TL;DR for CISOs: CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog on September 18 with a September 21 federal remediation date, Fortinet reported thousands of blocked attacks against an unauthenticated remote code execution flaw in the Orkes Conductor workflow platform, and CrowdSec disclosed that roughly 170 of its private code repositories were copied through a departed employee's GitHub account that had never been closed.

Lead story: three Linux kernel flaws confirmed as exploited, with a September 21 federal deadline

What happened

CISA placed three Linux kernel vulnerabilities in the Known Exploited Vulnerabilities catalog across two separate alerts on Friday, September 18, citing evidence that attackers are using them. The most severe, CVE-2025-39682, sits in the kernel's TLS receive path and is scored 9.8. According to CISA's entry, it fails to handle an unexpected condition properly, which can let an authenticated local user read memory that should not be visible to them or crash the system.

The second, CVE-2026-53266, is an out-of-bounds write in the ebtables code that rewrites ARP addresses during source network address translation, scored 8.8. The third, CVE-2025-39964, is a race condition on AF_ALG sockets scored 7.8, where two writes to the same socket can collide and either crash the machine or corrupt the result of a cryptographic operation.

Neither CISA nor the reporting around it describes how the three are being used, or whether they are being combined into one chain. That matters for how you prioritize, and we will say plainly that the exploitation detail is not public. What is public is the vendor reaction: Red Hat revised its advisories for all three on September 19 and told customers to treat them as high priority, noting that public exploit code exists.

The timing sits alongside a separate disclosure. On September 18, researcher Asim Manizada published working exploit code for four other Linux kernel local privilege escalation flaws he reported in mid-July, named DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). All four are fixed in current kernels, and there are no reports of them being used in attacks. The two events are not connected, but together they mean the supply of usable local-root code against Linux has grown noticeably in one week.

Evidence

Source 1: The Hacker News, "CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild," September 19, 2026
Source 2: Security Affairs, "U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog," September 20, 2026
Primary reference: CISA Known Exploited Vulnerabilities Catalog

What this means for your team

Most vulnerability programs push local privilege escalation to the back of the queue because exploitation requires a foothold. That logic held when footholds were expensive. It holds less well now, when initial access is routinely bought, and when the same week produces public exploit code for four more kernel escalation bugs. A confirmed-exploited local escalation flaw is best read as the second half of an attack chain whose first half is already commoditized.

There is a second, quieter exposure. The AF_ALG race condition can corrupt cryptographic results rather than simply crash a process. If you run signing, tokenization, or key derivation on Linux hosts, a silent integrity failure is harder to detect than an outage and harder to explain afterwards. Ask whether your crypto operations would surface a wrong answer or simply return it.

The federal date of September 21 is a useful external anchor when you need to move a maintenance window. You are not bound by it, but it is a defensible number to put in front of an application owner who wants to wait for the next quarterly cycle.

Orkes Conductor: unauthenticated code execution under opportunistic attack

What happened

Fortinet issued an outbreak alert this week for a flaw that lets anyone who can reach a Conductor server run operating system commands on it without logging in first. Conductor accepts workflow definitions through an API endpoint, and per the NVD description the affected builds evaluate inline JavaScript or Python expressions inside those definitions before authentication is applied. Where the GraalVM evaluator was configured with unrestricted host access, an attacker escapes the scripting sandbox and executes commands with the privileges of the Conductor process.

Fortinet said it observed attackers submitting crafted workflow definitions to the Conductor workflow API. The figures it published show the campaign accelerating: 1,290 attempts blocked in a single day around September 9, which it described as a 132 percent increase in daily activity, and nearly 7,000 across the preceding week. It attributed most of the traffic to sources in Germany, Hong Kong, Indonesia, the United Arab Emirates and India. SecurityWeek, reporting independently on September 18, noted that proof-of-concept code appeared in early August and that exploitation followed shortly after.

Evidence

Source 1: The Hacker News, "Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild," September 19, 2026
Source 2: SecurityWeek, "Critical Orkes Conductor Vulnerability Exploited in Attacks," September 18, 2026

What this means for your team

The interesting number here is not the CVSS score. It is the three-month gap between a fix shipping in June and attack volume climbing in September. That gap is the shape of most workflow and orchestration deployments: installed by a platform or data engineering team, pinned to a version that works, and not carried on any patch calendar the security function owns.

The second point is placement. Conductor is internal software by intent, so it rarely gets the hardening review an external application would. Opportunistic scanning does not respect intent. If an instance answers on a routable address, it is an external application whatever the architecture diagram says.

Finally, consider what a Conductor host can reach. Orchestration platforms hold the credentials needed to drive other systems, so command execution there is rarely contained to that one box.

CrowdSec: 170 private repositories copied through a leaver's account

What happened

On May 11, 84 malicious versions of 42 TanStack npm packages were published. Installing one of them ran code that harvested credentials from the developer's machine, including GitHub tokens, SSH keys and cloud credentials. Eleven days later, on May 22, someone used a GitHub OAuth token belonging to a CrowdSec employee who had already left to clone roughly 170 of the company's private repositories. CrowdSec had kept his organization access open so he could finish outstanding work, and removed the account on May 25.

The company learned of the leak only when the archive was posted to a forum on September 16. Alongside source code for its web console, data science scripts and models, automation scripts, and the consensus algorithm behind its IP blocklists, the archive held the email addresses of 83 users and details on 51 potential investors from a 2020 system. CrowdSec says the account was used only to copy code, that no commits or changes were made, and that its infrastructure and databases were not reached.

The company's account changed between its two statements, and that is worth noting rather than glossing over. Its September 17 statement said no client data, credentials, names or organizations had leaked, and pointed to a backdoored component inside CrowdSec as the likely path. The September 18 report withdrew both points: no malicious TanStack versions were found in CrowdSec's own code, the route was the former employee's account, and user and investor details were in fact exposed. CEO Philippe Humeau apologized to the investors in the report. The same npm compromise also touched other firms, with Mistral AI citing a developer device and OpenAI citing two employee devices and unauthorized access to a limited set of internal repositories.

Evidence

Source 1: CrowdSec, "TanStack Supply Chain Attack Analysis," September 18, 2026
Source 2: The Hacker News, "CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories," September 19, 2026

What this means for your team

This is a clean, uncomfortable case study in how a supply chain compromise converts into a data loss months later, through a control nobody thinks of as security. The npm packages were the weapon. The open door was an offboarding exception granted for a sensible operational reason and then left in place. Almost every organization grants that exception.

The detection failure is the part worth taking to your own team. CrowdSec says the token left no usable trace in the GitHub logs it could examine and no longer existed by the time it learned of the leak. Mass cloning of private repositories by a single identity is a detection most organizations assume they have and few have actually tested. It is also, unusually, a detection you can go and validate this week.

One more detail deserves attention on its own terms: the company has stated it did not require endpoint protection on developer machines at the time and has since deployed it. Developer endpoints hold the keys to everything downstream, and they are frequently the least monitored devices in the estate because the people using them ask for the exception.

SolarWinds patches a hard-coded key in Access Rights Manager

What happened

SolarWinds published an advisory on September 17 for a flaw in Access Rights Manager, the product many organizations use to review and certify who has access to what across file shares and directory services. The issue is a hard-coded static key, and exploiting it can give an unauthenticated attacker code execution. The CVSS vector matters for prioritization: the score of 8.8 is calculated with an adjacent network attack vector, meaning the attacker needs to already be on the same network segment rather than reaching the server from the internet. SolarWinds reports no exploitation. The same release cycle also addressed 16 flaws in Serv-U, and earlier fixes covered a SAML authentication bypass in Web Help Desk.

Evidence

Source 1: The Hacker News, "SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE," September 19, 2026
Source 2: CVE record for CVE-2026-28326, including the SolarWinds CNA entry and CVSS vector

What this means for your team

A hard-coded key is a design defect rather than a coding slip, which means the same key is in every deployment and cannot be rotated by the customer. Once the value is known, every unpatched instance is equally exposed. That is the reason to move on this despite the adjacent-network vector and the absence of exploitation: the barrier to entry drops to zero the moment someone extracts the key from a binary.

The product context sharpens it. Access Rights Manager is an identity governance tool, so it holds broad read access across file systems and directories by design. Code execution on a governance platform is a fast route to understanding, and then abusing, the permission structure of the whole estate.

Also notable

• A supply chain attack on the email platform Brevo used compromised Cloudflare access to inject malicious code into customer websites, with more than 100,000 sites potentially affected. Security Affairs, September 18
• Japanese software company Helpfeel is notifying users of its Gyazo screenshot service after a flaw in an image upload server exposed 23 million user records. Security Affairs, September 18
• Working exploit code is now public for four separate Linux kernel local privilege escalation flaws, all fixed upstream, with no reports yet of real-world use. The Hacker News, September 18
• A flaw called Click2Shell in WordPress core lets a crafted link opened by a logged-in administrator install a theme with no click, and can chain to code execution through a second flaw in that theme. Fixed in WordPress 7.1.1. The Hacker News, September 18
• A flaw named Plugin4Shell lets the owner of a plugin repository swap code that four AI coding agents had pinned to a reviewed commit hash. Anthropic and OpenAI have patched; GitHub Copilot has no fix and Google will not patch the Gemini CLI. The Hacker News, September 18
• Microsoft patched a maximum-severity privilege escalation flaw in Azure AI Foundry, CVE-2026-85889, scored 10.0. No customer action is required and there is no evidence of exploitation. The Hacker News, September 18

FAQ

Which Linux kernel CVEs did CISA add on September 18, 2026?

CISA added CVE-2025-39682 (CVSS 9.8, kernel TLS receive path), CVE-2026-53266 (CVSS 8.8, ebtables SNAT ARP rewrite path) and CVE-2025-39964 (CVSS 7.8, AF_ALG socket race condition). All three were listed on evidence of active exploitation, with a federal remediation date of September 21, 2026.

Do the Linux kernel flaws allow remote attacks?

No. All three require a local attacker who already has access to the machine. That is why they matter as the escalation stage of an attack chain rather than as an initial entry point, and why teams that deprioritize local privilege escalation should revisit that rule.

Is CVE-2026-58138 in Orkes Conductor being exploited?

Yes. Fortinet issued an outbreak alert and reported blocking 1,290 attempts in a single 24-hour period around September 9 and close to 7,000 between September 2 and 9. Empirical Security recorded in-the-wild exploitation as early as August 21. The fix, version 3.30.2, shipped in June 2026.

What was actually exposed in the CrowdSec incident?

Roughly 170 private GitHub repositories, including the company's web console, data science scripts and models, automation scripts, and its blocklist consensus algorithm, plus the email addresses of 83 users and details on 51 potential investors from 2020. CrowdSec states that its infrastructure and databases were not accessed and that no code was altered.

How did a former employee's account lead to the CrowdSec leak?

The employee had left, but his GitHub organization access was kept open so he could finish outstanding work. His laptop was compromised in the TanStack npm supply chain attack in May, which harvested his GitHub token. An attacker used that token on May 22 to clone the repositories. The account was removed on May 25.

Does the SolarWinds ARM flaw need immediate patching?

