The trailing 48 hours were dominated by PaperCut’s scramble to contain an actively exploited pre-auth RCE chain, a maximum-severity object-injection bug in a WordPress donation plugin with six-figure install counts, and two large data-theft disclosures. Every item below was checked against the vendor advisory, researcher write-up, or regulatory filing that originated it.

PaperCut ships a second emergency patch after researchers bypass the first one

PaperCut · August 28, 2026

PaperCut assigned CVE identifiers to the zero-day chain it disclosed on August 27 and shipped Emergency Patch Release 2 for PaperCut NG and MF versions 24, 25, and 26 across Windows, Linux, and macOS. CVE-2026-81578 is an authentication bypass in the NG/MF web management interface rated 8.8, and CVE-2026-82078 is a critical unsafe dynamic class-loading flaw in the database connection utilities rated 9.4; chained, they give an unauthenticated attacker remote code execution. The second release followed after watchTowr reproduced the bugs and found multiple bypasses of the original patch, and Huntress independently found bypasses plus an additional authentication bypass while observing exploitation in two customer environments. PaperCut is urging every customer to install Release 2 even if the first patch is already applied, and to restrict web interface access to trusted IP ranges; version 23 and earlier get no patch and should be upgraded.

“Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks.” — PaperCut security bulletin

Source: PaperCut security bulletin · BleepingComputer

GiveWP WordPress donation plugin patches a CVSS 10.0 object-injection-to-RCE chain

Patchstack · August 28, 2026

Patchstack published its write-up of CVE-2026-82222, a deserialization-of-untrusted-data flaw in the GiveWP donation plugin rated CVSS 10.0 and affecting all versions through 4.16.7.1. The plugin has more than 100,000 active installs. Exploitation chains three issues: an unsafe unserialize helper, a donation flow that stores attacker-controlled serialized objects, and a gadget chain in bundled libraries that reaches arbitrary system commands. The account requirement is not a barrier, because the plugin exposes a registration endpoint that ignores whether WordPress registration is disabled. GiveWP fixed it in 4.16.7.2, released August 27, which also strips serialized payloads already written to affected databases. No in-the-wild exploitation has been reported; the bug was reported by researcher Udin Chan on July 28.

“Even on a site that has registration disabled, the attacker can create an account and receive an authentication cookie, then carry out the rest of the attack in the same sequence.” — Patchstack

Source: Patchstack advisory · BleepingComputer

McKesson confirms an intrusion in an SEC filing as ShinyHunters claims 284 million patient records

McKesson (SEC Form 8-K) · August 28, 2026

Pharmaceutical distributor McKesson disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, filing a Form 8-K after the extortion group ShinyHunters claimed to hold 284 million patient records. McKesson says it discovered the incident on August 25 and that its investigation is in the early stages, so the attacker’s record count is unverified. Reporting on the claimed data set describes identity and contact fields including Social Security numbers, healthcare identifiers such as patient IDs and Medicaid numbers, and clinical detail including diagnoses, medications, and appointment notes. The group’s described access path — vishing against employee Okta single sign-on accounts, then Salesforce and Snowflake environments — matches ShinyHunters’ pattern across 2026 but has not been confirmed by McKesson.

Source: BleepingComputer · DataBreaches.net

Manchester Airports Group says attackers stole data on 8.7 million travelers and refuses a ransom

Manchester Airports Group · August 28, 2026

MAG disclosed that intruders took customer data tied to car park, lounge, and Fast Track bookings and to in-airport Wi-Fi sign-ups at Manchester, Stansted, and East Midlands airports, affecting roughly 8.7 million people. The exposed fields are email addresses, phone numbers, vehicle registrations, and postcodes; MAG states that neither the group nor the affected system holds bank or payment card data. The company says it restricted access to the affected systems, brought in external responders, and notified law enforcement, and it temporarily suspended its online “Manage My Booking” service. MAG confirmed a ransom was demanded and declined to pay.

