Find notable cyber news and cases, enriched with sources, timelines, and signals.

Recent notable Happenings and Cases

Hide ▲
Last updated: 20:04 21/08/2026 UTC
  • Vulnerability H score 49 Microsoft Entra ID actively exploited deserialization RCE (CVE-2026-69836) Microsoft reports CVE-2026-69836, a CVSS 10.0 Microsoft Entra ID deserialization RCE actively exploited in the wild, with claims of full mitigation that reduce urgency for customers but confirm real attacker capability.
  • Vulnerability H score 40 Zimbra Collaboration Suite actively exploited command injection RCE (CVE-2026-73570) CERT Polska warns that Zimbra Collaboration Suite CVE-2026-73570 is being actively exploited, with Shadowserver tracking 12,100+ exposed servers—advancing the threat from theoretical to live scanning risk.
  • Public Sector Action H score 37 CISA KEV patch directive for TrueConf Server flaws CISA added TrueConf Server CVE-2026-72529 and CVE-2026-72530 to KEV and ordered FCEB agencies to patch within two weeks, tightening response timelines for vulnerabilities linked to unauthenticated script/remote code execution.
  • Vulnerability H score 73 Gogs path traversal to Git hooks RCE (CVE-2026-52813) Gogs fixed CVE-2026-52813, a maximum-severity path traversal that can enable remote code execution via Git hook overwrite, advancing exploitation risk from disclosure to a concrete patch in version 0.14.3.
  • Data Leak H score 70 SickKids employee and applicant data exposure SickKids disclosed exposure of employee, foundation, and job applicant personal data stemming from a third-party software flaw and offered 24 months of monitoring, increasing identity-theft and social-engineering exposure in the immediate aftermath.
  • Data Leak H score 39 AWS access keys publicly exposed and still valid Researchers say 9,300+ publicly exposed AWS access keys remain active and valid, advancing the incident from past exposure to ongoing cloud account takeover and persistence risk.
Last updated: 08:06 21/08/2026 UTC

Latest updates

Browse →

MarlboroMan ecosystem shift changes threat-actor operations

Threat Actor Meta

Updated: 21.08.2026 21:53 · First: 21.08.2026 21:53 · 📰 1 src / 1 articles · H score: 32

MarlboroMan publicly marketed RedC2 4.0 as a cross-platform C2 framework, widening access to evasion-focused intrusion tooling across Windows, macOS, and Linux. The offering packages surveillance, credential theft, payload loading, and mass-operation functions into a purchasable underground product. Its Red Agent layer adds LLM-driven command execution, reducing operator effort and increasing task speed. The result is a more commercialized and scalable offensive-tool ecosystem.

Trojanized npm packages deliver RedC2 4.0 Linux implant

Malware Activity

Updated: 21.08.2026 21:53 · First: 21.08.2026 21:53 · 📰 1 src / 1 articles · H score: 31

Trojanized npm packages are now delivering the RedC2 4.0 Linux implant through a supply-chain execution path, turning a routine package import into remote malware deployment. The payload runs as soon as the module loads, so a single transitive dependency can trigger compromise without any install hook or user action. The package set also supports credential theft, persistence, discovery, and command-and-control tasking. The activity expands the reach of an AI-assisted C2 framework across Windows, Linux, and macOS.

SynkLoader Microsoft Teams help-desk phishing campaign

Campaign

Updated: 21.08.2026 21:01 · First: 21.08.2026 21:01 · 📰 1 src / 1 articles · H score: 35

The SynkLoader campaign is using Microsoft Teams help-desk impersonation and a fake PowerShell Cleaner MSI to push victims into a credential-theft chain that can open corporate environments from infected devices. The malware was first compiled and distributed around July 28, 2026, and it combines fake login prompts with access modules for reverse proxying, remote shell, and VNC control. The operation is aimed at corporate users and is designed to collect passwords, expand internal access, and support follow-on intrusion activity. The module mix and Active Directory profiling suggest a campaign built for deeper post-compromise operations, not just a single credential grab.

SynkLoader malware distribution via Microsoft Teams phishing

Malware Activity

Updated: 21.08.2026 21:01 · First: 21.08.2026 21:01 · 📰 1 src / 1 articles · H score: 26

The SynkLoader malware family is being pushed through Microsoft Teams phishing to steal credentials with a fake Windows lock screen, giving attackers remote access and internal-network reach on infected devices.

AWS access keys publicly exposed and still valid

Data Leak

Updated: 21.08.2026 18:55 · First: 21.08.2026 18:55 · 📰 1 src / 1 articles · H score: 39

More than 9,300 AWS access keys exposed in public sources between August 2022 and August 2026 remained active and valid, creating a live risk of cloud account takeover. The exposed set included company-linked keys, AWS root keys, and AdministratorAccess credentials. Working keys could let attackers access data, change infrastructure, create persistent admin access, or deploy cryptominers.

