A vulnerability in N-able's Passportal password manager, widely used by managed service providers (MSPs) and small to medium businesses (SMBs), has exposed master keys. Even after a patch, the cloud-based design may leave residual risk, raising questions about the suitability of cloud-hosted password vaults for sensitive credentials.
Threat actors compromised the maintainer account of the widely used Rust crate arrayref on crates.io, injecting malware that executed during compilation. The malicious code functioned as an infostealer, targeting developer systems and potentially exposing credentials and sensitive data. The incident highlights the ongoing risk of supply chain attacks targeting development dependencies.
This week's cybersecurity landscape features critical vulnerabilities in widely used software platforms. A remote code execution flaw in Gogs version 10.0 stems from a weak header check, while n8n workflow automation software contains a bypass that could allow similar exploitation. Security researchers have also demonstrated AI-assisted exploit research techniques that lower the barrier to discovering new vulnerabilities. A $10,000 reward has been offered for the Gogs vulnerability, underscoring its severity. These incidents reflect a broader trend of threat actors and researchers leveraging trusted applications and AI tools to identify and exploit weaknesses more efficiently.
Suspected Russian cyber espionage clusters UNC6293, UNC7005, and UNC5976 are abusing legitimate Google OAuth and WhatsApp linking flows to hijack accounts of individuals in academia, aerospace, defense, government, and think tanks across Europe and the U.S. The campaigns are persistent and adaptive, exploiting trusted authentication mechanisms to bypass security controls.
CISA has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-20349 (Cisco Secure Firewall ASA/FTD heap inspection), CVE-2026-68820 (Microsoft Windows Ancillary Function Driver for WinSock use-after-free), and CVE-2026-72898 (Metabase SQL injection). Federal agencies are required to prioritize patching these flaws under BOD 26-04, and all organizations are urged to adopt risk-based vulnerability management.
A supply chain attack targeting the Rust ecosystem has resulted in the deletion of malicious versions of three popular crates from crates.io. Analysis indicates a compromised maintainer account was used to push updates that introduced a typosquatted dependency. The build script of this dependency downloaded and executed a remote payload during the build process, potentially compromising downstream projects. The Rust Project confirmed the removal of the affected releases, though details regarding actor attribution and the origin of the remote payload remain unverified.
CISA has issued an advisory detailing eight vulnerabilities in the Mira Hormone Monitor firmware (v1.7.1.47) and Mira Android App (v4.5.15.4). The flaws range from critical severity with CVSS scores up to 9.8, enabling remote unauthenticated attackers within BLE range to rebind devices to attacker-controlled accounts, extract cleartext health data, cause denial-of-service conditions, and inject forged hormone measurements. Users are advised to update the Mira app and firmware immediately.
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and international partners have released joint advisory AA26-222A warning of Gunra ransomware, a ransomware-as-a-service (RaaS) variant that expanded operations in 2026. Gunra employs a double-extortion model, encrypting victim data and threatening publication on a dedicated leak site. Initial access is achieved through exploitation of known vulnerabilities in internet-facing VPN gateways and Remote Desktop Protocol (RDP) infrastructure. The advisory provides detection guidance, indicators of compromise, and mitigation recommendations for affected sectors.
On August 7, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-8037, a Progress LoadMaster command injection vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation in the wild. The vulnerability affects Progress LoadMaster systems and poses significant risk to Federal Civilian Executive Branch (FCEB) agencies, particularly those with publicly exposed instances that could grant total asset control post-exploitation. CISA's Binding Operational Directive 26-04 requires affected federal agencies to prioritize rapid remediation and verify whether systems were compromised before patching.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory regarding five vulnerabilities affecting CPDLC over ATN-B1, a legacy aviation data link protocol. The flaws, tracked as CVE-2025-71409 through CVE-2025-71413, stem from the protocol's reliance on clear text, unauthenticated radio frequency links. Research shows the weaknesses allow unauthorized message injection, denial-of-service conditions, and forced session resets. While the issues do not constitute an unsafe aircraft condition, they can degrade operational safety margins by increasing pilot and controller workload, delaying safety-critical instructions, and reducing situational awareness. No known public exploitation has been reported, but the vulnerabilities are assessed as exploitable in lab environments with high attack complexity.
CERT Polska has confirmed that attackers are actively exploiting CVE-2026-73570, a command injection vulnerability in the SNMP interface of Zimbra Collaboration Suite. The flaw allows unauthenticated remote code execution with a CVSS score of 8.9. Zimbra has released patches to address the vulnerability, and immediate application is recommended to prevent system compromise.
Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks named "CDN Tsunami" that exploit how major content delivery networks convert client-facing HTTP/3 traffic into HTTP/1.1 requests to origin servers. The vulnerability in the translation mechanism allows attackers to amplify low-bandwidth request streams by up to 350x, potentially overwhelming target websites. The attacks were evaluated against Alibaba and Baidu CDNs, with implications for other major CDN providers.
