and users. No CVE has been assigned, and no official patch is currently available.

11m

DDark readinginApplication Security·Aug 22high

AI Browser Prompt Injection Flaws Remain Unresolved Despite Guardrails

New research indicates that AI browsers from top vendors remain susceptible to prompt injection attacks, even with multiple security guardrails in place. The findings highlight the difficulty of securing AI-integrated browsing environments against adversarial prompts designed to override system instructions.

11m

DDark readinginweb-security·Aug 22medium

CSS Exfiltration Vector Poses New Risk to Webmail Security

Security researchers have identified Cascading Style Sheets (CSS) as a potential vector for data exfiltration from webmail clients. The technique allegedly leverages CSS features to transmit sensitive information from affected platforms. Specific attack methodologies, targeted vendors, and real-world exploitation instances are not detailed in the available report. The advisory notes that some webmail vendors may not have implemented adequate defenses against CSS-based data leakage. As of the publication date, no specific CVEs, patches, or vendor statements have been publicly disclosed.

11m

DDark readinginvulnerability·Aug 22medium

15 Security Bugs Identified in TP-Link Network Devices Raise Zero-Trust Provisioning Concerns

A recent analysis has identified 15 security bugs in TP-Link network devices that expose risks in automated zero-trust provisioning workflows. The findings, reported through Dark Reading, focus on inherent risks in automated network device onboarding rather than confirmed active exploitation in the wild.

11m

DDark readinginCyber Attacks·Aug 22high

Unitel, Angola's Largest Telco, Suffers Cyberattack Hours Before IPO

Unitel, Angola's dominant mobile operator and government-owned telco, experienced a cyberattack causing widespread service outages on the day of its initial public offering. The incident occurred shortly before the company was set to go public, disrupting operations and raising concerns about the resilience of critical infrastructure during high-profile financial events.

11m

DDark readinginCyber Attacks·Aug 22high

Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook

Threat actors are conducting active RMM-fueled phishing campaigns as of August 2026, using diverse social engineering lures and rotating payloads to deliver ScreenConnect and establish persistent remote access to compromised networks. The campaign targets global victims via email and web lures, with reported potential for data exfiltration, lateral movement, and ransomware deployment. Specific threat actor attribution and victim counts remain unverified.

11m

CCISA AdvisoriesinVulnerability Advisory·Aug 22medium

CISA Warns of Heap Out-of-Bounds Write Vulnerability in Medixant RadiAnt DICOM Viewer

CISA has published an advisory (ICSMA-26-218-01) detailing CVE-2026-17264, a heap out-of-bounds write vulnerability in Medixant RadiAnt DICOM versions 2025.2 and earlier. Successful exploitation requires a user to open a maliciously crafted DICOM file containing JPEG-compressed pixel data, potentially leading to application crash or remote code execution. The vendor has released version 2026.1 to address the issue. No public exploitation has been reported.

12m

DDark readinginVulnerability·Aug 22high

N-able Passportal Vulnerability Raises Concerns Over Cloud-Based Password Vault Security

A vulnerability in N-able's Passportal password manager, widely used by managed service providers (MSPs) and small to medium businesses (SMBs), has exposed master keys. Even after a patch, the cloud-based design may leave residual risk, raising questions about the suitability of cloud-hosted password vaults for sensitive credentials.

13m

BBleepingComputerinMalware·Aug 22high

Hackers Compromise arrayref Rust Crate to Distribute Infostealer Malware

Threat actors compromised the maintainer account of the widely used Rust crate arrayref on crates.io, injecting malware that executed during compilation. The malicious code functioned as an infostealer, targeting developer systems and potentially exposing credentials and sensitive data. The incident highlights the ongoing risk of supply chain attacks targeting development dependencies.

11m

TThe Hacker Newsinvulnerability·Aug 22critical

Multiple Critical Vulnerabilities Discovered in Gogs and n8n; AI-Assisted Exploit Research Raises Concerns

This week's cybersecurity landscape features critical vulnerabilities in widely used software platforms. A remote code execution flaw in Gogs version 10.0 stems from a weak header check, while n8n workflow automation software contains a bypass that could allow similar exploitation. Security researchers have also demonstrated AI-assisted exploit research techniques that lower the barrier to discovering new vulnerabilities. A $10,000 reward has been offered for the Gogs vulnerability, underscoring its severity. These incidents reflect a broader trend of threat actors and researchers leveraging trusted applications and AI tools to identify and exploit weaknesses more efficiently.

12m

TThe Hacker NewsinCyber Attacks·Aug 22high

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Suspected Russian cyber espionage clusters UNC6293, UNC7005, and UNC5976 are abusing legitimate Google OAuth and WhatsApp linking flows to hijack accounts of individuals in academia, aerospace, defense, government, and think tanks across Europe and the U.S. The campaigns are persistent and adaptive, exploiting trusted authentication mechanisms to bypass security controls.

12m

CCISA AdvisoriesinCVE·Aug 22high

CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog

CISA has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-20349 (Cisco Secure Firewall ASA/FTD heap inspection), CVE-2026-68820 (Microsoft Windows Ancillary Function Driver for WinSock use-after-free), and CVE-2026-72898 (Metabase SQL injection). Federal agencies are required to prioritize patching these flaws under BOD 26-04, and all organizations are urged to adopt risk-based vulnerability management.