Microsoft Defender BTR.sys reverse engineering shows a signed boot-time driver can be used for kernel-level file and registry operations

Technical Analysis

Updated: 21.08.2026 18:52 · First: 21.08.2026 18:52 · 📰 1 src / 1 articles · H score: 27

BTR.sys has been shown to function as a kernel-level file and registry operation primitive on Windows 7 through Windows 11 25H2, creating a new hardening and detection problem for Microsoft Defender deployments. The proof-of-concept BTR_CLI pulls the embedded driver from MpEngine.dll and submits a valid encrypted transaction to trigger boot-time operations. The technique does not require a software flaw or an external driver, but it does require administrator access and SeLoadDriverPrivilege. Researchers reported no evidence of real-world abuse and published Sysmon and Windows event patterns for defenders.

DoFun Android head unit malware spread through built-in updaters

Malware Activity

Updated: 21.08.2026 18:41 · First: 21.08.2026 18:41 · 📰 1 src / 1 articles · H score: 29

A new Android head-unit malware spread through built-in updaters on DoFun firmware, enabling ad fraud, unwanted ads, and proxy botnet activity on infected devices. The infection chain uses the legitimate TWCore update path and JarService to install a hidden payload. The malware checks in to C2 every 90 minutes and can fetch additional modules such as zhima. The activity was tied with high confidence to MoYu Group and the broader BADBOX ecosystem.

MoYu Group campaign expands across multiple victims

Campaign

Updated: 21.08.2026 18:41 · First: 21.08.2026 18:41 · 📰 1 src / 1 articles · H score: 38

The BADBOX infection campaign is still active, with MoYu Group-linked actors using abused update channels to spread malware to devices worldwide and support ad fraud plus a proxy botnet. The operation turns legitimate firmware update paths on DoFun Android head units into a delivery channel. The result is continued device compromise despite takedown efforts.

Microsoft Windows 11 gaming disruption after KB5121003

Service Disruption

Updated: 21.08.2026 17:54 · First: 21.08.2026 17:54 · 📰 1 src / 1 articles · H score: 0

The Windows 11 gaming disruption is causing crashes, launch failures, freezes, and restarts on affected PCs, and Microsoft is investigating the problem. The issue affects Windows 11 24H2 and 25H2 systems after KB5121003 and later updates. Early findings point to RGB lighting devices whose drivers or components may trigger the breakage when certain games start. Embark Studios has shared a temporary inpoutx64.sys workaround while Microsoft works on an official fix.

Arrayref maintainer account hit by network compromise

Incident

Updated: 20.08.2026 20:53 · First: 20.08.2026 20:53 · 📰 3 src / 3 articles · H score: 33

The arrayref maintainer account was compromised, and malicious crate releases on crates.io executed during compilation on developers’ systems, creating a supply-chain intrusion risk. The same account also poisoned append-only-vec and internment within a 23-minute window, widening exposure across widely used Rust packages. The fake dependency proc-macro1 used a `build.rs` script and platform-specific payloads to run on Linux, Windows, and macOS systems. The payload was built to collect host data and browser credentials, making the compromise a direct theft and persistence risk for developers.

CISA KEV patch directive for TrueConf Server flaws

Public Sector Action

Updated: 21.08.2026 15:25 · First: 21.08.2026 15:25 · 📰 1 src / 1 articles · H score: 37

CISA added CVE-2026-72529 and CVE-2026-72530 to its KEV catalog and ordered FCEB agencies to secure TrueConf Server within two weeks, forcing rapid federal response to actively exploited vulnerabilities. The affected product is a self-hosted secure messaging and video-conferencing platform that runs inside an organization's LAN, so exposure can reach internal networks. The directive addresses flaws that can enable unauthenticated script execution and remote code execution.

Agent Tesla v4 infostealer with emoji obfuscation and BEC delivery

Malware Activity

Updated: 21.08.2026 15:00 · First: 21.08.2026 15:00 · 📰 1 src / 1 articles · H score: 29

The Agent Tesla v4 infostealer is now being delivered through a BEC lure that targets finance departments and can steal credentials from more than 40 applications. The sample adds Unicode emoji obfuscation, ConfuserEx, and DonutLoader injection to make detection harder. It also exfiltrates stolen data to attacker-controlled infrastructure within seconds, increasing the chance of rapid account compromise.

FTP-banner dead-drop resolver malware delivery campaign

Campaign

Updated: 21.08.2026 14:00 · First: 21.08.2026 14:00 · 📰 1 src / 1 articles · H score: 39

A campaign is using FTP banners as dead-drop resolvers to deliver E4del and PINHOLE, creating a new command-delivery path that can bypass standard web-service monitoring. The operation has been weaponized since early July 2026 and was still active with new infrastructure seen in August 2026. It starts with ZIP archives that trigger a .LNK infection chain, and researchers assess phishing as the likely initial access route. The payloads provide remote access, screen capture, file transfer, and credential-theft capabilities.