Source: Help Net Security · BleepingComputer

Still developing

Citrix NetScaler CVE-2026-8452 — federal remediation deadline landed August 29. CISA added the NetScaler ADC and Gateway memory-buffer flaw to the KEV catalog on August 26 with a three-day fix deadline for federal civilian agencies. Citrix originally patched the bug on June 30 as a denial-of-service issue; researchers later showed it yields unauthenticated remote code execution, and webshells and discovery activity have been seen on compromised appliances. Source: CISA · The Hacker News

Three more KEV additions carry an August 30 deadline. On August 27 CISA added CVE-2023-49105 (ownCloud improper authentication, versions 10.6.0 through 10.13.0), CVE-2026-53362 (Linux kernel), and CVE-2026-66384 (JFrog Artifactory path traversal). The ownCloud and kernel entries are due August 30; the Artifactory entry is due September 10. Source: CISA · Security Affairs

ServiceNow patched three CVSS 10.0 flaws. The August 27 advisory covers CVE-2026-18885 (code injection in the Now Platform), CVE-2026-18886 (code injection in the ServiceNow AI Platform enabling privilege escalation), CVE-2026-74820 (SQL injection in the AI Platform), and CVE-2026-6876 (sandbox escape). Three are rated 10.0 and reachable by an unauthenticated attacker under certain conditions; self-hosted customers need to patch or upgrade. Source: ServiceNow · The Hacker News

This brief covers the trailing ~48 hours (August 28–29, 2026).

Primary sources:

• PaperCut — URGENT Security Advisory: PaperCut NG/MF Security Bulletin
• Huntress — PaperCut actively exploited
• Patchstack — Unauthenticated PHP Object Injection to RCE on GiveWP
• CISA — Adds Six Known Exploited Vulnerabilities to Catalog (Aug 26)
• CISA — Adds Three Known Exploited Vulnerabilities to Catalog (Aug 27)
• CISA — Known Exploited Vulnerabilities Catalog
• ServiceNow — Security advisory KB3137947

The trailing ~48 hours (August 13–15, 2026) were defined by exploitation catching up to recent patches rather than by fresh disclosures. Every item below was confirmed against a primary source — a vendor advisory, a national CERT bulletin, original incident-response research, or a company’s own breach notice — and dated on that source’s page.

Max-severity SAP Commerce Cloud RCE exploited three days after patch day

SAP · August 14, 2026

CVE-2026-58231, an improper-authorization flaw in the Data Hub Adapter extension of SAP Commerce Cloud, is being probed in the wild three days after SAP shipped a fix. SAP scored it CVSS 10.0 as CNA (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-94); NVD has not yet issued its own assessment. Affected products are COM_CLOUD 2211 and 2211-JDK21, patched via SAP Note 3771065 on the August 11 Security Patch Day. Threat intelligence firm Defused reported the first exploitation attempts against its honeypots on August 14. The CVE is not in the CISA KEV catalog, and Defused states no public proof-of-concept exists.

“First exploitation attempts against CVE-2026-58231 (unauth RCE in SAP Commerce Cloud, CVSS 10.0) is now hitting our honeypots – 3 days after patch day. This vulnerability has no public PoC and is not known to be exploited.” — Defused

Source: SAP Note 3771065 · NVD · BleepingComputer

vCenter exploitation campaign attributed to a Chinese-speaking actor, with ESXi ransomware in the chain

QUIRSO · August 14, 2026

German DFIR firm QUIRSO published a follow-up to its earlier survey of CVE-2026-59310, the CVSS 9.8 directory-traversal-to-RCE flaw in the vCenter Syslog Server that Broadcom disclosed in VMSA-2026-0006 on July 29 and revised on August 3. The new report adds a full incident-response case study: unauthenticated RCE, cron-based execution, an open-source reverse_ssh implant for C2, rogue adminuser accounts created on every ESXi host, and a Babuk-derived ESXi ransomware payload that also encrypted ESXi logs. QUIRSO counts 361 victim IPs across 47 countries, with first callbacks on August 3 — five days after disclosure. It also reports possible exploitation of the related CVE-2026-59309, a CVSS 9.8 authentication bypass in VMware Directory Service, beginning August 1. Fixed builds are vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k or 8.0 U2f; Broadcom lists no workarounds. Neither CVE is in KEV.

