Ransomware victimization remains heavily concentrated in mid-sized organizations with $10m-$1bn in revenue, keeping the mid-market in the crosshairs across North America and Europe. A study of 13,336 disclosed incidents found that 73% of attacks hit this revenue band, while total incident volume rose 44% between 2023 and 2025. Manufacturing accounted for 26% of mid-market victims, making it the most exposed sector in the dataset. The pattern aligns with persistent security-posture gaps, including known exploited vulnerabilities, patching weaknesses, and weak DMARC coverage.

Microsoft is facing a search disruption in Microsoft 365 apps that is preventing some users from finding content in SharePoint Online, OneDrive, Outlook on the web, and Outlook desktop. The issue is tracked as MO1456424 and stems from a recent deployment that caused a resource utilization inefficiency. Microsoft says it has developed and deployed a fix to reduce resource pressure and restore service.

The Solicitors Regulation Authority (SRA) issued a warning notice to solicitors and law firms on August 17, tightening expectations around AI hallucinations and client data handling in legal work. The notice raises compliance risk across the UK legal sector by warning that misuse of AI can create confidentiality, data protection, and court filing problems.

CISA added Ray's CVE-2025-62593 to the KEV catalog and told FCEB agencies to apply fixes and mitigations by August 20, 2026, escalating an actively exploited flaw into a federal remediation deadline. The issue can enable browser-based remote code execution through DNS rebinding in Firefox and Safari, putting exposed Ray deployments at risk. The fix is available in Ray 2.52.0, but unpatched systems remain vulnerable until the deadline is met.

CISA added CVE-2025-62593 in Ray to its KEV catalog after evidence of active exploitation, raising the risk of browser-based remote code execution for exposed deployments. The flaw can be triggered through DNS rebinding in Mozilla Firefox and Apple Safari, especially against Ray development and testing instances. A fixed release, Ray 2.52.0, is available, and FCEB agencies must apply mitigations by August 20, 2026.

GitLab released out-of-band security updates on August 17, 2026 for GitLab CE/EE to fix CVE-2026-19478, a critical GraphQL issue that could let an unauthenticated attacker remotely modify or delete public projects and user data. The same release also patched CVE-2026-19650 in the GraphQL multiplex query handler. GitLab.com and GitLab Dedicated were already patched. Self-managed installations need to move to 19.2.4, 19.1.6, 19.0.8, or 18.11.11.

A threat actor is selling alleged Microsoft Azure/Entra employee dumps from multiple major companies, creating immediate risk of spearphishing and tenant-account abuse. The posts, attributed to TheHatman, claim 3.64 million records dated from July 31 to August 16, 2026 across firms such as McDonald's, Tata Consultancy Services, Vodafone, IHG, and Kyndryl. The advertised samples reportedly include employee names, email addresses, phone numbers, postal addresses, service accounts, and other tenant records. Several named companies said they found no evidence of compromise, but the exposed data structure could still support targeted fraud and identity-based attacks.

CEVA Logistics suffered a server breach between July 29 and August 1, 2026, disrupting operations for retailers in Europe and causing shipping delays. The compromise also created downstream customer impact for fulfillment and delivery services tied to the logistics network.

Wiz disclosed a GitHub Actions workflow injection in Snowflake’s public snowflakedb/snowflake-connector-net repository that could let a crafted GitHub issue execute commands and expose internal Jira credentials. The vulnerable automation sat in .github/workflows/jira_issue.yml and was confined to the repository’s CI/CD workflow. Snowflake merged a fix on June 23, 2026, and no affected connector release was identified. As of August 17, 2026, no CVE, CVSS, or CISA KEV entry had been identified.

More than 40,000 WordPress sites are exposed to CVE-2026-15826 in User Profile Builder, an authentication bypass that can let unauthenticated attackers obtain an administrator session on affected configurations.

CVE-2026-15748 affects Forminator Forms for WordPress, exposing more than 600,000 active installations to unauthenticated arbitrary file upload and potential remote code execution. The flaw can lead to complete site compromise on susceptible sites that meet the plugin’s form-field preconditions. Version 1.56.2 addresses the issue, and sites running 1.56.1 or earlier are affected.