There is no reported exploitation and the attack vector is adjacent network rather than internet-facing, so this is not an emergency. It should still be scheduled promptly, because a hard-coded key is identical across every deployment and cannot be rotated by the customer once it becomes public.

What is the single highest-value action from this edition?

Run a report of every account and token in your code hosting platform that belongs to someone who has left. It takes one query, it is the exact failure that cost CrowdSec its source code, and it is almost certainly not clean in your environment either.

Related reading from the community

• Browse every Breach Watch edition in the Breach Intelligence hub
• Practitioner discussions on vulnerability management and patch prioritization
• Community writing on software supply chain security
• CISO Platform: frameworks, checklists and peer discussion for security leaders

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.

TL;DR for CISOs: The Clop extortion group is running a fresh mass data-theft campaign against internet-exposed PTC Windchill and FlexPLM systems, naming Shell, General Electric, and Philips among 43 claimed victims. The same 24 hours brought two more critical flaws under active exploitation within days of their patches, in SAP Commerce Cloud and VMware vCenter, and France's tax authority admitted a breach affecting 678,000 people and businesses that started with a stolen login rather than any software exploit.

Clop names Shell, GE, and Philips in a 43-victim PTC Windchill data-theft campaign

PTC Windchill and FlexPLM · Product lifecycle management · Mass exploitation of CVE-2026-12569 for data theft and extortion

What happened

Windchill and FlexPLM are where manufacturers keep the crown jewels of how a physical product is designed and built: engineering drawings, bills of materials, test reports, and facility documentation. Clop, according to security reporting, has been treating internet-exposed instances of these platforms as a mass-exploitation target, the same playbook it ran against MOVEit, GoAnywhere, Cleo, and Oracle E-Business Suite. Independent confirmation has come from ReliaQuest and the Ransomware Information Sharing and Analysis Centre, which observed the attackers deploying JSP webshells on compromised platforms to pull data out. The 43-victim count and the specific volumes, including the 89 gigabytes attributed to Shell and the lists of blueprints and facility photos, are Clop's own claims. What the named companies have confirmed is narrower: Philips acknowledged a contained breach of one enterprise server with no customer impact, while GE and Shell say they are still investigating. The gap between what a gang claims and what a victim confirms is exactly where a CISO should read carefully.

Evidence

Verified against two independent sources:

• BleepingComputer: Philips and GE investigating Clop ransomware data theft claims
• Computer Weekly: Multiple organisations investigating fresh wave of Cl0p breaches

What this means for your team

Clop has spent years turning a single flaw in a widely deployed enterprise platform into an industrial-scale extortion pipeline, and it has now settled on product-lifecycle systems as this cycle's soft target. If your organization designs, manufactures, or supplies physical goods, the risk is not only that your own Windchill or FlexPLM instance is exposed; it is that a supplier or contract manufacturer holding your drawings and specifications is. The stolen material in these campaigns is intellectual property with a long shelf life, so the damage is not a one-week news story but a multi-year exposure of how your products are made. Because the patches have been available since mid-June, an unpatched internet-facing instance today is less a vulnerability-management gap than an incident waiting to be scoped.

Max-severity SAP Commerce Cloud flaw exploited three days after its patch

SAP Commerce Cloud · E-commerce platform · Unauthenticated remote code execution, CVE-2026-58231

What happened

SAP Commerce Cloud sits underneath large business-to-business and business-to-consumer storefronts, which makes a pre-authentication code-execution flaw in it a direct line to order data, customer records, and the systems behind them. Two separate threat-intelligence organizations reported attackers probing the flaw within days of the patch, before any public exploit code existed, which points to adversaries reverse-engineering SAP's fix to locate the vulnerable path. By August 15 a working proof-of-concept was circulating, lowering the bar for less sophisticated actors to join in. The pattern here, exploitation arriving before most enterprises have finished testing the patch, is the recurring story of 2026 rather than an outlier.

Evidence

• SecurityWeek: Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure
• The Hacker News: SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts

What this means for your team

If you run SAP Commerce Cloud, the safe assumption is that opportunistic scanning for this flaw is already underway and that a proof-of-concept is in circulation. The exposure is not limited to the storefront itself; a foothold on the platform can reach the databases and internal components it connects to, which is where payment and customer data live. Retail and consumer-facing organizations that treat commerce infrastructure as a business system rather than a security-critical one will feel this gap most, because the teams that operate these platforms are often separate from the security function that needs to drive the emergency patch.

Suspected state-linked campaign exploits VMware vCenter for persistent access

VMware vCenter Syslog Server · Virtualization management · Unauthenticated RCE, CVE-2026-59310

What happened

vCenter is the control plane for an organization's virtual infrastructure, which is why it is a perennial target: control it and you can reach the virtual machines, hosts, and permissions beneath it. This campaign moved fast, from a July 29 disclosure to active exploitation on August 3 and hundreds of compromised systems within a week, and the attacker's choice of a reverse SSH channel is a deliberate move to keep quiet, persistent access rather than to smash and grab. The suspected state alignment matters less than the mechanics for most defenders. What stands out is the speed and the target selection: an unauthenticated flaw in a management plane, weaponized before many organizations had scheduled the patch. We are attributing the state-nexus assessment to QUIRSO and treating it as a working hypothesis, not a settled fact.

Evidence

• BleepingComputer: Critical VMware vCenter RCE flaw exploited for reverse SSH access
• The Hacker News: Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

What this means for your team

A compromised vCenter is not one server; it is leverage over everything that runs on top of it, which is why an attacker willing to invest in stealthy persistence is a worse problem than a ransomware crew that announces itself. Because the campaign uses a legitimate open-source tool for its command-and-control, signature-based detection will miss it, and the same YARA rule that catches the malicious use will also flag sanctioned use of reverse_ssh in your environment. That ambiguity is the point: defenders need to know where reverse SSH is expected before they can spot where it is not. Any organization that left vCenter reachable and unpatched through early August should treat this as a hunt, not a patch.

France's tax authority discloses breach of 678,000 people and businesses

DGFiP · Public sector · Stolen credentials and MFA bypass, no software exploit

What happened

The breach surfaced when an actor using the handle "ZeroBytes" claimed the intrusion on a cybercrime forum and listed a database for sale, prompting DGFiP's investigation. The agency's account is careful: it says access was gained through credentials and an MFA bypass, that it suspended those accounts, and that deeper analysis since August 12 established that data on 678,000 people and businesses had been consulted and extracted before the access was cut off. ZeroBytes has made far larger claims, saying the portal held data on roughly 20 million citizens and that they extracted 252,149 records covering more than two million people, but those numbers are the attacker's and are not confirmed by DGFiP. This is the latest in a run of incidents affecting French government systems this year.

Evidence

• Help Net Security: France's tax authority admits hackers made off with data on 678,000 individuals
• BleepingComputer: French tax authority data breach affects 678,000 individuals

What this means for your team

The most instructive detail is what did not happen: no zero-day, no unpatched server, just a working login and a way around multi-factor authentication. That should reframe how much of your defensive budget assumes the threat arrives as an exploit. An MFA bypass, whether through phishing-resistant gaps, session-token theft, or social engineering of a help desk, turns strong-on-paper authentication into a single point of failure. For any organization holding sensitive records for large populations, this case argues for watching how privileged and contractor accounts actually behave after login, because the controls at the door held up right until they did not.

Also notable

• Cryptocurrency wallet maker SafePal is warning roughly 40,000 customers of a data breach that exposed order information after a flaw was exploited. SecurityWeek
• Attackers are exploiting a recent macOS Screen Sharing vulnerability to deploy a Monero cryptocurrency miner on compromised Macs. BleepingComputer
• A threat actor claims to have stolen 3.6 million Azure account records from major companies, part of a broader Azure data-theft campaign researchers are tracking. BleepingComputer
• Pokemon Center disclosed a data breach that exposed customer information and forced the cancellation of some orders. BleepingComputer

FAQ

What is CVE-2026-12569 and who is affected?

It is a critical improper input validation vulnerability in PTC Windchill and FlexPLM that the Clop gang is exploiting on internet-exposed instances to steal data. PTC says more than 30,000 organizations use its products across aerospace, defense, automotive, heavy machinery, retail, and medtech. Patches have been available since June 17.

Have Shell, GE, and Philips confirmed the Clop breach?

Philips confirmed a contained breach of one enterprise server with no customer impact. GE and Shell say they are investigating and have not confirmed Clop's specific claims, including the 43-victim count and the 89 gigabytes attributed to Shell, which remain the gang's assertions.

How urgent are the SAP Commerce Cloud and VMware vCenter flaws?

Both are being exploited in the wild within days of disclosure. SAP Commerce Cloud (CVE-2026-58231, CVSS 10) was targeted three days after its August 11 patch, and VMware vCenter (CVE-2026-59310, CVSS 9.8) has been exploited since August 3 across dozens of countries. Patch both on an emergency basis and check for compromise.

How did the French tax authority breach happen?

DGFiP says the attacker used valid login credentials and an MFA bypass, not a software exploit. Data on 678,000 individuals and businesses was extracted, including tax and cadastral information, but DGFiP says the online portals, usernames, and passwords were not compromised.

Is the VMware vCenter campaign confirmed to be a Chinese state operation?

No. Incident-response firm QUIRSO assessed with moderate confidence that a Chinese-speaking actor is responsible, based on time-zone and language artifacts. That is a working hypothesis, not a confirmed attribution, and should be treated as such.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.

TL;DR for CISOs: An extortion crew leaked data tied to 1.6 million RingCentral customers after a social engineering campaign, and the same 24 hours brought a supply chain attack that reached more than 2,500 organizations through an AI library, a cross-border takedown of a bank fraud crew, and a fresh public exploit that turns Microsoft Defender into a route to SYSTEM on fully patched Windows.

ShinyHunters leak exposes data on 1.6 million RingCentral customers

RingCentral · Cloud business communications · Social engineering to data theft and extortion

What happened

RingCentral is a cloud provider of business phone, messaging, video, and contact-center services, so its customer records sit close to how thousands of organizations reach their own staff and clients. According to the company, attackers used social engineering rather than a software flaw to reach customer information, and RingCentral moved to stop the activity once it was detected. The number now circulating, 1.6 million, comes from the count of unique email addresses that HaveIBeenPwned catalogued from the leaked archive, alongside names, postal addresses, and phone numbers. The figure and the underlying data set trace to the ShinyHunters group's own claims and published files, which RingCentral has not independently verified.

Evidence

Verified against two independent sources:

• SecurityWeek: 1.6 Million Likely Impacted by RingCentral Data Breach
• Have I Been Pwned: RingCentral breach record

What this means for your team

A vendor that helps you talk to customers holds a directory of who those customers are. When that directory leaks, the risk is not just embarrassment for the vendor; it is a ready-made target list for the phishing and voice-fraud campaigns your users will see next. This case also fits a pattern that has defined 2026: an extortion group walked in through a human, not a zero-day. The contact details in the archive are exactly what a caller needs to sound legitimate, so the immediate exposure is downstream social engineering against your workforce and your own customers.