“QUIRSO assesses with moderate confidence that the exploitation campaign targeting CVE-2026–59310 is operated by a Chinese-speaking threat actor, probably working in a UTC+8 environment.” — QUIRSO GmbH

Source: Broadcom VMSA-2026-0006 · QUIRSO · BleepingComputer

macOS Screen Sharing authentication bypass abused to drop Monero miners

NCSC-NL · August 12, 2026

The Netherlands’ National Cyber Security Centre updated advisory NCSC-2026-0280 to report in-the-wild abuse of CVE-2026-65400, an authentication bypass in macOS Screen Sharing that lets a network attacker authenticate over VNC (TCP 5900) without valid credentials. Apple patched it on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, describing it as “an authentication issue… addressed with improved state management” and crediting Alfredo Pesoli (@__rev) via Bynario Atlas. Apple assigns no CVSS and NVD has not scored it; the only published score is CISA-ADP’s 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), which NCSC-NL matches. Some outlets have circulated a 9.8 figure that no primary source supports. Exploit code is public, root was obtained on every affected host observed, and the CVE is not in KEV. Where patching is not immediate, disabling Screen Sharing under General → Sharing removes exposure.

“The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet.” — NCSC-NL, advisory NCSC-2026-0280

Source: Apple HT148170 · NCSC-NL NCSC-2026-0280 · BleepingComputer

Trezor customer data exposed through a two-hop supply chain rooted in the Metabase zero-day

Trezor · August 13, 2026

Hardware wallet maker Trezor disclosed that 13,689 customers had data exposed after its fulfilment provider ShipMonk was breached. ShipMonk attributes its own compromise to exploitation of Metabase, the analytics platform hit by CVE-2026-72898 — a CVSS 10.0 SQL injection zero-day granting unauthenticated admin access, which CISA added to the KEV catalog on August 11. The chain therefore runs Metabase → ShipMonk → Trezor. Trezor says its own systems were not touched and that private keys, wallet backups, recovery seeds, and customer funds are unaffected. ShipMonk notified Trezor on August 10; Trezor disclosed publicly three days later.

“The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email).” — Trezor

Source: Trezor · CISA KEV alert · BleepingComputer

Have I Been Pwned puts a number on the RingCentral extortion leak: 1.6 million accounts

Have I Been Pwned · August 13, 2026

Have I Been Pwned indexed the RingCentral breach, deriving 1.6 million unique email addresses from the archive ShinyHunters published after the company declined to pay. Exposed fields are email addresses, names, phone numbers, and physical addresses; HIBP records no passwords. The figure comes from attacker-leaked data, not from RingCentral, which has published no count. RingCentral’s own security bulletin of July 28 attributes the intrusion to a social engineering campaign against its systems, states that the core platform was not impacted, and has not confirmed how access was obtained or attributed the incident to any group.

“In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters ‘pay or leak’ extortion campaign.” — Have I Been Pwned

Source: Have I Been Pwned · RingCentral security bulletin · BleepingComputer

Still developing

Windows privilege escalation from a researcher on a disclosure campaign — Microsoft · August 11–12, 2026. Microsoft’s August Patch Tuesday closed “LegacyHive,” CVE-2026-62832, a CVSS 7.8 link-following flaw (CWE-59) in the Windows User Profile Service that a researcher using the handle Nightmare Eclipse had published a proof-of-concept for hours after July’s Patch Tuesday. CISA’s SSVC record lists exploitation as none and the CVE is not in KEV. The same researcher then released “ShieldBreak,” claimed as a bypass of Microsoft’s earlier RoguePlanet fix for a Microsoft Defender race condition tracked as CVE-2026-50656, said to yield SYSTEM on fully patched Windows 11 and Server 2025. The bypass claim is the researcher’s and has not been confirmed by Microsoft.
Source: MSRC · BleepingComputer · SecurityWeek

Lazarus exploited the WinSock driver zero-day against defence firms — Check Point · August 12, 2026. Check Point Research tied CVE-2026-68820, the use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) that Microsoft patched on August 11 as actively exploited, to a new Operation Dream Job wave running since early July. The chain delivered an updated FudModule kernel rootkit alongside a backdoor tracked as Troy. Microsoft scored the flaw 7.0 as CNA, and CISA added it to KEV on August 11 with a remediation deadline of August 25.
Source: MSRC · Check Point Research · BleepingComputer

This brief covers the trailing ~48 hours (August 13–15, 2026).

Primary sources:

• SAP Security Note 3771065 — CVE-2026-58231
• NVD — CVE-2026-58231
• Broadcom VMSA-2026-0006 — CVE-2026-59309, CVE-2026-59310
• QUIRSO — Global Exploitation of CVE-2026-59310
• Apple — macOS Tahoe 26.6.1 security content
• NCSC-NL — NCSC-2026-0280
• Trezor — customer data exposed in shipping provider incident
• CISA — KEV additions, August 11, 2026
• Have I Been Pwned — RingCentral
• RingCentral — security bulletin
• MSRC — CVE-2026-62832
• MSRC — CVE-2026-68820
• Check Point Research — Shattering the Dream

This brief covers the trailing ~48 hours (August 9–11, 2026). Every item below was verified against its primary source — vendor advisory, CISA publication, or the original research — and dated from that source.

