New research indicates that AI browsers from top vendors remain susceptible to prompt injection attacks, even with multiple security guardrails in place. The findings highlight the difficulty of securing AI-integrated browsing environments against adversarial prompts designed to override system instructions.
Security researchers have identified Cascading Style Sheets (CSS) as a potential vector for data exfiltration from webmail clients. The technique allegedly leverages CSS features to transmit sensitive information from affected platforms. Specific attack methodologies, targeted vendors, and real-world exploitation instances are not detailed in the available report. The advisory notes that some webmail vendors may not have implemented adequate defenses against CSS-based data leakage. As of the publication date, no specific CVEs, patches, or vendor statements have been publicly disclosed.
A recent analysis has identified 15 security bugs in TP-Link network devices that expose risks in automated zero-trust provisioning workflows. The findings, reported through Dark Reading, focus on inherent risks in automated network device onboarding rather than confirmed active exploitation in the wild.
Unitel, Angola's dominant mobile operator and government-owned telco, experienced a cyberattack causing widespread service outages on the day of its initial public offering. The incident occurred shortly before the company was set to go public, disrupting operations and raising concerns about the resilience of critical infrastructure during high-profile financial events.
Threat actors are conducting active RMM-fueled phishing campaigns as of August 2026, using diverse social engineering lures and rotating payloads to deliver ScreenConnect and establish persistent remote access to compromised networks. The campaign targets global victims via email and web lures, with reported potential for data exfiltration, lateral movement, and ransomware deployment. Specific threat actor attribution and victim counts remain unverified.
CISA has published an advisory (ICSMA-26-218-01) detailing CVE-2026-17264, a heap out-of-bounds write vulnerability in Medixant RadiAnt DICOM versions 2025.2 and earlier. Successful exploitation requires a user to open a maliciously crafted DICOM file containing JPEG-compressed pixel data, potentially leading to application crash or remote code execution. The vendor has released version 2026.1 to address the issue. No public exploitation has been reported.
A vulnerability in N-able's Passportal password manager, widely used by managed service providers (MSPs) and small to medium businesses (SMBs), has exposed master keys. Even after a patch, the cloud-based design may leave residual risk, raising questions about the suitability of cloud-hosted password vaults for sensitive credentials.
Threat actors compromised the maintainer account of the widely used Rust crate arrayref on crates.io, injecting malware that executed during compilation. The malicious code functioned as an infostealer, targeting developer systems and potentially exposing credentials and sensitive data. The incident highlights the ongoing risk of supply chain attacks targeting development dependencies.
This week's cybersecurity landscape features critical vulnerabilities in widely used software platforms. A remote code execution flaw in Gogs version 10.0 stems from a weak header check, while n8n workflow automation software contains a bypass that could allow similar exploitation. Security researchers have also demonstrated AI-assisted exploit research techniques that lower the barrier to discovering new vulnerabilities. A $10,000 reward has been offered for the Gogs vulnerability, underscoring its severity. These incidents reflect a broader trend of threat actors and researchers leveraging trusted applications and AI tools to identify and exploit weaknesses more efficiently.
Suspected Russian cyber espionage clusters UNC6293, UNC7005, and UNC5976 are abusing legitimate Google OAuth and WhatsApp linking flows to hijack accounts of individuals in academia, aerospace, defense, government, and think tanks across Europe and the U.S. The campaigns are persistent and adaptive, exploiting trusted authentication mechanisms to bypass security controls.
CISA has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-20349 (Cisco Secure Firewall ASA/FTD heap inspection), CVE-2026-68820 (Microsoft Windows Ancillary Function Driver for WinSock use-after-free), and CVE-2026-72898 (Metabase SQL injection). Federal agencies are required to prioritize patching these flaws under BOD 26-04, and all organizations are urged to adopt risk-based vulnerability management.
A supply chain attack targeting the Rust ecosystem has resulted in the deletion of malicious versions of three popular crates from crates.io. Analysis indicates a compromised maintainer account was used to push updates that introduced a typosquatted dependency. The build script of this dependency downloaded and executed a remote payload during the build process, potentially compromising downstream projects. The Rust Project confirmed the removal of the affected releases, though details regarding actor attribution and the origin of the remote payload remain unverified.
CISA has issued an advisory detailing eight vulnerabilities in the Mira Hormone Monitor firmware (v1.7.1.47) and Mira Android App (v4.5.15.4). The flaws range from critical severity with CVSS scores up to 9.8, enabling remote unauthenticated attackers within BLE range to rebind devices to attacker-controlled accounts, extract cleartext health data, cause denial-of-service conditions, and inject forged hormone measurements. Users are advised to update the Mira app and firmware immediately.