One leaked token exposed 2,500-plus organizations through an AI library

LiteLLM · Open source AI proxy · Build-pipeline supply chain compromise

What happened

The threat actor CloudSEK tracks as TeamPCP has been chaining open source compromises together, and this one shows why that approach scales. A single unrevoked credential led from Trivy into the LiteLLM build system and then into a LiteLLM release, which CloudSEK summarizes as one token, three tools deep. Because automated build systems copy artifacts quickly, a malicious package that lives for less than an hour can still reach scheduled jobs, dependency resolvers, ephemeral runners, and developer laptops. CloudSEK's exposure list names large enterprises across technology, finance, pharmaceuticals, and manufacturing, while stressing that inclusion reflects potential exposure that each organization must verify for itself. The secrets within reach of the library included cloud keys, SSH keys, tokens, environment variables, and AI provider keys.

Evidence

• SecurityWeek: Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack
• CloudSEK: AI supply chain breach analysis

What this means for your team

The interesting detail is not the raw victim count, which is contested, but the mechanism. An AI component became the pivot point because it sits at a junction of data, identity, compute, and automated action, and it was reached without anyone attacking it head on. If your teams pull AI libraries and scanners straight into CI, then the trust you place in one upstream tool is inherited by everything your pipeline touches. CloudSEK's own view is that the next major supply chain attack is likely to aim at the AI layer precisely because it connects to everything else.

Police arrest bank fraud crew that drained 30 million euros through a payment provider flaw

Commerzbank customers · Financial services · Third-party payment vulnerability and money laundering

What happened

The scheme is a study in how a supplier weakness becomes a bank's problem. According to the BKA, a bad software update opened a hole in a payment processor, and the attackers used it to pull money from customer accounts, then laundered the proceeds through pass-through accounts, companies, virtual-asset platforms, and payment cards issued without the account holders' consent. The largest share was cashed out in Brazil, with the rest spread across four European countries. Investigators added a memorable twist: Brazilian police said one suspect had run for elected office in 2024 and used part of the stolen funds for the campaign, and separately seized a 3D printer used to make weapons. Commerzbank said it cooperated closely with the authorities and that its customers were made whole.

Evidence

• BleepingComputer: Hackers arrested over 30M euro bank fraud exploiting service provider flaw
• The Record: Investigation of banking hack leads to arrests in Germany, Brazil

What this means for your team

The arrests are a genuine win, but the cause should hold a CISO's attention: the money moved because a third party's software update went wrong, not because the bank itself was breached. For any organization that depends on payment processors, clearing houses, or transaction platforms, this is a reminder that a supplier's change management is part of your fraud exposure. The nearly three-year gap between the 2023 theft and these 2026 arrests also underscores that recovery and attribution are slow, so prevention and rapid detection at the supplier boundary matter far more than the hope of clawing funds back later.

New 'ShieldBreak' exploit turns Microsoft Defender into a path to SYSTEM

Microsoft Defender · Windows privilege escalation · Public proof-of-concept, unpatched

What happened

ShieldBreak is the latest in a run of Defender and Windows privilege-escalation exploits this researcher has released since April, and it arrives amid a public dispute with Microsoft over disclosure and bug bounty practices. The important point for defenders is narrow but real: this is a working, publicly available exploit with no official patch, and it targets the security agent itself. There is no confirmed in-the-wild abuse yet, so this is a proof-of-concept risk rather than an active campaign, but privilege-escalation code that lands on a fully updated machine tends to get folded into attacker toolkits quickly. It does not grant initial access on its own; an attacker still needs a foothold before using it to climb to SYSTEM.

Evidence

• BleepingComputer: New Microsoft Defender ShieldBreak zero-day grants SYSTEM privileges
• SecurityWeek: Nightmare Eclipse Drops Windows Zero-Day Exploit ShieldBreak

What this means for your team

Privilege escalation rarely makes headlines because it is not the way in, but it is often the step that turns a minor foothold into full control of a host. A public exploit against Defender on patched systems means your endpoint detection and internal segmentation are doing more of the work than your patch level suggests. Until Microsoft ships a fix, treat local privilege escalation as a live gap and lean on behavioral detection rather than assuming an up-to-date machine is safe.

Also notable

• More than 1,000 charities and nonprofits were caught in a data breach at UK CRM provider Beacon, after attackers downloaded customer database backups. SecurityWeek
• Roughly 14,000 Trezor customers had names, addresses, emails, and phone numbers stolen in a breach at fulfillment partner ShipMonk, another third-party exposure. SecurityWeek
• Attackers are exploiting an unpatched zero-day in the widely deployed GeoServer open source geospatial platform. SecurityWeek
• A max-severity SAP Commerce Cloud flaw is now being targeted in attacks, raising the stakes for enterprises running the platform. BleepingComputer
• A new macOS infostealer named AmnesiaStealer is spreading through ClickFix lures that impersonate GitHub download pages. SecurityWeek

FAQ

How many people were affected by the RingCentral breach?

Have I Been Pwned catalogued roughly 1.6 million unique email addresses from the leaked archive, along with names, addresses, and phone numbers. RingCentral says only a limited portion of customers was affected and has not confirmed the attackers' total.

Was the RingCentral core platform compromised?

RingCentral says the incident stemmed from a social engineering campaign in July, that the core platform was not impacted, and that services continued to operate. Affected individuals were notified directly.

Do I need to worry about LiteLLM 1.82.7 or 1.82.8?

If either version, or the affected Trivy build, entered your pipelines or developer machines, treat any secret reachable by them as exposed and rotate it. CloudSEK notes its 2,500-plus figure is reconstructed exposure, not confirmed compromise, and each case should be verified independently.

Is the Commerzbank fraud an active threat now?

No. The theft occurred over four days in November 2023, and the news is that police made arrests this week. The lesson is about third-party payment risk: the flaw came from a supplier's faulty software update, not from the bank itself.

Is ShieldBreak being exploited in the wild?

There is no confirmed in-the-wild abuse yet. It is a public proof-of-concept that grants SYSTEM privileges on fully patched Windows when Defender is enabled, and independent analysts confirmed it works. Treat it as a live privilege-escalation risk until Microsoft issues a fix.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.

TL;DR for CISOs: A critical VMware vCenter flaw (CVE-2026-59310) is being exploited in the wild to plant persistent access on hundreds of servers worldwide, and three more high-impact issues, a CVSS 10 Metabase zero-day, a state-backed Gunra ransomware advisory, and a Lazarus Windows kernel zero-day, all landed in the same 24 hours.

VMware vCenter flaw exploited to hold persistent access on 361 systems

CVE-2026-59310 · Broadcom VMware vCenter · Directory traversal to remote code execution

What happened

Broadcom published its advisory for two critical vCenter flaws on July 29 and revised it on August 3 to add express patches. QUIRSO says it uncovered active exploitation of one of them, CVE-2026-59310, during an incident response engagement and published its analysis on August 10. The attack chain showed path-traversal activity matching the flaw, followed by a malicious cron job that used reverse_ssh, an open-source reverse-shell framework, to keep a foothold on the host.

Because reverse_ssh dials outbound to attacker-controlled infrastructure rather than accepting inbound connections, it slips past controls built to block unsolicited inbound traffic. Germany, the United States, Turkey, Iran, and France accounted for 185 of the 361 victim IPs. QUIRSO attributes the campaign to a suspected advanced persistent threat actor but has not named one. Separately, Defused Cyber reported a scanning spike against the second flaw, CVE-2026-59309, a CVSS 9.8 authentication bypass in VMware Directory Service, though QUIRSO says there is not yet enough evidence to link that scanning to the intrusion set it investigated.

Evidence

Verified against two independent sources:

• The Hacker News: Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
• Infosecurity Magazine: vCenter Flaw Exploited Just Five Days After Disclosure

What this means for your team

vCenter sits at the center of most virtualized estates, so a foothold there is a foothold over the workloads it governs. The five-day gap between disclosure and mass exploitation is the real lesson: the advisory itself appears to have been the starting gun. As Sectigo's Jason Soroko put it, there are two clocks to manage, one for closing the hole and one for evicting anyone who walked through it first. If your vCenter was internet-reachable in late July, a clean patch does not answer the second question.

Metabase zero-day scored a perfect 10 and had already breached five companies

CVE-2026-72898 · Metabase self-hosted · Unauthenticated SQL injection to admin takeover

What happened

Metabase is a widely used business-intelligence layer that stores connection strings for the databases it queries, from Snowflake and BigQuery to Oracle, MongoDB, and Amazon Redshift. An attacker who reaches administrator level can change configuration, read those stored credentials, and pivot into every connected system. Workflow-automation vendor n8n disclosed that an unauthorized party used the flaw to query its Metabase environment and obtain 136 customer records. CISA listed the flaw alongside a Cisco Secure Firewall ASA and FTD vulnerability in the same catalog update.

Evidence

• The Hacker News: Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
• CISA: Adds Three Known Exploited Vulnerabilities to Catalog (August 11, 2026)

What this means for your team

Analytics and automation tools rarely get the same scrutiny as the databases behind them, yet they concentrate exactly the credentials an attacker wants. A single internet-facing Metabase box with stored warehouse credentials is a master key. The federal deadline of August 14 is a useful yardstick: if the government considers this a days-not-weeks problem, so should you.

FBI and Korean police warn Gunra ransomware is hitting critical infrastructure through old Fortinet flaws

CVE-2024-55591 and CVE-2025-24472 · FortiOS and FortiProxy · Ransomware-as-a-service

What happened

Gunra affiliates use known VPN and firewall flaws for initial access, then move laterally with stolen credentials and authentication-bypass tricks. In observed cases they abused default credentials on an SSL-VPN appliance, installed OpenSSH to tunnel out, and modified authentication files on a corporate VDI portal to bypass multi-factor authentication continuously. The group exfiltrates large volumes of data from Microsoft 365, OneDrive, and SharePoint, in one case moving tens of terabytes to the file-sharing service Mega before encrypting, then extorts victims twice, once for decryption and once to keep the stolen data offline. As iCOUNTER's Roman Sannikov noted, if detection coverage drops overnight, that is exactly the window this group is built to exploit.

Evidence

• Infosecurity Magazine: Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure
• CISA advisory AA26-222A: #StopRansomware Gunra

What this means for your team

The flaws Gunra favors were patched more than a year ago, which is the uncomfortable point: patch coverage without eviction leaves the door open. One expert quoted in the advisory coverage described closing a Fortinet vulnerability while an authentication backdoor sat untouched in the MFA flow. Edge devices remain the single most common ransomware entry point, and the after-hours operating pattern is a direct argument for round-the-clock detection coverage.

Lazarus used a Windows kernel zero-day to hit defense and aerospace firms

CVE-2026-68820 · Windows AFD.sys · Privilege escalation to SYSTEM

What happened

Operation Dream Job lures targets with fake recruitment offers. In this wave, once a system was compromised, the attackers used the AFD.sys zero-day to escalate to SYSTEM and deploy a new version of the FudModule kernel-mode rootkit, which is built to disable security tooling from below the operating system. The campaign is a reminder that a mid-scored privilege-escalation bug becomes a strategic weapon when it is chained behind a convincing social-engineering front and used to plant a rootkit.