Microsoft’s August Patch Tuesday fixes ~400 flaws, including an actively exploited Windows zero-day

Microsoft MSRC · August 11, 2026

Microsoft’s August 2026 Patch Tuesday addresses roughly 400 vulnerabilities (counts across trackers range from 394 to 421), including 42 rated Critical. One flaw is under active exploitation: CVE-2026-68820, a use-after-free in the Ancillary Function Driver for WinSock (afd.sys) that attackers are using to elevate privileges to SYSTEM. A second zero-day, CVE-2026-72971 in the Windows Container Isolation FS Filter Driver (unionfs.sys), was publicly disclosed before patching but is assessed as less likely to be exploited. Patch the afd.sys bug first — WinSock EoP flaws are a recurring favorite for ransomware operators post-compromise.

Source: Microsoft MSRC update guide (CVE-2026-68820) · BleepingComputer · SecurityWeek

CISA, FBI, NSA and South Korean police publish joint #StopRansomware advisory on Gunra

CISA (AA26-222A) · August 10, 2026

A joint advisory from CISA, the FBI, NSA, the DoD Cyber Crime Center, the U.S. Secret Service, and South Korea’s National Police Agency details the Gunra ransomware-as-a-service operation, a Conti-derived variant that emerged in 2025 and expanded to RaaS in 2026, targeting government, healthcare, and critical infrastructure. Key mitigations: patch known exploited vulnerabilities on internet-facing systems (especially VPN gateways and exposed RDP), maintain offline immutable backups, and segment networks. The advisory ships with STIX-format indicators of compromise.

“The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid.” — CISA advisory AA26-222A

Source: CISA AA26-222A · Joint advisory PDF

Microsoft: Storm-1175 deploys new StormEncryptor ransomware, likely via N-able N-central flaw

Microsoft Threat Intelligence · August 10, 2026

Microsoft Threat Intelligence reports that Storm-1175, a China-based former Medusa ransomware affiliate, is deploying a previously unseen C++ ransomware family dubbed StormEncryptor (files renamed .encrypted, ransom note !!!README_FIRST!!!.txt, three-day deadline). Intrusions were likely preceded by exploitation of CVE-2026-18577 (CVSS 8.2), the N-able N-central authentication bypass added to CISA’s KEV catalog on August 3; post-compromise tooling includes AnyDesk/SimpleHelp, Advanced IP Scanner, and Mimikatz LSASS dumping. N-able has patched the flaw (builds 2026.3.1.7 and later, with Hotfix 2 superseding the original fix) and published IoCs for self-hosted servers.

“This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days.” — Microsoft Threat Intelligence

Source: Microsoft Threat Intelligence · N-able security update · BleepingComputer

Kimsuky built a self-hosted LLM lab on its own attack servers, Genians finds

Genians Security Center · August 10, 2026

South Korean security firm Genians published research on North Korea’s Kimsuky group (“Operation GitPower”) documenting what it describes as the first observed case of a state-sponsored APT running self-hosted large language model environments — Ollama, GPT4All, and Msty with retrieval-augmented generation — directly on its attack infrastructure. The offline setup lets the group analyze stolen documents, generate decoy files, and assist malware development without sending data to cloud AI services that might detect or log the activity. The campaign uses AI-generated lure documents and GitHub/GitLab-based C2 to deliver payloads including a modified AsyncRAT.

“The evidence identified to date remains focused on the use and integration of existing AI technologies rather than independent model training. It is therefore necessary to continue monitoring changes in the scope of AI use and the evolution of related attack techniques.” — Genians Security Center

Source: Genians threat intelligence report · The Record

Still developing

Metabase zero-day exploited in the wild for unauthenticated admin access

Metabase (GHSA-vwf4-m7j8-wcjf) · August 6, 2026

Metabase disclosed a CVSS 10.0 unauthenticated SQL injection in the /api/session/reset_password endpoint affecting all versions from x.58.0 onward; no CVE has been assigned yet. Exploitation grants full administrator access, including stored credentials for every connected database. Patched releases are available for each branch (x.58.24 through x.63.5); block the reset_password endpoint if you can’t upgrade immediately, and rotate connected-database credentials if the endpoint was publicly reachable.