The HOLLOWGRAPH malware now uses Microsoft 365 calendar events and the Microsoft Graph API as a covert channel for command reception and file exfiltration, increasing the risk of hidden activity inside compromised mailboxes. It also uses DNS tunneling to refresh credentials for C2 communication, making the implant harder to disrupt. The module was first detected in the wild on June 7, 2026, and its calendar-based dead-drop can hide tasking behind future-dated events.

The GitHub outage is degrading website, API, Actions, and Pull Requests access for some users, interrupting developer workflows and automated delivery. The disruption is also affecting SAML/OIDC authentication, SCIM, Team Sync, and some repository downloads. GitHub said it was seeing about 20% error rates across web and API traffic, with download errors reaching roughly 50%. The cause has not been disclosed and the investigation is still ongoing.

Cozmoslabs released User Profile Builder 3.16.5 to fix CVE-2026-15826, an authentication bypass affecting more than 40,000 WordPress sites. The patch closes a flaw in versions up to and including 3.16.4 that could let unauthenticated attackers reach an administrator session on vulnerable configurations. Site owners should update to 3.16.5 or later to remove the exposure.

Researchers published a CWE-1189 privilege-escalation flaw in Unisoc modem firmware that can elevate modem-level access to full Android kernel control through a VoLTE video call. The issue affects shared firmware across at least T606, T612, and T7250 chipsets used in devices such as the Motorola E13, Realme C33, and Xiaomi Redmi A5. No CVE had been assigned and no patch or vendor mitigation was available at publication. The chain requires attacker-controlled private 4G infrastructure and a victim who answers the incoming call.

The French Ministry of the Economy and Finance disclosed a DGFiP data breach after an attacker claimed access and put stolen data up for sale, exposing records for 678,000 individuals and professionals. The claimed leak included tax, cadastral, and business data, while the ministry said online accounts and user IDs/passwords were not compromised. The attacker used the ZeroBytes handle and posted the sale claim on PwnForums on August 12, 2026.

The General Directorate of Public Finances (DGFiP) disclosed a data breach after an attacker accessed its systems and stole information on 678,000 individuals and professionals. The ministry said sensitive systems were shut down during the investigation, while online accounts and user IDs/passwords were not compromised.

DGFiP in France suffered unauthorized access that was later paired with a public sale claim from ZeroBytes on PwnForums and a claimed reach into the Serveur Professionnel de Données Cadastrales (SPDC) environment. French authorities subsequently confirmed that the access points had been used to consult and extract tax and cadastral data concerning 678,000 individuals and professionals. The exposed information included tax, business, and property-related data, while the government said online accounts, user IDs, and passwords were not compromised. Access to sensitive information systems was shut down, CNIL was notified, and ANSSI is assisting the impact assessment while affected individuals are prepared for notification.

Evooo1Bot is a new modular Linux botnet that Fortinet says has been active since July 2026 and uses Mirai-derived code to compromise internet-facing edge devices. It combines encrypted C2 over port 443, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal against multiple known CVEs. The malware’s loader activity points to 91.92.40[.]118/wget.sh, and successful infections can turn affected devices into SOCKS5 proxies for relaying traffic and follow-on operations.

CVE-2026-59310 is a critical 9.8 directory-traversal flaw in Broadcom VMware vCenter that allows arbitrary code execution. QUIRSO attributed active exploitation of the newly patched vulnerability to a suspected China-nexus APT, with activity beginning five days after public disclosure and affecting 361 unique victim IP addresses across 47 countries. The intrusion used cron-abused payloads, the linuxFile WebSocket backdoor, and masqueraded VMware-style account creation to gain root execution on vCenter systems. The same reporting also observed activity consistent with CVE-2026-59309 on one compromised appliance, and the campaign ended with Babuk-derived ransomware that encrypts files with the .babyk extension.