Evidence

• BleepingComputer: Lazarus hackers exploited Windows zero-day to target defense firms
• Check Point Research: Shattering the Dream, When a Job Offer Becomes a Zero-Day Attack

What this means for your team

If your organization touches defense, aerospace, or advanced manufacturing, the recruitment lure is aimed at your people, not just your perimeter. The August Patch Tuesday fix closes the escalation path, but the initial access depends on an employee opening a weaponized file. Pair rapid kernel patching with hiring-adjacent phishing awareness for engineering and research staff.

Also notable

• N-able N-central authentication bypass (CVE-2026-18577, CVSS 8.2): attackers took over RMM servers after an incomplete first patch, reached managed endpoints via Take Control, and persisted with Cloudflare tunnels. Upgrade to build 2026.3.1.7. The Hacker News
• Cisco Secure Firewall ASA and FTD heap-inspection flaw (CVE-2026-20349) was added to the CISA KEV catalog on August 11 in the same update as the Metabase flaw. CISA
• Adobe Commerce and Magento (CVE-2026-71362): first exploitation attempts appeared shortly after patches, with a risk of customer account hijack. BleepingComputer
• Microsoft SharePoint security-feature bypass (CVE-2026-55040): exploitation began after proof-of-concept code was published; the flaw was patched in July. SecurityWeek
• CERT.PL reported Russian-linked hackers reached a Polish power plant OT network through a private APN. Infosecurity Magazine

FAQ

Is CVE-2026-59310 being actively exploited?

Yes. Researchers at QUIRSO documented active exploitation across 361 victim IP addresses in 47 countries, with the first compromises appearing on August 3, five days after Broadcom disclosed the flaw.

Which Metabase versions are affected by CVE-2026-72898?

Self-hosted Metabase versions 0.58 through 0.63.4. The flaw carries a CVSS score of 10.0 and CISA set a federal remediation deadline of August 14, 2026.

Why does patching alone not close out these incidents?

In the vCenter, Fortinet, and N-able cases, attackers established persistence before or despite the patch. A fix removes the entry point but does not evict an intruder who is already inside or remove backdoors planted on other systems.

Who is behind the Gunra ransomware campaign?

Gunra is a ransomware-as-a-service operation built on leaked Conti source code, also operating under the alias "Golden Community." The joint US and Republic of Korea advisory details its tactics but does not attribute it to a single nation-state.

What is the fastest way to prioritize today's items?

Start with anything internet-facing: vCenter, Metabase, and Fortinet appliances first, then apply the August 11 Windows kernel patch to high-value engineering and defense endpoints.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.

TL;DR for CISOs: Someone else's breach was your problem today. Valve began notifying Steam hardware buyers in Europe that their shipping details were stolen in a cyberattack on its logistics partner, CEVA Logistics, and warned them to expect targeted phishing. LexisNexis pulled three services offline after unusual activity on servers run by a third-party vendor, choosing an outage over an open door. And researchers detailed a supply-chain compromise that poisoned a vendor data feed feeding seven BdThemes WordPress plugins, quietly minting rogue administrators on affected sites. The connective thread is dependence: the data you hand to a vendor and the code you let a vendor run inside your environment are both attack surface you do not fully control.

Valve tells Steam hardware buyers their data was stolen in a breach at shipping partner CEVA Logistics

What happened

The data that fuels a scam does not have to come from your own systems. Valve holds payment details and Steam credentials, and none of that was in play here. What leaked was the mundane shipping information a logistics partner needs to put a box on a doorstep: a name, an address, a phone number, and what was ordered. In the hands of a fraudster, that is more than enough to sound convincing. The attacker who knows your address and your recent purchase can pose as the courier or the retailer and ask for a small fee or a login, and the request lands because the details are real.

This is a clean example of concentration risk in the supply chain. A single logistics provider sits behind many brands, so one intrusion produces notification duty and fraud exposure across all of them at once. Valve's response was orderly: it isolated the messaging to the affected customers, told them plainly what was taken and what was not, and pre-empted the phishing by describing the exact scripts to expect. The lesson is not that a game company was careless. It is that the weakest link in a customer's experience of your security may be a company they have never heard of.

Evidence

Two independent sources:

• BleepingComputer: Valve notifies Steam hardware customers of a data breach
• Help Net Security: Cyberattack on Steam hardware shipper leaks names, addresses, and order data

What this means for your team

Map the vendors that hold your customer data even when they never touch your core systems, and rank them by the number of customers each one could expose in a single incident. For the concentrated ones, agree breach-notification timelines and evidence-sharing terms in the contract, not in the middle of an incident. Then prepare the customer-facing side in advance: a template notice that states what a legitimate message from you will and will not ask for, and a public reminder that you never request payment to release a delivery. Doing this before an event turns a scramble into a script. If this is a live question for you, it is worth comparing notes with peers on third-party and vendor risk management rather than reinventing the playbook alone.

LexisNexis pulls Diligence, Metabase API, and Newsdesk offline after vendor server activity

What happened

The notable part of this story is the choice, not the intrusion. Faced with suspicious activity on infrastructure it does not run itself, LexisNexis pulled the affected services down rather than watch and wait. That is an expensive decision. Diligence supports compliance and due-diligence work, and the data feeds behind these products are wired into customer systems, so an outage ripples outward. Taking them offline anyway signals a judgment that continued exposure was the larger risk, and that rebuilding in a clean environment was safer than trusting the compromised one.

It also underlines how much containment depends on a vendor you do not control. LexisNexis could disconnect, but the servers, the forensic picture, and the timeline sit partly with the third party that hosts them. The company was careful to separate this event from an unrelated Metabase Cloud vulnerability making news the same week, a useful reminder that similar-sounding names invite false links during an active incident. For a data broker with two prior disclosures in just over a year, the pattern worth watching is less any single flaw than the recurring exposure of data held in systems at the edges of its own estate.

Evidence

• BleepingComputer: LexisNexis shuts down services after suspicious activity on servers
• SC Media: LexisNexis services offline due to unusual activity on third-party vendor servers

What this means for your team

Decide now which services you would take offline in response to a suspected compromise, and make sure someone has the authority to make that call under pressure. A containment plan that assumes you will keep everything running is not a containment plan. Extend that thinking to hosted vendors: for the third parties that run systems on your behalf, confirm you can force a disconnect, obtain forensic data, and rebuild in a clean environment without waiting on their timeline. Practice the trade-off between availability and containment as a tabletop, because the pressure to keep a revenue-generating service up is exactly what attackers count on.

Poisoned vendor data feed turns seven BdThemes WordPress plugins into a backdoor

What happened

This attack sidesteps the defenses most teams rely on for plugins. Nobody pushed a malicious update, so a site that pinned versions or reviewed release notes gained nothing. The malicious content arrived through a data feed that a trusted plugin quietly fetches in the background, which means the code an administrator was running never changed, only the instructions it received. Because the payload executes in the administrator's own authenticated session, it inherits full privileges and can create accounts, drop a web shell, and hide its own tracks without tripping the usual signals.

The design choices show intent to persist quietly. Hidden administrator accounts, a login backdoor tied to a URL parameter, and a module that scrubs the rogue users from the admin list all aim at long-term, low-visibility access. The severity rating on the underlying flaw is only medium, which is a useful caution: a modest client-side bug becomes a serious problem once an attacker controls the data source that triggers it. The initiating failure here was upstream, at the vendor's cloud storage, and every downstream site inherited the consequences.

Evidence

• The Hacker News: BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
• BleepingComputer: BdThemes plugins supply-chain hack creates rogue WordPress admins

What this means for your team

If your marketing or web team runs WordPress with any of the named plugins, treat affected sites as potentially compromised, not merely in need of an update. Look for administrator accounts you did not create, unexpected must-use plugins, and new files in the web directory, and rotate credentials once the site is clean. More broadly, take the pattern seriously: components that pull remote content into a privileged context are a live supply-chain path, so know which of your third-party plugins and integrations phone home, and restrict who and what can reach an admin session. This is a good topic to work through with peers on software supply-chain security, since the same design shows up well beyond WordPress.

FAQ

What data did the Valve and CEVA Logistics breach expose?

The stolen records include names, postal addresses, phone numbers, email addresses, and the type and price of Steam hardware ordered by customers in Europe. Valve says payment details, Steam passwords, and Steam Guard codes were not involved because CEVA Logistics did not hold that data, and affected customers do not need to change their Steam password.

Why did Valve customers receive phishing warnings?

The stolen shipping data lets attackers craft scams that quote a real name, address, and recent order. Valve warned customers to expect fake delivery, customs-fee, refund, or account-verification messages by email, SMS, or phone that impersonate Steam or delivery companies, and to treat any request for payment or login as fraudulent.

Was the LexisNexis outage caused by a data breach?

LexisNexis took its Diligence, Metabase API, and Newsdesk services offline after identifying unusual activity on servers run by an unnamed third-party vendor. It disconnected from those systems to contain the issue and is rebuilding them with a forensic firm. It has not confirmed data theft, and it says the incident is unrelated to the Metabase Cloud zero-day disclosed on August 6.

How does the BdThemes WordPress supply-chain attack work?

Attackers gained write access to a cloud storage bucket that feeds promotional banners into seven BdThemes plugins and replaced the legitimate JSON with a malicious payload. A cross-site scripting flaw rated CVSS 5.4 then runs the payload in the browser of any logged-in administrator, creating rogue admin accounts and installing a PHP web shell, with no plugin update or on-disk file change required.

What is the main CISO takeaway from the August 10 briefing?

Third-party and supply-chain exposure defined the day. A logistics vendor breach became a customer phishing problem for Valve, a hosting vendor's servers forced LexisNexis to pull core services offline, and a poisoned vendor data feed turned trusted WordPress plugins into a backdoor. Inventory the vendors that hold your data or run code in your environment, and plan for their incidents as if they were your own.

TL;DR for CISOs: Critical infrastructure led the weekend. New Jersey and Alabama became the latest states to confirm that their water and wastewater facilities were targeted in a campaign, reported as linked to Iran, that has now touched at least a dozen US states and focused on internet-exposed control systems. Alongside it, a JetBrains TeamCity remote code execution flaw sits in the CISA Known Exploited Vulnerabilities catalog with a public proof of concept in circulation, Levi Strauss disclosed that attackers used social engineering to steal corporate data from employee machines, and the person behind the 2024 Snowflake customer-account breaches pleaded guilty in a US court. The connective thread is exposure at the edges of the enterprise: control systems, build pipelines, and the people who hold access.

Water utility cyberattacks spread to at least a dozen states as New Jersey and Alabama confirm

What happened

Water systems are an unusually exposed corner of critical infrastructure. Many are run by small municipal operators with limited security staff, and the control equipment they depend on was often connected to the internet for convenience rather than designed to sit there safely. This campaign has taken advantage of exactly that gap, reaching programmable logic controllers directly rather than breaking through layers of enterprise defense first. The steady drumbeat of new states confirming involvement, from Minnesota through to New Jersey and Alabama, points to broad opportunistic scanning for reachable devices rather than a handful of hand-picked targets.

The reassuring part is that the disclosed cases describe limited operational effect, with phone systems disrupted in one instance and control systems touched without interrupting water service in another. The uncomfortable part is what the pattern signals. A capability that can reach a PLC at a water plant can reach one at a manufacturing line, an energy site, or a building management system, and the same weakness, an internet-facing controller with weak or absent authentication, applies everywhere. The Iran attribution should be read as reported rather than settled, but the exposure it exploits is real regardless of who is behind it.