“Metabase has confirmed active exploitation of this vulnerability. Please upgrade your Metabase instance ASAP.” — Metabase security advisory

Source: Metabase advisory · The Hacker News

WordPress 7.0.3 patches pre-auth login-page XSS with a path to PHP code execution

WordPress · August 6, 2026

CVE-2026-64638 (CVSS 8.9, “XSS2Shell”) is a pre-authentication cross-site scripting flaw in the WordPress login error page affecting every version, chainable to PHP code execution on the server when an administrator interacts with an attacker-controlled page. The fix shipped in WordPress 7.0.3 and was backported to every branch still receiving security updates (back to 4.7). No in-the-wild exploitation or public PoC had been reported at disclosure.

Source: Hadrian research · The Hacker News

“Payroll Pirates” AiTM phishing hijacks Microsoft 365 accounts to hunt payroll and finance mailboxes

Arctic Wolf Labs · August 7, 2026

Arctic Wolf documented a widespread adversary-in-the-middle phishing campaign — overlapping Microsoft’s Storm-2755 “Payroll Pirates” cluster — that steals Microsoft 365 session tokens via voicemail-themed lures, bypassing MFA, then uses Microsoft Graph to enumerate payroll, HR, and finance staff. Compromised sessions are refreshed by automation at roughly eight-hour intervals through geographically matched residential proxies, with hundreds of organizations targeted across the U.S., Canada, and Europe.

“The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic. Automated activity maintains compromised sessions at approximately eight-hour intervals.” — Arctic Wolf Labs

Source: Arctic Wolf Labs · The Hacker News

This brief covers the trailing ~48 hours (August 9–11, 2026).
Primary sources: Microsoft MSRC · CISA AA26-222A · Microsoft Threat Intelligence · N-able · Genians · Metabase · Arctic Wolf Labs

This brief covers the trailing ~48 hours (August 5–7, 2026). Every item below was verified against its primary source — vendor advisory, CISA KEV entry, or original research — before inclusion.

Hackers begin exploiting JetBrains TeamCity RCE (CVE-2026-63077); CISA adds it to KEV

CISA / JetBrains · August 5, 2026

Threat actors are actively exploiting CVE-2026-63077 (CVSS 9.8), a deserialization-of-untrusted-data flaw in JetBrains TeamCity On-Premises that allows unauthenticated remote code execution via HTTP/S requests. CISA added the bug to its Known Exploited Vulnerabilities catalog on Wednesday, roughly a week after disclosure, giving federal agencies three days to patch under BOD 26-04. Fixes are available in TeamCity 2025.11.7 and 2026.1.3, plus a security patch plugin for 2017.1+.

“An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol.” — JetBrains

Source: CISA KEV catalog · SecurityWeek

CISA flags exploited Langflow, Apache Tomcat, and N-able N-central flaws; Tomcat attacks tied to AI-driven campaign

CISA / Palo Alto Networks Unit 42 · August 5, 2026

CISA added three actively exploited vulnerabilities to the KEV catalog: CVE-2026-9198 (CVSS 9.8), an unauthenticated code-injection RCE in Langflow fixed in version 1.10.1; CVE-2026-34486 (CVSS 7.5), an EncryptInterceptor bypass in Apache Tomcat fixed in 11.0.21, 10.1.54, and 9.0.117; and CVE-2026-18556 (CVSS 8.2), an authentication bypass in N-able N-central whose incomplete fix spawned CVE-2026-18577, itself added to KEV earlier in the week. Unit 42 attributes exploitation of the Tomcat flaw to a Zhuhai-based, Chinese-speaking actor using DeepSeek via the Hermes Agent framework as an autonomous offensive operator. Federal agencies have until August 7 to remediate.

“This actor attempted to exploit over 460 targets, leveraging a mix of autonomous and manual techniques.” — Palo Alto Networks Unit 42

Source: CISA alert · The Hacker News

ChainDrop supply-chain attack infects 440 npm packages with Mini Shai-Hulud worm

Microsoft / JFrog / Socket · August 5, 2026

More than 2,200 malicious versions of 440 npm packages were published in the ChainDrop campaign, which began with the compromise of a maintainer account in the keyv and cacheable namespaces — packages with a combined 500+ million weekly downloads. The self-propagating worm, a descendant of Shai-Hulud 2.0, steals npm, GitHub, cloud, and Vault credentials, republishes poisoned package versions, uses Ethereum-based C2 (EtherHiding), and installs a dead-man’s switch that wipes itself if the stolen GitHub token is revoked. Affected developers should treat machines as compromised, rebuild CI runners, and rotate credentials.

“Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for NPM, GitHub, cloud, and infrastructure credentials.” — Microsoft

Source: Microsoft · JFrog · SecurityWeek

Cisco ships critical Catalyst SD-WAN hardening release: three CVSS 9.9 flaws, no workarounds

Cisco PSIRT · August 5, 2026

Cisco’s August 5 advisory bundle addresses five vulnerability classes in Catalyst SD-WAN Software, three rated CVSS 9.9: CVE-2026-20303 (improper input validation/path traversal), CVE-2026-20304 (improper access control), and CVE-2026-20310 (improper link resolution), plus CVE-2026-20312 (8.8) and CVE-2026-20313 (7.7). All deployment types are affected, there are no workarounds, and fixed releases start at 20.9.10 through 26.1.2. The flaws were found internally and are not known to be exploited; the same publication window also included critical IOS XE and FMC fixes.

“These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models.” — Cisco PSIRT advisory

Source: Cisco advisory · SecurityWeek

CVSS 10.0 authorization bypass in Paperclip AI agent platform allowed unauthenticated RCE (CVE-2026-41679)

Oasis Security · August 6, 2026

Oasis Security disclosed CVE-2026-41679 (CVSS 10.0), a missing authorization check in Paperclip, an AI agent orchestration platform. On default authenticated-mode deployments, a remote attacker could self-register without email verification, self-approve a CLI authorization challenge for board-level API access, then import a crafted company bundle whose .paperclip.yaml deploys an agent that executes host commands as the server process. Patched in v2026.416.0 along with two related bugs, including a DNS-rebinding-on-loopback flaw enabling code execution on developer machines; no exploitation in the wild has been reported.

“A network attacker could create an account and sign in immediately, without an invitation or control of a verified mailbox.” — Oasis Security

Source: Oasis Security technical report (PDF) · SecurityWeek

This brief covers the trailing ~48 hours (August 5–7, 2026). Primary sources: CISA KEV catalog, CISA KEV alert, Cisco PSIRT, Microsoft Security Blog, JFrog Research, Socket, Unit 42, Oasis Security.

This brief covers cyber security developments from the trailing ~48 hours (July 30 – August 1, 2026). Every item below was verified against its primary source — vendor advisory, government alert, or original research — before inclusion.

CosmosEscape: Wiz researchers could have taken over every Azure Cosmos DB database

Wiz Research · July 30, 2026

Wiz Research disclosed CosmosEscape, a critical vulnerability chain in Azure Cosmos DB’s Gremlin API. By escaping the Gremlin query sandbox via .NET reflection, researchers gained code execution on the multi-tenant DB Gateway and extracted a platform-wide signing secret they dubbed the “Cosmos Master Key” — capable of retrieving the primary key of any Cosmos DB account across all tenants, regions, and API flavors. No CVE ID or CVSS score was assigned to this cloud-service flaw. Microsoft deployed a hotfix within 48 hours of the November 2025 report, completed a permanent architectural fix across all regions in July 2026, and found no evidence of exploitation or customer data access. No customer action is required.

“It was a platform-wide key that could retrieve the primary key for any Cosmos DB account on the service, all through publicly accessible endpoints.” — Wiz Research

Source: Wiz Research blog · SecurityWeek

CISA urges water utilities to pull exposed PLCs offline after coordinated attacks on 30+ Minnesota systems

CISA · July 30, 2026

CISA issued an alert warning of a significant increase in threat activity targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector. The alert follows a coordinated cyberattack on more than 30 Minnesota community water systems that state officials suspect may be linked to Iran; attackers changed PLC passwords to lock out operators, modified IP addresses to disconnect devices, and disrupted operations, forcing some utilities to switch to manual operation. CISA specifically flagged undocumented cellular modems as a common blind spot and pointed Rockwell Automation MicroLogix 1400 owners to vendor recovery guidance. Censys estimates more than 4,100 Rockwell/Allen-Bradley hosts, 4,100 Siemens hosts, and over 2,000 Schneider Electric hosts are currently reachable from the public internet.

“CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.” — CISA alert, July 30, 2026

Source: CISA alert · BleepingComputer

Sophos: Microsoft Teams vishing campaign STAC4749 deployed Chaos ransomware in under 17 hours

Sophos · July 30, 2026

Sophos detailed STAC4749, a Teams voice-phishing campaign that targeted dozens of North American organizations between February and June 2026 — roughly 95% in Canada (50%) and the U.S. (44%). Operators posed as IT helpdesk staff from “.top” domains like info-secure[.]top, talked victims into Quick Assist or RemSupp remote sessions, then deployed a custom loader, a Python backdoor, and Golang C2 implants with pinned certificates. At least three intrusions ended in Chaos ransomware deployment; in one case, initial access to encryption took less than 17 hours. Most scam calls lasted just two to two-and-a-half minutes.

“Given the short interval between initial access and encryption, Sophos analysts assess with high confidence that STAC4749 was a financially motivated operation that either directly deployed ransomware or coordinated with affiliates.” — Sophos

Source: Sophos threat research · BleepingComputer

Still developing

Cisco patches actively exploited Secure FMC zero-day CVE-2026-20316; KEV deadline was August 1

Cisco / CISA · July 29, 2026

Cisco released patches for CVE-2026-20316, a static-credential vulnerability in Secure Firewall Management Center that lets a remote, unauthenticated attacker log into devices using default credentials for a low-privilege account and access sensitive data. Cisco rates it high severity, confirmed active exploitation observed in July, and published indicators of compromise; the flaw can be chained with other FMC bugs to escalate privileges. CISA added it to the Known Exploited Vulnerabilities catalog on July 29 with a remediation deadline of August 1 for federal agencies. Discovery is credited to a Horizon3.ai researcher.

“If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.” — Cisco security advisory

Source: Cisco advisory · CISA KEV alert · SecurityWeek

Russian group TA488 exploits Exchange OWA flaw CVE-2026-42897 to plant OWAReaper implant

Proofpoint · July 29, 2026

Proofpoint reported that Russia-aligned TA488 (Void Blizzard / Laundry Bear) began a campaign on July 22 exploiting CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access that Microsoft patched in June 2026, against US and European government entities plus telecom, financial, hospitality, and aerospace targets. Opening a crafted email is enough to execute OWAReaper, a browser-resident JavaScript implant that steals autofill credentials and OAuth tokens, grants mailbox-wide folder permissions to the tenant’s “Default” user, and persists in OWA settings and the offline message cache. Campaign infrastructure dates to March 2026 — two months before Microsoft’s out-of-band patch — suggesting possible zero-day use.

“This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user’s device will not evict the actor.” — Proofpoint Threat Research

Source: Proofpoint threat research · NVD entry · BleepingComputer

This brief covers the trailing ~48 hours (July 30 – August 1, 2026). Primary sources: Wiz Research, CISA Alert (Jul 30), Sophos, Cisco PSIRT, CISA KEV (Jul 29), Proofpoint.

This brief covers the trailing ~48 hours (July 24–26, 2026). Every item below was checked against its primary advisory, vendor PSIRT, original research write-up, or the CISA KEV catalog, and the disclosure or publication date was confirmed to fall within (or, for the “Still developing” section, just outside) the window.

Researchers publish working GitLab RCE chain from two five-year-old Oj memory-corruption bugs

depthfirst · July 24, 2026

depthfirst detailed — and released proof-of-concept code for — a remote code execution chain against default self-managed GitLab, built by combining two memory-safety flaws in Oj, the native-C Ruby JSON parser used by GitLab’s Jupyter notebook diff renderer. An authenticated user who can push to a project commits a crafted .ipynb file and opens its commit diff, driving repository-controlled bytes into Oj inside a Puma worker; an out-of-bounds write plus a heap-pointer disclosure are chained to hijack a callback pointer and reach system(), executing commands as the git account. The chain affects GitLab CE/EE 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1 (fixed in 18.10.8, 18.11.5, and 19.0.2 by upgrading to Oj 3.17.3, shipped June 10). GitLab did not file the underlying fix as a security fix, so there is no CVE or CVSS for the chain itself; the broader Oj review produced nine published advisories including CVE-2026-54502, CVE-2026-54896, and CVE-2026-54903. No in-the-wild exploitation was reported at publication.