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and international partners have released joint advisory AA26-222A warning of Gunra ransomware, a ransomware-as-a-service (RaaS) variant that expanded operations in 2026. Gunra employs a double-extortion model, encrypting victim data and threatening publication on a dedicated leak site. Initial access is achieved through exploitation of known vulnerabilities in internet-facing VPN gateways and Remote Desktop Protocol (RDP) infrastructure. The advisory provides detection guidance, indicators of compromise, and mitigation recommendations for affected sectors.
On August 7, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-8037, a Progress LoadMaster command injection vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation in the wild. The vulnerability affects Progress LoadMaster systems and poses significant risk to Federal Civilian Executive Branch (FCEB) agencies, particularly those with publicly exposed instances that could grant total asset control post-exploitation. CISA's Binding Operational Directive 26-04 requires affected federal agencies to prioritize rapid remediation and verify whether systems were compromised before patching.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory regarding five vulnerabilities affecting CPDLC over ATN-B1, a legacy aviation data link protocol. The flaws, tracked as CVE-2025-71409 through CVE-2025-71413, stem from the protocol's reliance on clear text, unauthenticated radio frequency links. Research shows the weaknesses allow unauthorized message injection, denial-of-service conditions, and forced session resets. While the issues do not constitute an unsafe aircraft condition, they can degrade operational safety margins by increasing pilot and controller workload, delaying safety-critical instructions, and reducing situational awareness. No known public exploitation has been reported, but the vulnerabilities are assessed as exploitable in lab environments with high attack complexity.
CERT Polska has confirmed that attackers are actively exploiting CVE-2026-73570, a command injection vulnerability in the SNMP interface of Zimbra Collaboration Suite. The flaw allows unauthenticated remote code execution with a CVSS score of 8.9. Zimbra has released patches to address the vulnerability, and immediate application is recommended to prevent system compromise.
Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks named "CDN Tsunami" that exploit how major content delivery networks convert client-facing HTTP/3 traffic into HTTP/1.1 requests to origin servers. The vulnerability in the translation mechanism allows attackers to amplify low-bandwidth request streams by up to 350x, potentially overwhelming target websites. The attacks were evaluated against Alibaba and Baidu CDNs, with implications for other major CDN providers.
Microsoft's August 2026 Patch Tuesday update includes a critical remote code execution vulnerability in the Windows DNS Server component, tracked as CVE-2026-62878 with a CVSS score of 9.8. The vulnerability requires no user interaction and could allow remote code execution on internet-facing DNS servers. The update bundle also addresses additional security flaws across Windows and related components.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems advisory regarding a vulnerability in Johnson Controls Simplex Incident Manager that stores user credentials in cleartext within system memory. Successful exploitation could allow a local attacker with low privileges to extract sensitive authentication data, potentially leading to unauthorized access to the application and connected systems. No known public exploitation has been reported at this time.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities (KEV) Catalog. CVE-2026-72529 involves missing authentication for a critical function, and CVE-2026-72530 involves code injection. Both were added based on evidence of active exploitation and pose significant risks to federal and organizational networks.
An advisory published by CISA and ABB PSIRT discloses multiple vulnerabilities in ABB Ability Zenon Industrial IoT services. The flaws involve CVE-2025-14847, a heap memory read issue in Zlib compressed protocol headers affecting all MongoDB versions prior to specified patch levels, and CVE-2020-7928, a memory read overrun affecting older MongoDB versions. Both vulnerabilities affect ABB Ability Zenon versions with MongoDB 4.2 installed and have been assigned CVSS scores up to 8.7. ABB recommends replacing the bundled MongoDB with a supported patched version or uninstalling IIoT services where not required.
Researchers have detailed a critical vulnerability in the Elementor Pro WordPress plugin tracked as CVE-2026-32475. The flaw stems from unrestricted file upload functionality within the Forms module, potentially allowing unauthenticated attackers to upload PHP files and execute arbitrary code. The vulnerability carries a CVSS score of 9.0 and affects the global WordPress ecosystem using the Elementor Pro plugin.
GitLab has addressed a critical GraphQL vulnerability tracked as CVE-2026-19478, which could allow unauthenticated attackers to remotely modify or delete public projects and associated user data. The flaw received a CVSS score of 9.4 and affects both Community Edition and Enterprise Edition. Patches were coordinatedly released on August 17, 2026.
_Ivelin_Radkov_Alamy.png?width=720&quality=80&disable=upscale)