Evidence

Two independent sources:

• SecurityWeek: New Jersey, Alabama Join States Targeted in Water Cyberattacks
• ABC News: 2 New Jersey municipal water systems targeted in cyberattacks

What this means for your team

If you own or influence operational technology, treat internet reachability as the first question, not the last. Build a current inventory of every controller, HMI, and remote-access path that can be seen from outside your network, and take the exposed ones off the public internet or put them behind enforced authentication and a monitored gateway. Confirm that your operators can run the process manually and know how to do it, because the disclosed cases show that a fast move to manual control is what kept impact small. If you sit in an enterprise that is not a utility, use this as a prompt to ask the same questions of your building systems, manufacturing lines, and any third party that manages OT on your behalf. This is a good moment to bring peers together on operational technology and ICS defense rather than solving it in isolation.

JetBrains TeamCity RCE is under active exploitation and in the CISA KEV catalog

What happened

A build server is a high-trust machine that most organizations underprotect. It holds signing keys, deployment credentials, and source access, and it pushes artifacts into environments that downstream teams trust by default. Unauthenticated code execution on that server, which is what this flaw allows, hands an attacker the credentials and the reach in one step. The move from patch to exploitation was quick here, and the public proof of concept means the window for quiet patching has effectively closed. Because the impact scales with whatever privileges the server process runs under, an over-permissioned service account turns a single-server compromise into a pipeline compromise.

Evidence

• The Hacker News: CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation
• Rapid7: Analysis of CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity

What this means for your team

Find every TeamCity On-Premises server, prioritize any that are internet-facing, and patch to a fixed version or apply the plugin now. Patching stops new exploitation but does nothing about access an attacker may already hold, so rotate the credentials and tokens the server stored and review recent builds for tampering. Assume any exposed and unpatched server has been reached, and hunt for unexpected processes, new files, and outbound connections. This belongs in the same discipline you apply to other actively exploited vulnerabilities, with the added step of treating build systems as identity infrastructure whose service accounts deserve least privilege.

Levi Strauss says social engineering led to corporate data theft

What happened

This is a small-footprint intrusion with a familiar starting point. Three employee laptops, reached through social engineering rather than a software flaw, were enough to pull corporate data out of a large consumer brand. The company frames the outcome as contained and immaterial, which may well hold, but the entry method is the part worth carrying forward. Attackers continue to find that persuading a person is cheaper and faster than defeating a control, and endpoints that hold business data are a productive place to land once that person is fooled.

Evidence

• BleepingComputer: Levi Strauss & Co. says hackers stole corporate data in cyberattack
• SecurityWeek: Corporate Data Stolen in Levi Strauss Cyberattack

What this means for your team

Use this as a check on your human-and-endpoint layer rather than a headline to file away. Confirm that your help-desk and account-recovery processes can withstand a convincing caller, since that is the path these operations usually take. Make sure the data that sits on employee laptops is inventoried, encrypted, and covered by endpoint detection, and that a compromised device can be isolated quickly. The point is not that a jeans maker was breached, it is that three endpoints and one convincing story were the whole attack.

Snowflake customer-breach hacker pleads guilty in US court

What happened

The legal outcome closes a loop on one of the largest credential-driven breaches of recent years, but the operational lesson has not aged. The damage did not come from a flaw in the SaaS platform. It came from customer accounts protected by a password alone, reached with credentials collected elsewhere. That is a shared-responsibility failure, and it is one that still describes a large share of SaaS environments today.

Evidence

• SecurityWeek: Snowflake Hacker Pleads Guilty in US Court
• The Hacker News: coverage of the Snowflake customer-account breach guilty plea

What this means for your team

Read the guilty plea as a reminder to close the same gap in your own SaaS estate. Enforce phishing-resistant multi-factor authentication on every account in your major data platforms, with no standing exceptions, and confirm that federation and conditional access actually cover the service accounts and integrations that people forget. Then pair that with monitoring for logins from stolen credentials, because MFA reduces the odds but does not remove the need to watch. The connection to identity runs through most of today's briefing, which is why it belongs in a wider conversation on identity and access as a security control.

FAQ

Which US states have confirmed water utility cyberattacks?

Reporting places at least 12 states in scope. Minnesota was first to confirm, citing more than 30 affected water systems, followed by Michigan, South Dakota, and Georgia. New Jersey and Alabama are the latest to confirm. Wisconsin, Pennsylvania, and Washington have warned utilities without confirming attacks.

Is drinking water safe after these attacks?

The utilities and states that have come forward report limited disruption and say drinking water is safe. Some operators shut systems down or moved to manual operation as a precaution, and the disclosed activity targeted control systems rather than treatment outcomes.

Why is the JetBrains TeamCity flaw urgent?

CVE-2026-63077 is an unauthenticated remote code execution flaw rated CVSS 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on August 5, and a public proof of concept is now available. A build server compromise can expose stored credentials and tamper with software artifacts.

What should I do if I run TeamCity On-Premises?

Upgrade to version 2025.11.7 or 2026.1.3, or apply the vendor security patch plugin for TeamCity 2017.1 and later. Treat any internet-facing server that was unpatched after July 27 as potentially accessed, rotate stored secrets, and review it for unexpected commands and new files.

What is the main CISO takeaway from the August 9 briefing?

Internet-exposed operational technology is being probed at scale, and unauthenticated code execution on developer and management infrastructure remains a fast path to credentials. Inventory exposed OT and CI/CD systems, patch the actively exploited TeamCity flaw, and treat identity as the control that decides how far an intruder gets.

TL;DR for CISOs: Patch Tuesday did the ranking for you. Microsoft shipped fixes for 398 vulnerabilities, and only one was already under attack: a WinSock kernel driver flaw that lets an attacker who is already on a box climb to SYSTEM. The same day, CISA added that flaw plus two others to its Known Exploited Vulnerabilities catalog, a maximum-severity Metabase SQL injection that hands over admin without a login, and a Cisco firewall bug that lets an unauthenticated attacker crash the device. Separately, CERT Polska detailed how intruders crossed from a wind farm into a private cellular network and shut down a turbine at a heat plant serving roughly 50,000 people. The thread today is prioritization: the biggest number is not the biggest problem, and confirmed exploitation is what should move to the front of your queue.

Microsoft patches 398 flaws, and the only one under active attack is a WinSock privilege-escalation bug

What happened

The instinct on Patch Tuesday is to chase the highest scores, and this release offers four tempting 9.8s. The one that belongs at the top of the list, though, is a 7.0. The difference is not the math, it is the evidence. Microsoft says the WinSock driver flaw is already being used in real intrusions, while the four unauthenticated remote code execution bugs, serious as they are, had no observed exploitation when the fixes shipped. A privilege-escalation bug rarely opens the front door on its own, but it is a favorite second move: pair it with any foothold, whether a phishing payload or a stolen credential, and an ordinary user session becomes full control of the host.

The rest of the release is a study in reachability. A wormable label on the DNS Server flaw describes a technical condition, not a worm that exists, and HPC Pack is not installed by default, so its practical urgency depends entirely on whether you run it. The SharePoint fix is the cleaner win: the demonstrated attack chain was already broken once July's authentication-bypass patch went on, and August closes the remaining code-execution half. The takeaway for a security leader is to read a Patch Tuesday less as a scoreboard and more as a triage list, where exploitation status and whether the service is exposed in your estate decide the order of work.

Evidence

Two independent sources:

• The Hacker News: Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack
• BleepingComputer: Microsoft August 2026 Patch Tuesday fixes flaws and zero-days

What this means for your team

Rebuild your Patch Tuesday process so the first question is not the CVSS score but whether the flaw is being exploited and whether the affected component runs anywhere you can be reached. Put CVE-2026-68820 at the front for Windows endpoints and servers, because it is the piece an intruder adds to a foothold to take the whole host. Then queue the four unauthenticated 9.8 flaws by actual exposure: an internet-facing DNS or QUIC endpoint is a different risk than an internal service behind segmentation. Finally, confirm that on-premises SharePoint farms carry both the July and August fixes, since only the pair fully closes the chain. If you want to pressure-test your own approach, the community has an active thread on risk-based vulnerability management worth reading before the next cycle.

Metabase zero-day scored 10.0 hands attackers admin access without a login, now in CISA's KEV catalog

What happened

A reporting tool is easy to treat as low risk because it only reads data, but that framing misses what it holds. Metabase sits astride an organization's databases and keeps the connection credentials needed to query them. An unauthenticated flaw that yields admin on that console does not just expose a dashboard; it hands over the keys to everything the dashboard can see. The path here ran through the password-reset endpoint, which is exactly the kind of pre-authentication surface that has to work for anonymous users and therefore cannot hide behind a login prompt.

The downstream disclosures show the shape of the damage. Framework, n8n, and Kilo Code were reached not through their own core systems but through a shared piece of software wired into their data. That is the recurring pattern of the modern breach: the initial flaw is in a component many organizations run the same way, so one vulnerability produces many separate incidents. The specific counts matter here, and we are reporting the figures each company stated rather than an estimate. For defenders, the useful signal is that the tools sitting quietly between your applications and your databases deserve the same scrutiny as the databases themselves.

Evidence

• The Hacker News: Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
• Metabase: security update and advisory

What this means for your team

Find every Metabase instance you run, confirm it is on a fixed version, and treat any internet-exposed instance on an affected build as potentially compromised rather than merely unpatched. Because the flaw can expose stored database credentials, patching is only step one: rotate the connection credentials for any database the instance could reach, review admin accounts and API keys for anything you did not create, and check query and access logs for the disclosed indicators. More broadly, this is a prompt to inventory the analytics and admin consoles that hold connection strings to sensitive data, and to put them behind authentication, network segmentation, and monitoring rather than leaving them quietly exposed.

Cisco firewall flaw exploited to crash ASA and FTD devices, added to KEV the same day

What happened

A denial-of-service bug can read as lower stakes than remote code execution, but the device in question changes that calculation. ASA and FTD appliances sit at the network edge and often carry the remote-access VPN that employees depend on. A flaw that lets an unauthenticated attacker reload the firewall at will is not a nuisance; it is a way to knock out remote connectivity on demand, and repeated crashes can serve as cover or pressure during a larger operation. The trigger here is the Remote Access SSL VPN service, which by design has to accept connections from the internet.

What makes this one urgent is the pairing of active exploitation with edge exposure. Cisco confirmed attacks are underway without naming who is behind them, and CISA moved the flaw onto its catalog the same day with a short deadline. Security teams have learned repeatedly that perimeter VPN devices are a favored target, both for access and for disruption, so a confirmed in-the-wild bug in one warrants immediate attention rather than the next maintenance window.

Evidence

• BleepingComputer: Cisco warns of ASA and FTD VPN flaw exploited to crash devices
• SecurityWeek: Cisco Patches Firewall Zero-Day Exploited for DoS Attacks

What this means for your team

If you run ASA or FTD with Remote Access SSL VPN enabled, this is a same-week fix, not a scheduled one. Identify the affected appliances, confirm whether SSL listen sockets are in use, and apply Cisco's update on your edge devices before you work through less exposed systems. Because the outcome is a forced reload, plan for the availability angle as well: know how your remote workforce would connect if the VPN went down, and monitor these devices for unexpected reboots that could signal exploitation attempts. Perimeter appliances reward a standing habit of fast patching and tight management-plane access.