“A normal authenticated user who could push to a project and view its commit diff could reach this path from their own project. Exploitation required no administrator privileges, CI or runner access, victim interaction, or access to another user’s project.” — Yuhang Wu, depthfirst

Source: depthfirst research · GitLab 19.0.2 patch release · The Hacker News

“Certighost” exploit lets a low-privileged AD user impersonate a Domain Controller (CVE-2026-54121)

Microsoft MSRC / independent researchers · July 24, 2026

Researchers H0j3n and Aniq Fakhrul published a working exploit for an Active Directory Certificate Services flaw they codenamed Certighost, tracked as CVE-2026-54121 (CVSS 8.8, improper authorization), which Microsoft patched on July 14. The bug lives in the AD CS enrollment “chase” fallback: an Enterprise CA follows a requester-supplied Domain Controller host over SMB and LDAP without first proving it is a real DC, letting a normal domain account obtain a certificate for a Domain Controller and authenticate as that machine via PKINIT. Because DC accounts carry directory-replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync. Exploitation needs only network access and a domain account (no admin rights, no user interaction), and the full PoC is public. The flaw was not on CISA’s KEV catalog as of July 24, and no primary source reviewed reported in-the-wild exploitation.

“As of July 24, no primary source reviewed by The Hacker News reported exploitation in the wild, but the full proof-of-concept was public. That absence of reporting does not prove that exploitation has not occurred.” — The Hacker News

Source: Microsoft MSRC advisory · NVD · The Hacker News

Fastjson 1.x RCE (CVE-2026-16723) reported under active attack with no 1.x patch available

Alibaba advisory / ThreatBook / Imperva · advisory July 21, exploitation reported July 22–25, 2026

Alibaba published an advisory for CVE-2026-16723 (Alibaba-assigned CVSS 9.0), a critical RCE in the Fastjson 1.x Java JSON library affecting versions 1.2.68 through 1.2.83. In a Spring Boot executable fat-JAR application, an attacker-controlled @type value can be turned into a class-resource lookup that fetches attacker-controlled bytecode, yielding unauthenticated code execution with the privileges of the Java process; the maintainers confirmed the chain requires no AutoType enablement and no classpath gadget. ThreatBook reported capturing in-the-wild exploitation on July 22, and Imperva reported activity against U.S. financial-services, healthcare, and retail organizations. As of July 25 no fixed Fastjson 1.x artifact was available — mitigations are enabling SafeMode (-Dfastjson.parser.safeMode=true) or using the 1.2.83_noneautotype build, with migration to Fastjson2 as the long-term fix. Note: a July 23 CISA-ADP assessment marked exploitation as “none,” and the flaw was absent from CISA’s KEV catalog on July 25.

“As of July 25, Alibaba had not released a fixed Fastjson 1.x version.” — The Hacker News

Source: Alibaba advisory · NVD · The Hacker News

Still developing

Cl0p-linked actors chain unauthenticated RCE against internet-exposed PTC Windchill / FlexPLM (CVE-2026-12569)

Ransom-ISAC / PTC · July 25, 2026

A coordinated advisory from Ransom-ISAC, eCrime.ch, and DEFUSED describes a data-extortion campaign, with tradecraft attributed to Cl0p (aka FIN11 / Graceful Spider / Lace Tempest), against internet-exposed PTC Windchill and FlexPLM. Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5) with a server-side flaw in the Windchill login servlet, CVE-2026-12569 (CVSS 9.3), which CISA added to its KEV catalog in late June. Successful exploitation yields unauthenticated RCE and hex-named JSP web shells under /Windchill/login/, followed by staging and double-extortion theft of engineering and design data across manufacturing, automotive, aerospace, and retail targets.

“Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling unauthenticated remote code execution and deployment of hex-named JSP web shells under /Windchill/login/.” — Ransom-ISAC / eCrime.ch / DEFUSED advisory

Source: Ransom-ISAC advisory · The Hacker News

This brief covers the trailing ~48 hours (July 24–26, 2026).

Primary sources:

• depthfirst — GitLab RCE via two Ruby memory-corruption vulnerabilities
• GitLab — June 10 patch release (19.0.2 / 18.11.5 / 18.10.8)
• Microsoft MSRC — CVE-2026-54121
• NVD — CVE-2026-54121
• Alibaba — Fastjson 1.x RCE advisory (CVE-2026-16723)
• NVD — CVE-2026-16723
• Ransom-ISAC — Cl0p Windchill/FlexPLM exploitation advisory
• CISA — Known Exploited Vulnerabilities Catalog