Threat intelligence researchers recorded a 7.4 million-device infostealer surge in H1 2026, and the activity drove theft of 1.7 billion credentials. Vidar, StealC, and Lumma were the most prolific variants in the period. The shift turned infostealers into a high-volume credential-harvesting pipeline that increases downstream account-abuse risk.

SafePal disclosed a data breach that exposed customer order information for 39,798 customers after an authorization flaw in a plug-in order-tracking function. The affected orders were placed between March 2, 2025 and April 11, 2026, and the stolen records included names, email and shipping addresses, phone numbers, and purchase details. SafePal said the incident did not expose seed phrases, private keys, wallet credentials, or funds, but it warned customers about phishing attempts and said it had removed over 30 fraudulent websites and phishing links tied to the breach.

SafePal disclosed a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and the stolen dataset is now being offered for sale. Exposed records included names, email addresses, shipping addresses, phone numbers, and purchase information from orders placed between March 2, 2025, and April 11, 2026. The exposure increases targeted phishing and social-engineering risk, while SafePal says wallet seed phrases, private keys, passwords, and funds were not compromised.

SafePal's order-tracking plug-in had an authorization flaw that was actively exploited to expose customer order information for about 39,798 customers. The weakness let an unauthorized user access another customer's order details and became the route used to steal order data. SafePal says it fixed the vulnerability and added additional security measures during the July 2026 review of its order-processing system. The affected information included order-related personal details that could support targeted phishing and other social-engineering attacks.

Anthropic's Claude services are in a major outage, blocking some users from signing in and degrading performance across Claude.ai, Claude Code, and Claude Cowork. The disruption also affects platform.claude.com and can leave requests incomplete or fail to load. The outage began at 21:58 UTC on August 16, 2026, and the cause remains under investigation.

A ClickFix campaign is distributing AmnesiaStealer to macOS users through a counterfeit GitHub "Download for macOS" page and a copy-and-paste command that launches a malicious loader. Jamf said the Rust-based infostealer harvests credentials, browser data, Apple Notes, Telegram, Safari, and iCloud Keychain content, and uses a root LaunchDaemon that impersonates Apple's crash reporting service for persistence. The newer analysis adds stream_module and remote_stream, which copy a victim’s Chromium profile into a hidden headless browser and let the operator drive authenticated sessions through WebSocket and Chrome DevTools Protocol channels on Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium.

SAP Commerce Cloud CVE-2026-58231 is under active exploitation attempts after SAP released a fix for the flaw in the core Data Hub Adapter extension. The 10.0 CVSS vulnerability involves insufficient authorization checks and input validation and can let an unauthenticated attacker abuse a default authentication client to reach arbitrary code execution. Defused said exploitation attempts began hitting its honeypot systems three days after the patch was released, and Onapsis advised customers to patch to the fixed Commerce Cloud release levels and use an IP Filter Set as a temporary mitigation.

Apple released fixes for CVE-2026-65400 in macOS Tahoe 26.6.1 and related releases, closing a Screen Sharing authentication bypass that could let network attackers connect without valid credentials. The update reduces exposure on systems that expose TCP port 5900 and is especially urgent because the flaw is being actively abused in the wild. Administrators should install the patched macOS versions and disable Screen Sharing if it is not needed.

CVE-2026-65400 in macOS Screen Sharing is being actively exploited on systems with TCP port 5900 exposed to the internet, allowing network attackers to bypass authentication and reach the desktop without credentials. Reported intrusions escalated to root access and Monero mining on exposed systems. Apple fixed the flaw on August 6 and released patched macOS versions, while defenders are being urged to update or disable Screen Sharing if it is not needed.

The Sable Squirrel campaign is using expired domains, social platforms, and a traffic distribution system (TDS) to redirect users in Vietnam, South Korea, Japan, Taiwan, Singapore, and Australia to illicit sports streaming and betting sites, widening the operation’s reach across multiple markets. The actor has spent nearly $7 million on the domain portfolio and controls more than 10,000 domains to keep the traffic pipeline moving. The same infrastructure is also tied to malware command-and-control (C2), increasing the risk that users and scanners encounter both fraud and malware services. Many of the repurposed domains are weaponized quickly, often within two weeks of re-registration.