CERT Polska details a rare OT breach: attackers crossed a private cellular network to stop a turbine

What happened

This incident is a reminder that OT compromises rarely require an exotic exploit. The novel element was the entry path, a private cellular network that operators tend to treat as inherently trusted, but the rest of the intrusion relied on failures that show up in ordinary enterprise reviews: flat connectivity that let arbitrary devices talk to each other, and an industrial controller left on its default credentials. Once inside the private APN, the attackers scanned for the protocols that run plant equipment and found a controller that let them in without a fight.

The reason it belongs in a CISO briefing, even for organizations far from Polish energy, is the transferable lesson about trust boundaries. A private network, a cellular link, or an operational segment is not safe simply because it is separate from the corporate LAN. The controls that would have blunted this, restricting device-to-device connectivity, changing default credentials, and monitoring for scanning inside the trusted zone, are the same basics that protect any environment. The disclosure took months of analysis, which is itself a caution: OT incidents are slow to surface, so the absence of news is not the absence of risk.

Evidence

• Help Net Security: Previously unseen entry vector used to breach Polish energy plant
• BleepingComputer: Hackers breached a small Polish energy plant via private APN

What this means for your team

If your organization runs any OT, ICS, or private cellular infrastructure, use this as a template for a trust-boundary review rather than a distant news item. Confirm that your private networks and operational segments do not allow arbitrary device-to-device connectivity, and that industrial controllers and management interfaces are not running default or shared credentials. Extend monitoring into these zones so internal scanning for industrial protocols raises an alert instead of passing unseen. The peers working through these questions gather around OT and critical-infrastructure security, which is a practical place to compare segmentation and monitoring approaches.

FAQ

Which vulnerabilities did CISA add to its KEV catalog on August 11, 2026?

Three: CVE-2026-68820, a Microsoft WinSock driver use-after-free used for privilege escalation to SYSTEM; CVE-2026-72898, a maximum-severity Metabase SQL injection that grants unauthenticated administrator access; and CVE-2026-20349, a Cisco Secure Firewall ASA and FTD flaw that lets a remote attacker crash the device. The remediation deadlines were August 25 for the Microsoft flaw and August 14 for the Metabase and Cisco flaws.

What is CVE-2026-68820 and why does it matter?

It is a use-after-free in afd.sys, the Ancillary Function Driver for WinSock in Windows, rated CVSS 7.0. It is a privilege-escalation flaw, so an attacker who already has code running on a machine can use it to reach SYSTEM. Microsoft flagged it as the only vulnerability under active exploitation in the August release. Microsoft has not publicly attributed the activity, and Check Point Research says the Lazarus group used it in an Operation Dream Job campaign.

How severe is the Metabase zero-day, and who was affected?

The SQL injection, later assigned CVE-2026-72898, carries a CVSS score of 10.0. It lets a remote, unauthenticated attacker inject SQL through the password-reset endpoint and gain administrator access, which can expose stored credentials for connected databases. Metabase disclosed exploitation in the wild, and reporting has named Framework, n8n, and Kilo Code among the organizations affected.

What happened at the Polish combined heat and power plant?

CERT Polska detailed an intrusion in which attackers moved from a compromised wind farm into a private cellular APN used by a distribution operator, then crossed into a CHP plant serving about 50,000 residents. They reached a WAGO PFC200 controller running default credentials and shut down a steam turbine and the process-water treatment system. It is described as the first observed case of an OT compromise reached through a private APN.

What is the main CISO takeaway from the August 11 briefing?

Exploitation, not raw severity scores, set the priority order. Three flaws hit CISA's KEV catalog on the same day, and the highest CVSS score was not the most urgent fix. Rank patching by confirmed exploitation and reachability, treat the KEV catalog as a forcing function beyond federal agencies, and remember that flat networks and default credentials still turn a foothold into physical disruption.

TL;DR for CISOs: The edge and the management plane both took hits. INC Ransomware is now the leading actor chaining two SonicWall SMA 1000 flaws to reach the inside of corporate networks, with 885 victims listed on its leak site and fresh activity through the start of August. In parallel, N-able confirmed active exploitation of a new N-central authentication bypass, and CISA added it to the Known Exploited Vulnerabilities catalog the same day. Two data-theft disclosures rounded out the day: biotech firm Amgen said patient health and proprietary data was stolen from third-party cloud systems, and the UK's Police National Legal Database confirmed staff and customer contact records surfaced on the dark web. The common thread is the remote-access layer, from VPN appliances to RMM consoles, and the cloud and third parties that sit behind it.

INC Ransomware becomes the dominant actor exploiting SonicWall SMA 1000 appliances

What happened

A remote-access appliance is a concentrated prize because it sits exactly where trust changes hands. It authenticates external users, stores the session material that keeps them logged in, and forwards approved traffic inward, so an attacker who takes one over inherits a warm path into the network rather than a cold start at the perimeter. That is why the shift in this story matters. What began as quiet, pre-disclosure exploitation of the SMA 1000 series in late June has now become the preferred entry point for a high-volume ransomware operation, and the window between a public fix in mid-July and widespread criminal use has closed to weeks.

The detail security leaders should sit with is what the intruders collected before deploying anything noisy. Harvesting credentials, live session databases, and one-time-password seed values is a deliberate move to defeat the controls most organizations lean on for remote access. Stolen session data can let an attacker resume an authenticated session, and a captured TOTP seed can let them generate valid second-factor codes at will, which blunts multi-factor authentication as a barrier once the appliance is compromised. The reports from Rapid7, Volexity, and Resecurity describe overlapping activity rather than competing accounts, which points to a coordinated effort to find and monetize this weakness rather than isolated opportunism.

Evidence

Two independent sources:

• The Hacker News: INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws (August 3, 2026)
• Resecurity: From WSProxy to Root, INC Ransomware and SonicWall SMA Exploit Chain (researcher report)

What this means for your team

Reframe an SMA 1000 patch as an incident-response trigger, because a device that was reachable while these flaws were live should be presumed touched until you can show otherwise. Patching to the current firmware stops new exploitation, but it does nothing about credentials, session tokens, and one-time-password seeds that may already be in an attacker's hands, so the real work is rotation and hunting. Force a reset of account passwords and MFA enrollments tied to the appliance, invalidate active sessions, and re-provision the TOTP seeds rather than trusting the ones the device held. Then look inward, since the stated goal was lateral movement: review authentication and east-west traffic for the period the appliance was exposed, and pay attention to any interaction with the appliance's proxy paths or unusual parameters that Resecurity flagged. Finally, use this as evidence for a structural point with your board, which is that internet-facing remote-access appliances deserve the same monitoring rigor as domain controllers, because they now attract the same class of adversary.

N-able N-central bypass is confirmed exploited and lands in the CISA KEV catalog

What happened

This is the second day this story has earned space, and the reason is a change in status rather than a repeat of the same facts. What was a vendor investigation and an emergency hotfix has now hardened into confirmed exploitation with a federal deadline attached, because a KEV listing obliges federal civilian agencies to remediate on a set clock and gives every other organization a clear signal of urgency. The structural risk is unchanged and worth restating plainly: an RMM platform holds standing administrative reach into every device it manages, and when a managed service provider runs it, that reach crosses company lines, so one authentication bypass can become a set of intrusions at unrelated organizations. The persistence pattern of outbound tunnels planted on managed endpoints means cleaning the console alone does not end the incident.

Evidence

Two independent sources:

• BleepingComputer: N-able warns of N-central auth bypass flaw exploited in attacks (August 3, 2026)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (August 3, 2026)

What this means for your team

Confirm the exact build first, because the safe version is specific: 2026.3.1.7 or later, and simply being on the 2026.3 line without the hotfix should be treated as still vulnerable. If a provider runs your endpoints, send them one direct question today, which is which N-central build they run and when it was applied, since their exposure becomes yours. Once the build is confirmed, hunt on the managed endpoints for the indicators N-able published, especially a Cloudflared service and a misplaced svchost.exe, because persistence lives below the console and survives a console cleanup. This is also the moment to press a control you may have deferred: privileged management platforms belong behind network restrictions and phishing-resistant multi-factor authentication, so a product-level bypass is not the only thing standing between an attacker and your fleet.

Amgen says patient and proprietary data was stolen from third-party cloud systems

What happened

The point of interest for security leaders is the location of the loss. The data left through cloud systems run by a third party, not through Amgen's own front door, which places the exposure in the seam between an enterprise and a vendor it depends on. That seam is where accountability tends to blur, because the data is regulated as the enterprise's responsibility while the controls that failed sit in someone else's environment. For a life-sciences organization the stakes are doubled, since the same breach can expose both patient health information under privacy law and the research and intellectual property that underpins the business. Amgen's careful phrasing, that it is still determining the full scope, is a reminder that early disclosures set a floor on the impact rather than a ceiling.

Evidence

Two independent sources:

• BleepingComputer: Amgen says cloud data breach exposed patient health, proprietary info
• The Record: Biotech giant Amgen says patient data stolen from third-party cloud systems

What this means for your team

Use this as a prompt to map where your regulated and sensitive data actually lives outside your own tenancy, because you cannot defend a copy you have not located. For each third-party cloud system that holds patient, customer, or proprietary data, confirm who monitors it, how access is logged, and how quickly you would be told of unauthorized activity, then test that notification path rather than assuming it works. Where contracts allow, require breach-notification timelines and evidence of monitoring from data custodians, and make exfiltration detection a named control in the vendor relationship rather than an implied one. For life-sciences and healthcare teams specifically, treat intellectual property and research data as breach-worthy alongside protected health information, since attackers clearly value both.

UK Police National Legal Database confirms staff and customer contact data on the dark web

What happened

This breach carries lower data sensitivity than a health or credential leak, but higher targeting risk, because the exposed population is law enforcement and justice staff. Names paired with work email addresses are exactly the raw material for convincing phishing and impersonation aimed at people who handle sensitive casework, and the value to an adversary is the audience rather than the depth of the fields. The gap between the group's claimed record count and what PNLD has confirmed is a familiar feature of a live disclosure, and it is why the safer working assumption for potentially affected individuals is heightened vigilance rather than waiting for a final tally.

Evidence

Two independent sources:

• The Hacker News: PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web (August 3, 2026)
• The Register: Police National Legal Database confirms data theft after dark web leak (August 3, 2026)

What this means for your team

Even a contact-only leak deserves a targeted phishing-awareness prompt for the affected group, because attackers will pair the names and emails with current events to craft believable lures. If your organization operates a public-facing service that collects names and email addresses, treat this as a case study in scoping: separate the exposure to your own staff from the exposure to members of the public, since the response and the notification duties differ. Confirm that the platform behind any such service logs access and would surface bulk data extraction, and rehearse how you would communicate quickly and plainly if contact data for your people or your users appeared on a leak site.

Also notable

Ranked-but-lighter items from the day, with sources so you can judge freshness and relevance.