Microsoft's August 2026 Patch Tuesday update includes a critical remote code execution vulnerability in the Windows DNS Server component, tracked as CVE-2026-62878 with a CVSS score of 9.8. The vulnerability requires no user interaction and could allow remote code execution on internet-facing DNS servers. The update bundle also addresses additional security flaws across Windows and related components.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems advisory regarding a vulnerability in Johnson Controls Simplex Incident Manager that stores user credentials in cleartext within system memory. Successful exploitation could allow a local attacker with low privileges to extract sensitive authentication data, potentially leading to unauthorized access to the application and connected systems. No known public exploitation has been reported at this time.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities (KEV) Catalog. CVE-2026-72529 involves missing authentication for a critical function, and CVE-2026-72530 involves code injection. Both were added based on evidence of active exploitation and pose significant risks to federal and organizational networks.
An advisory published by CISA and ABB PSIRT discloses multiple vulnerabilities in ABB Ability Zenon Industrial IoT services. The flaws involve CVE-2025-14847, a heap memory read issue in Zlib compressed protocol headers affecting all MongoDB versions prior to specified patch levels, and CVE-2020-7928, a memory read overrun affecting older MongoDB versions. Both vulnerabilities affect ABB Ability Zenon versions with MongoDB 4.2 installed and have been assigned CVSS scores up to 8.7. ABB recommends replacing the bundled MongoDB with a supported patched version or uninstalling IIoT services where not required.
Researchers have detailed a critical vulnerability in the Elementor Pro WordPress plugin tracked as CVE-2026-32475. The flaw stems from unrestricted file upload functionality within the Forms module, potentially allowing unauthenticated attackers to upload PHP files and execute arbitrary code. The vulnerability carries a CVSS score of 9.0 and affects the global WordPress ecosystem using the Elementor Pro plugin.
GitLab has addressed a critical GraphQL vulnerability tracked as CVE-2026-19478, which could allow unauthenticated attackers to remotely modify or delete public projects and associated user data. The flaw received a CVSS score of 9.4 and affects both Community Edition and Enterprise Edition. Patches were coordinatedly released on August 17, 2026.
A critical security vulnerability in the Forminator Forms WordPress plugin, tracked as CVE-2026-15748, has been disclosed with a CVSS score of 9.8. The flaw enables unauthenticated remote code execution through malicious PHP file uploads, affecting over 600,000 active installations. The vulnerability was reported by a security researcher and details are pending official patch release and exploitation confirmation.
A maximum-severity vulnerability in SAP Commerce Cloud is being actively exploited in the wild days after SAP released a security update. Tracked as CVE-2026-58231, the flaw carries a CVSS score of 10.0 and involves insufficient authorization checks and input validation that could allow unauthenticated attackers to abuse a default authentication client.
Adobe has released security updates to address multiple critical vulnerabilities impacting ColdFusion and Campaign Classic platforms. The most severe flaw, tracked as CVE-2026-48362, carries a CVSS score of 10.0 and involves an operating system command injection vulnerability. Additional privilege escalation flaws were also addressed in this release.
The U.S. Department of Justice has unsealed an indictment charging 17 Iranian nationals with orchestrating a prolonged hacking-for-hire operation on behalf of the Iranian government. The group, identified as the Mabna Institute, is alleged to have conducted spear-phishing and brute-force attacks against hundreds of American institutions, resulting in the theft of sensitive intellectual property and data. The DOJ estimates the total economic loss at $3.4 billion. Authorities have coordinated the indictment with international law enforcement efforts to disrupt the group's infrastructure.
The FBI and CISA have issued alerts regarding the Medusa ransomware gang, which has breached more than 500 critical infrastructure organizations in the United States since June 2021. The campaign has resulted in significant disruption to essential services and data exfiltration. Authorities attribute initial access to common vectors such as phishing, RDP compromise, and exploitation of known vulnerabilities. No single software patch addresses the ransomware; mitigation focuses on security best practices.
CISA and Johnson Controls have issued advisories regarding multiple critical vulnerabilities affecting C-CURE 9000 and Victor application server products. The vulnerabilities, primarily tracked as CVE-2026-21655, CVE-2026-34496, and CVE-2026-21653, involve server-side request forgery (SSRF) that could allow unauthenticated remote attackers to achieve arbitrary code execution, impact physical security controls, and facilitate lateral movement within networks. Affected versions span C-CURE 9000 up to v3.10.1, victor Application Server up to v4.10, victor up to v7.0, and victor Web up to v7.1. Johnson Controls has released vendor fixes recommending upgrades to newer versions to address the vulnerable deserialization paths.