12m

TThe Hacker NewsinMalware·Aug 21high

Rust Supply Chain Attack Distributes Build-Time Malware via Compromised Crates.io Accounts

A supply chain attack targeting the Rust ecosystem has resulted in the deletion of malicious versions of three popular crates from crates.io. Analysis indicates a compromised maintainer account was used to push updates that introduced a typosquatted dependency. The build script of this dependency downloaded and executed a remote payload during the build process, potentially compromising downstream projects. The Rust Project confirmed the removal of the affected releases, though details regarding actor attribution and the origin of the remote payload remain unverified.

31m

CCISA AdvisoriesinCVE·Aug 21critical

Multiple Critical Vulnerabilities Discovered in Mira Hormone Monitor and Android App

CISA has issued an advisory detailing eight vulnerabilities in the Mira Hormone Monitor firmware (v1.7.1.47) and Mira Android App (v4.5.15.4). The flaws range from critical severity with CVSS scores up to 9.8, enabling remote unauthenticated attackers within BLE range to rebind devices to attacker-controlled accounts, extract cleartext health data, cause denial-of-service conditions, and inject forged hormone measurements. Users are advised to update the Mira app and firmware immediately.

22m

CCISA AdvisoriesinRansomware·Aug 21high

CISA Issues Advisory on Gunra Ransomware RaaS Threat

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and international partners have released joint advisory AA26-222A warning of Gunra ransomware, a ransomware-as-a-service (RaaS) variant that expanded operations in 2026. Gunra employs a double-extortion model, encrypting victim data and threatening publication on a dedicated leak site. Initial access is achieved through exploitation of known vulnerabilities in internet-facing VPN gateways and Remote Desktop Protocol (RDP) infrastructure. The advisory provides detection guidance, indicators of compromise, and mitigation recommendations for affected sectors.

12m

CCISA AdvisoriesinCVE·Aug 21high

CISA Adds CVE-2026-8037 Progress LoadMaster Command Injection to Known Exploited Vulnerabilities Catalog

On August 7, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-8037, a Progress LoadMaster command injection vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation in the wild. The vulnerability affects Progress LoadMaster systems and poses significant risk to Federal Civilian Executive Branch (FCEB) agencies, particularly those with publicly exposed instances that could grant total asset control post-exploitation. CISA's Binding Operational Directive 26-04 requires affected federal agencies to prioritize rapid remediation and verify whether systems were compromised before patching.

12m

CCISA AdvisoriesinVulnerability·Aug 21high

CISA Issues Advisory on Five CPDLC over ATN-B1 Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory regarding five vulnerabilities affecting CPDLC over ATN-B1, a legacy aviation data link protocol. The flaws, tracked as CVE-2025-71409 through CVE-2025-71413, stem from the protocol's reliance on clear text, unauthenticated radio frequency links. Research shows the weaknesses allow unauthorized message injection, denial-of-service conditions, and forced session resets. While the issues do not constitute an unsafe aircraft condition, they can degrade operational safety margins by increasing pilot and controller workload, delaying safety-critical instructions, and reducing situational awareness. No known public exploitation has been reported, but the vulnerabilities are assessed as exploitable in lab environments with high attack complexity.

12m

TThe Hacker NewsinCyber Attacks·Aug 21high

Active Exploitation of Zimbra Collaboration SNMP Vulnerability CVE-2026-73570

CERT Polska has confirmed that attackers are actively exploiting CVE-2026-73570, a command injection vulnerability in the SNMP interface of Zimbra Collaboration Suite. The flaw allows unauthenticated remote code execution with a CVSS score of 8.9. Zimbra has released patches to address the vulnerability, and immediate application is recommended to prevent system compromise.

11m

TThe Hacker NewsinCyber Attacks·Aug 21high

CDN Tsunami Attack Exploits HTTP/3 Translation for Up to 350x DoS Amplification

Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks named "CDN Tsunami" that exploit how major content delivery networks convert client-facing HTTP/3 traffic into HTTP/1.1 requests to origin servers. The vulnerability in the translation mechanism allows attackers to amplify low-bandwidth request streams by up to 350x, potentially overwhelming target websites. The attacks were evaluated against Alibaba and Baidu CDNs, with implications for other major CDN providers.

11m

DDark readinginCVE·Aug 21critical

Critical Windows DNS Server Vulnerability Headline August 2026 Patch Tuesday

Microsoft's August 2026 Patch Tuesday update includes a critical remote code execution vulnerability in the Windows DNS Server component, tracked as CVE-2026-62878 with a CVSS score of 9.8. The vulnerability requires no user interaction and could allow remote code execution on internet-facing DNS servers. The update bundle also addresses additional security flaws across Windows and related components.

11m

CCISA AdvisoriesinVulnerability·Aug 21medium

CISA Warns of Credential Exposure in Johnson Controls Simplex Incident Manager

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems advisory regarding a vulnerability in Johnson Controls Simplex Incident Manager that stores user credentials in cleartext within system memory. Successful exploitation could allow a local attacker with low privileges to extract sensitive authentication data, potentially leading to unauthorized access to the application and connected systems. No known public exploitation has been reported at this time.

11m