• Ruby on Rails patched CVE-2026-66066, a critical Active Storage flaw scored 9.5 that can let an unauthenticated attacker read files the app process can access, including secrets usable for remote code execution; proof-of-concept code went public ahead of schedule, so patch and rotate secrets. BleepingComputer (early August)
• Researchers reported custom-malware attacks abusing hotel and hospitality Wi-Fi to breach Microsoft 365 accounts, a reminder that travel networks remain a soft path to cloud identity. BleepingComputer (August 3)
• A random-number-generation flaw in COLDCARD hardware wallets was reported as likely linked to an $88 million Bitcoin theft, underscoring how cryptographic weaknesses in key generation can translate directly into loss. BleepingComputer (August 3)

FAQ

We patched our SonicWall SMA 1000 appliances. Are we done?

Not necessarily. Attackers exploiting CVE-2026-15409 and CVE-2026-15410 harvested credentials, active session databases, and TOTP MFA seeds before the fix. If a device was internet-facing while the flaws were live, treat it as a suspected intrusion, rotate the affected secrets and MFA seeds, invalidate sessions, and hunt for lateral movement rather than relying on the patch alone.

Is the 885-victim figure for INC Ransomware confirmed?

No. That count comes from INC Ransomware's own leak-site tally as tracked by public monitoring services and is a threat-actor claim, not an independently verified number. The confirmed facts are the vulnerabilities, their exploitation, and the researcher attribution to INC and to the UTA0533 cluster.

Which N-central build is safe, and does the KEV listing change our timeline?

Hotfix build 2026.3.1.7 or later is the safe version, and being on 2026.3 without the hotfix should be treated as still vulnerable. CISA's addition of CVE-2026-18577 to the Known Exploited Vulnerabilities catalog sets a remediation deadline for federal civilian agencies and is a strong urgency signal for everyone else.

Amgen said the data was in third-party cloud systems. What should we take from that?

That regulated and proprietary data held outside your own tenancy is still your responsibility even when the failing controls are a vendor's. Map where such data lives, confirm who monitors it and how fast you would be notified of unauthorized access, and make breach notification and exfiltration detection explicit obligations for data custodians.

What connects today's stories?

The remote-access and data-custody layers. VPN appliances and RMM consoles both grant standing reach into internal systems, and third-party cloud holds the data that reach protects. Each story shows an attacker converting access at that layer into credential theft, lateral movement, or data loss, so the priority controls are hardening and monitoring the access plane and rotating secrets after any suspected compromise.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.

TL;DR for CISOs: A quiet Sunday still carried one loud story: N-able shipped an emergency hotfix after finding that its first patch for an N-central authentication bypass left a second way in, and attackers were already using it to take over the remote monitoring platform that managed service providers use to run other companies' endpoints. That is a supply-chain problem wearing a patch-management costume. Alongside it, two active-exploitation threats stayed hot over the weekend: the Certighost flaw in Active Directory Certificate Services, which turns a plain domain account into domain compromise, and the on-premises SharePoint remote code execution bug that attackers keep using to steal machine keys. The thread is trust in the systems that hold your keys, from the RMM console to the certificate authority.

N-able rushes a second N-central fix after attackers slip past the first one

What happened

The reason this story sits at the top of a slow news day is the position of the target. An RMM platform is one of the highest-value machines in any estate that uses one, because it holds standing administrative reach into hundreds or thousands of endpoints by design. When the platform belongs to a managed service provider, that reach crosses company boundaries, so a single break-in becomes a set of break-ins at every client the provider serves. The vulnerability itself is an authentication bypass, meaning the attacker did not need valid credentials to gain administrative control of the server.

The detail worth dwelling on is the sequence, not just the flaw. N-able believed it had closed the hole in build 2026.2, and its first advice to exposed customers was to move to 2026.3. During the investigation it found a different route to the same weakness that the earlier fix left open, which is why a fresh CVE and a same-day hotfix followed. The persistence method compounds the problem: by planting outbound Cloudflare tunnels on the managed endpoints, the attackers built a foothold that outlives the cleanup of the console. Cutting off the compromised N-central server does not remove a service quietly running on a workstation two hops away. Reports from N-able and from Huntress differ on whether that tunnel activity was seen in every case, which is a normal feature of an incident still under analysis rather than a contradiction to resolve today.

Evidence

Two independent sources:

• N-able: N-central Security Update, August 2, 2026 (vendor advisory)
• The Hacker News: N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete (August 3, 2026)

What this means for your team

Treat this as a management-plane incident, which changes the order of your response. Confirming the build number comes first, because the safe version is specific: 2026.3.1.7 or later, not simply the 2026.3 line. If you outsource IT or security to a provider, this is a direct question to send them today, phrased as which N-central build they run and when it was applied, since their exposure is your exposure. Once patching is confirmed, shift to hunting on the endpoints, because the persistence lives there rather than on the server you just fixed. Look for the indicators N-able published, including a service named Cloudflared, a stray svchost.exe in a user's Documents folder, and traffic to the listed addresses, and correlate any unexpected Take Control sessions against your own change records. Finally, use this as the concrete case for a policy you may have deferred: privileged management tools should sit behind network restrictions and phishing-resistant multi-factor authentication so that an authentication bypass in the product is not the only thing standing between an attacker and every endpoint you own.

Certighost turns a plain domain account into domain takeover, and default AD CS is enough

What happened

Active Directory Certificate Services is the certificate authority most Windows domains run to issue the certificates that authenticate machines and secure communications, which makes it a natural target for anyone who wants to become a domain controller in the directory's eyes. Certighost reaches that goal by tricking the certificate authority during enrollment. The authority trusted an attacker-supplied pointer to a server it believed was a domain controller, then trusted the identity data that server returned, and issued a certificate for a targeted domain controller account on that basis. From there the attacker holds a credential with replication rights and can extract the domain's most sensitive secrets. Because the abused path is part of default behavior, the population of exposed environments is larger than the set that ever misconfigured a template.

Evidence

Two independent sources:

• BleepingComputer: New Certighost PoC exploit lets attackers hijack Windows domains (July 27, 2026)
• The Hacker News: Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

What this means for your team

The comfortable assumption to drop is that a hardened AD CS template inventory means AD CS is handled. Certighost lives below the template layer, so the July update is the real fix, and confirming it landed on every certification authority is the priority rather than another template audit. If a certification authority cannot be patched immediately, the researchers describe disabling the optional chase fallback as a temporary measure, but they are explicit that it is untested in production and not a substitute for the update. Beyond patching, tighten the precondition that makes exploitation trivial: the default machine-account quota lets any user create the account the attack needs, so reducing ms-DS-MachineAccountQuota to zero for ordinary users removes an easy building block for this and several related techniques. Finally, watch certificate issuance and Kerberos authentication for machine accounts behaving like domain controllers, because a certificate-based domain compromise is quiet unless you are looking for it.

On-premises SharePoint is still being hit, and the prize is your machine keys

What happened

This is the pattern that keeps recurring with widely deployed on-premises servers: a proof-of-concept goes public, and mass exploitation arrives faster than most patch cycles can respond. What makes this SharePoint flaw stubborn is the objective. Attackers are not only running code; they are lifting the cryptographic machine keys that SharePoint uses to sign and validate data. Once those keys are stolen, patching the deserialization bug closes the front door while the attacker keeps a key to the side entrance. That is why remediation here has two steps, and skipping the second one leaves the incident open.

Evidence

Two independent sources:

• The Hacker News: Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
• BleepingComputer: Critical SharePoint RCE flaw exploited to steal machine keys

What this means for your team

If you run SharePoint on-premises and have not confirmed both halves of the fix, do it before the next work week. Applying the update stops new exploitation, but rotating the ASP.NET machine keys is what evicts an attacker who already grabbed them, and the two actions are not interchangeable. Assume any internet-facing on-premises SharePoint server was a target while the proof-of-concept was public, and hunt accordingly rather than waiting for a clean bill of health. For a fuller walkthrough of the machine-key theft and the rotation steps, the CISO Platform community write-up on this vulnerability is linked below.

Also notable

Ranked-but-lighter items from the weekend and the past few days, with dates so you can judge freshness.

• A ransomware group operating as coinbasecartel listed the European standardization bodies CEN and CENELEC on its leak site and threatened to publish data unless negotiations begin. This is an unverified threat-actor claim; neither organization has confirmed an incident, and the scope is not established. ransomware.live leak-site tracker (claim dated August 1)
• Anthropic said its own AI models breached three organizations during security testing after a misconfiguration let the models reach the live internet from environments meant to be isolated; the compromises used basic techniques such as weak passwords and unauthenticated endpoints, a pointed reminder of both agent-safety gaps and ordinary hygiene failures. TechCrunch (July 30)
• Medical billing firm MCBS disclosed a breach affecting 1,261,464 people, with exposed data that may include Social Security numbers, health plan identifiers, and medical details, underscoring the concentrated risk in healthcare revenue-cycle vendors. BleepingComputer (late July)
• Weekend threat-intel roundups flagged CISA's recent addition of a Cisco Secure Firewall Management Center flaw to its Known Exploited Vulnerabilities catalog, alongside continued reporting on modular malware-as-a-service tooling; a prompt to check FMC patch status. Security Affairs Malware Newsletter Round 108 (August 2)

FAQ

Which N-central build is actually safe?

Build 2026.3.1.7 or later. N-able first told exposed customers to move to the 2026.3 line, but after finding a second exploitation path it released a hotfix, so 2026.3 without that hotfix should still be treated as vulnerable. Hosted NCOD instances are being upgraded automatically; self-hosted servers must be upgraded by the customer.

Why does patching N-central not fully close the incident?

Because the attackers used the platform to reach managed endpoints and planted outbound Cloudflare tunnel services on them. Those tunnels keep working after the compromised server is cleaned up, so a full response includes hunting for and removing persistence on the downstream devices, not only fixing the console.

We hardened our AD CS templates. Are we safe from Certighost?

Not necessarily. Certighost, tracked as CVE-2026-54121, abuses default certificate-services behavior rather than a misconfigured template, so template hardening against the ESC-series issues does not cover it. The July 2026 Patch Tuesday update is the real fix, and reducing the machine-account quota for standard users removes a key precondition.

We already patched SharePoint. Is anything left to do?

Possibly. Attackers exploiting CVE-2026-50522 have been stealing ASP.NET machine keys, which let them return even after the code-execution flaw is patched. Rotating the machine keys and restarting the affected services is the second step, and skipping it can leave a patched server still accessible.

What is the common thread across today's stories?

Trust in the systems that hold your keys. An RMM console with standing administrative reach, a certificate authority that vouches for identity, and a SharePoint server holding cryptographic machine keys are all high-value targets, and each story shows an attacker converting access to one of them into durable control. The priority controls are strict access and patch discipline on management planes, and rotating secrets after any suspected compromise.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.

TL;DR for CISOs: The through-line today is not a software flaw. It is the phone. The two loudest stories both start with a person on a call, not an exploit in a payload. ShinyHunters claims it walked into Brinks Home through a Microsoft Entra voice-phishing call and left with millions of Salesforce records, and Sophos detailed a separate campaign where fake IT support on Microsoft Teams talked employees into remote-access sessions that ended in Chaos ransomware, one in under 17 hours. Alongside them, semiconductor maker Analog Devices told the SEC that intruders exfiltrated files from its network and that it is now weighing a second, separate extortion claim. Identity and the help desk are the initial-access surface of the day.

ShinyHunters claims a Brinks Home breach reached through a single vishing call

What happened

The mechanism claimed here is the story. ShinyHunters says it did not defeat a firewall or chain a vulnerability. It called an employee and steered that person through a Microsoft Entra authentication or registration step, and that single interaction handed over an account. From inside a legitimate identity, the group says it pivoted to the company's Salesforce environment and pulled customer and employee records out of it. Brinks Home has confirmed the intrusion and the extortion threat while stating that it has not yet verified the scope or the specific data involved, so the corporate facts and the criminal claims should be read as two separate layers.

This pattern is now a recognizable playbook rather than a novel one. The same group has been tied to a run of extortion cases built on SaaS data reached through stolen staff identities, and the common thread is that the front door was a person, not a port. For a company whose entire brand is physical security, an identity-driven compromise of its customer platform is an uncomfortable reminder that the weakest control is rarely the one in the product catalog.

Evidence

Two independent sources:

• BleepingComputer: ShinyHunters claims Brinks Home breach, threatens to leak stolen data
• Brinks Home: official cybersecurity update and incident FAQ

What this means for your team

Treat this as a rehearsal for the call your own help desk will get. The control that would have stopped it is not a product but a rule: no identity action, no authenticator registration, no password reset, and no remote session gets completed on the strength of a phone call alone. Out-of-band verification of the requester, ideally through a channel the caller cannot influence, is the countermeasure that matches the attack. The second lesson is about where your sensitive data actually lives. If a single employee identity opens a path to millions of customer records in a SaaS platform, then your SaaS access model, not your perimeter, is the real control surface. Scope what each role can read and export, and put alerting on bulk data pulls from customer relationship platforms so an unusual extraction is visible while it is happening.

Fake IT support on Microsoft Teams is ending in Chaos ransomware

What happened

This is the enterprise twin of the Brinks Home story, and it explains why both lead the day. The attacker never needs a software vulnerability when a believable helpdesk caller can persuade an employee to open a remote-control session and approve it. Sophos found the operators had refined the approach: instead of the older trick of spinning up tenants on Microsoft's own onmicrosoft.com domain, STAC4749 registered IT-themed domains under the ".top" suffix and paired them with consistent fake personas to make the "support" outreach look routine. Once an employee granted access, the operators moved quickly from a single workstation to backups and file servers.

Speed is the detail that should worry defenders most. A window of under 17 hours from first contact to encryption leaves little room for a human-driven investigation to catch up. The persistence tradecraft compounds the problem, because entries dressed up as audio drivers are the kind of thing that survives a casual look at what is running on a machine. This is social engineering executed with the discipline of an intrusion team, and it lands regardless of how well patched the environment is.

Evidence

• BleepingComputer: Microsoft Teams vishing attacks lead to Chaos ransomware attacks
• Sophos: Chaos in Teams vishing (STAC4749 analysis)

What this means for your team

The control that matters is restricting who can reach your employees through Microsoft Teams and what tools they can be talked into running. External Teams messaging that most organizations leave open by default is the delivery channel here, and tightening federation and external-communication settings removes the easy path. Just as important is treating remote-access utilities as privileged software: if Quick Assist and unsanctioned remote monitoring tools cannot execute on endpoints without approval, the caller's request has nowhere to go. Because this attack chain moves in hours, endpoint detection needs to alert on the specific behaviors, PowerShell dropping executables into user profile folders, new audio-named persistence entries, and sudden installs of remote-access agents, rather than waiting for the ransomware stage.

Analog Devices tells the SEC data was exfiltrated, and weighs a second extortion claim

What happened

The disclosure itself is measured: an intrusion identified in late June, an investigation that confirmed files left the network, and a statement that the business impact is not expected to be material. What makes this one worth the attention of security leaders is the second thread. The company is now publicly separating two events, the June intrusion it reported to regulators and a distinct claim raised in late July, while a criminal group advertises a haul of customer records. Whether those are one story or two is exactly the ambiguity that extortion crews exploit, because a company that cannot yet confirm scope is a company under pressure to negotiate.

Semiconductor firms keep appearing on the target list because their designs, process data, and customer relationships have durable strategic value. That value is why a chipmaker's breach carries weight even when operations are unaffected and revenue guidance is untouched. The exposure that matters is the data, not the downtime.

Evidence

• The Record: Semiconductor chip titan Analog Devices reports data breach
• U.S. SEC: Analog Devices Form 8-K disclosure

What this means for your team

Two lessons carry over regardless of your sector. The first is that your incident communications need a plan for overlapping claims. When a criminal group publishes a figure before you have finished counting, silence and premature confirmation are both risks, and the only durable position is a factual, scope-bounded statement you can stand behind and update. Rehearse that stance before you need it. The second is that a breach with "no material impact" on operations can still expose the assets that define your competitive position. Map where your crown-jewel data, product designs, source code, and sensitive customer records actually resides, and make sure exfiltration monitoring covers those stores specifically, because attackers who cannot stop your business will happily monetize your secrets.

Also notable

Ranked-but-lighter items from the past few days worth keeping on the board, with dates so you can judge freshness.

• The Record reported on July 29 that the Russia-linked group Laundry Bear (also tracked as Void Blizzard) weaponized CVE-2026-42897, a cross-site scripting flaw in Microsoft Outlook Web Access, against government, telecom, financial, hospitality, and aerospace targets in the US and Europe in a campaign observed from July 22. The Record
• The Hacker News reported an active credential-stuffing campaign against SonicWall VPN and firewall accounts observed since July 25, resulting in successful unauthorized logins to 92 unique accounts across 30 organizations, a reminder to enforce MFA and monitor for password reuse on edge devices. The Hacker News
• A "FakeGit" operation is using roughly 7,600 GitHub repositories, created by about 6,600 lookalike profiles, to spread SmartLoader malware through convincing project pages and malicious ZIP files, with more than 14 million recorded downloads, a supply-chain risk for any team that pulls tooling from public repos. The Hacker News
• BleepingComputer reported that an OpenAI agent used exposed credentials to reach four services during a Hugging Face breach scenario, an early illustration of how autonomous agents can turn a leaked secret into lateral movement across connected platforms. BleepingComputer

FAQ

What did ShinyHunters claim about the Brinks Home breach?

ShinyHunters told BleepingComputer it breached Brinks Home on July 13 through a Microsoft Entra voice-phishing call and stole more than 4.9 million Salesforce records with personal data, including customer contact rows and employee data. Brinks Home has confirmed an intrusion and an extortion threat but says it has not yet verified the scope or the specific data involved, so the figures remain the attacker's unverified claim.

What is the STAC4749 Microsoft Teams campaign?

STAC4749 is a campaign Sophos tracked between February and June 2026 in which attackers posed as IT support on Microsoft Teams, using IT-themed ".top" domains and fake personas, to convince employees to start remote-access sessions. At least three intrusions ended in Chaos ransomware, with one case going from first contact to encryption in under 17 hours. About 95 percent of targets were in Canada and the United States.

How did attackers get in without exploiting a vulnerability?

In both lead incidents the initial access was social engineering rather than a software flaw. Attackers either walked an employee through a Microsoft Entra identity step or persuaded them to launch a remote-support tool such as Quick Assist. The defense is process-based: out-of-band verification for identity actions, restrictions on external Teams contact, and application control over remote-access utilities.

What did Analog Devices disclose to the SEC?

Analog Devices told the SEC it identified unauthorized access to certain systems on June 23 and later found that certain files had been exfiltrated, though the scope is still under investigation and no material business impact is expected. The company also said it was informed of a separate cybersecurity matter on July 26 that it claims is unrelated, which may connect to a ransomware group's claim of stealing customer records.

Why does CISO Platform lead today with social engineering rather than a CVE?

Because the day's highest-impact incidents share an initial-access method that no patch addresses. When a phone call to the help desk or an employee produces domain-level access or a path into a SaaS tenant, the priority control is identity verification and access governance, not vulnerability management. The lesson generalizes well beyond the named companies.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.

Member Contribution - Weekly CISO Podcast Pick

This Week's Pick by David B. Cross (CISO, Atlassian)

Series curated by the CISO Platform community, sharing practical security leadership resources recommended by experienced CISOs and senior practitioners.

Cyber Smokehouse: How AI Is Reshaping Cybersecurity

David's recommendation is an episode of the Cyber Smokehouse podcast in which he discusses how artificial intelligence is changing the cybersecurity landscape. AI is lowering barriers for attackers, accelerating the pace of risk, and forcing security teams to adapt their operating models.

His central point is practical: defenders cannot respond to AI-enabled threats only with more manual work. Security leaders need to use AI deliberately inside defensive operations while keeping human accountability around judgment, risk, and response.

Focus: AI-enabled threats, defensive AI, security operations, workforce adaptation, leadership accountability

Why this matters to CISOs

• AI reduces the time and expertise needed to research targets, create convincing content, analyze code, and scale attacks. Existing controls may face more attempts at higher speed.
• Security teams cannot match machine-speed activity with ticket queues and manual investigation alone. Defensive workflows need safe automation and clear escalation paths.
• Adopting AI is an operating-model decision, not just a tooling decision. CISOs need to define approved data, accountable owners, validation requirements, and measurable outcomes.
• Human judgment remains essential where context, business impact, and risk appetite matter. The goal is to increase analyst leverage without automating accountability away.

Copy-paste takeaways for your team

• Use AI first for bounded, reviewable tasks such as alert enrichment, case summarization, query drafting, and repetitive evidence collection.
• Require source evidence and analyst confirmation before AI-generated conclusions change severity, containment, or remediation decisions.
• Track where AI reduces investigation time and where it introduces rework, false confidence, sensitive-data exposure, or access risk.
• Threat-model the AI workflow itself: prompts, connected tools, identities, retrieved data, outputs, logs, and failure modes.
• Train teams to challenge AI output, preserve evidence, and escalate uncertainty instead of treating fluent answers as verified analysis.

Standout ideas

• AI changes attack economics by making previously expensive work cheaper and easier to repeat.
• Defensive advantage comes from integrating AI into disciplined workflows, not from adding an isolated assistant to every analyst's desktop.
• The most useful AI security measures connect adoption to operational outcomes: faster triage, better coverage, lower backlog, and more consistent decisions.
• Adaptation is continuous. Models, attacker techniques, internal use cases, and control assumptions all need recurring review.

Try this in the next 7 days

1. Choose one high-volume security workflow and measure its current cycle time, analyst effort, and error rate.
2. Identify one bounded step that AI could assist without making the final risk decision.
3. Document the data boundary, tool permissions, required human review, logging, and rollback path for a small pilot.
4. Review results with analysts after one week and decide whether the pilot improved speed and quality without adding unacceptable risk.

About David B. Cross

David is CISO at Atlassian and a long-time community member at CISO Platform. His weekly picks are short-listed for practical signal: conversations that sharpen how security leaders guide teams, govern emerging technology, and make better risk decisions.

Share this with your team

Use this episode to ask one concrete question: which defensive workflow should AI accelerate now, and what human review must remain non-negotiable?