E4del and PINHOLE Windows RAT activity via FTP-banner dead-drop resolvers

Malware Activity

Updated: 21.08.2026 14:00 · First: 21.08.2026 14:00 · 📰 1 src / 1 articles · H score: 29

New Windows RAT activity has been identified using FTP banners as dead-drop resolvers to deliver E4del and PINHOLE, increasing risk from remote command execution, screenshot capture, and credential theft. The activity has been operational since early July 2026 and remained active into August 2026, showing that the delivery method is still in use. The infection chain relies on .LNK-based execution and likely phishing to start the compromise. The two malware families use different C2 and execution paths, but both aim to establish durable remote access on victim systems.

SickKids employee and applicant data exposure

Data Leak

Updated: 21.08.2026 13:10 · First: 21.08.2026 13:10 · 📰 1 src / 1 articles · H score: 70

A SickKids cybersecurity incident exposed personal information for current and former employees, Boomerang and SickKids Foundation staff, and job applicants, creating identity-theft and social-engineering risk. The hospital says the exposure came from a third-party software flaw and that clinical systems and patient records were untouched. The public Careers website was temporarily taken offline and later restored. Individuals identified as affected will be notified directly, and SickKids is offering 24 months of credit monitoring and identity protection.

Defense contractors' CMMC confidence rises while proof of compliance lags

Trend

Updated: 21.08.2026 11:41 · First: 21.08.2026 11:41 · 📰 1 src / 1 articles · H score: 25

Across the defense industrial base, defense contractors are becoming more confident in CMMC/SPRS compliance even as their ability to prove it remains weak, widening a verification gap that affects procurement and legal exposure. A recent survey of 273 contractors found 96% confidence in self-attested scores but only 29% with the evidence needed to back them up. A second survey showed the same pattern over a longer horizon, with SPRS scores improving while confidence in their accuracy fell.

GitLab CE/EE security update for CVE-2026-19478 and CVE-2026-19650

Security Patch Release

Updated: 18.08.2026 00:03 · First: 18.08.2026 00:03 · 📰 2 src / 3 articles · H score: 31

GitLab released out-of-band security updates on August 17, 2026 for GitLab CE/EE to fix CVE-2026-19478, a critical GraphQL issue that could let an unauthenticated attacker remotely modify or delete public projects and user data. The same release also patched CVE-2026-19650 in the GraphQL multiplex query handler. GitLab.com and GitLab Dedicated were already patched. Self-managed installations need to move to 19.2.4, 19.1.6, 19.0.8, or 18.11.11.

Microsoft Entra ID actively exploited deserialization RCE (CVE-2026-69836)

Vulnerability

Updated: 21.08.2026 09:06 · First: 21.08.2026 09:06 · 📰 2 src / 2 articles · H score: 49

Microsoft Entra ID is facing CVE-2026-69836, a CVSS 10.0 remote-code-execution flaw that was exploited in the wild. The bug affects Microsoft’s cloud identity and access management service and stems from deserialization of untrusted data that can let an attacker execute code over a network. Microsoft says the issue has already been fully mitigated, so no customer action is required.

Tyler Robert Buchanan guilty plea in Scattered Spider crypto-theft case

Law Enforcement

Updated: 20.04.2026 16:33 · First: 20.04.2026 16:33 · 📰 2 src / 2 articles · H score: 26

Tyler Robert Buchanan pleaded guilty in the United States in a Scattered Spider cybercrime case, increasing his criminal exposure for wire fraud and aggravated identity theft. The plea resolves part of a scheme prosecutors say used SMS phishing and SIM swapping to steal cryptocurrency and hijack victims' accounts.

Scattered Spider 2022 SMS phishing campaign targeting technology companies

Campaign

Updated: 21.04.2026 17:53 · First: 21.04.2026 17:53 · 📰 1 src / 1 articles · H score: 29

Tyler Robert Buchanan’s guilty plea newly confirms Scattered Spider’s 2022 SMS phishing campaign, showing it reached at least a dozen major technology companies and enabled downstream cryptocurrency theft. The operation matters because it paired text-message social engineering with credential theft and later SIM-swapping abuse.

UNC7005 (Storm-2945) targeted OAuth and WhatsApp phishing campaign

Campaign

Updated: 20.08.2026 22:59 · First: 20.08.2026 22:59 · 📰 1 src / 1 articles · H score: 16

A UNC7005 (Storm-2945) campaign is hijacking accounts with OAuth, WhatsApp linking, and device-code phishing across academia, diplomatic, nonprofit, and European defense targets. The operation is actively stealing tokens and steering victims through legitimate login flows to make takeover attempts harder to spot. Between August 6 and August 13, 2026, the group sent targeted phishing emails to people in or related to the European defense industry. The activity spans Ukraine, Western Europe, and the U.S. and is designed for repeated account access rather than a single one-off lure.

Proc-macro1 malicious crate payload

Malware Activity

Updated: 20.08.2026 20:53 · First: 20.08.2026 20:53 · 📰 1 src / 1 articles · H score: 29

A proc-macro1 typosquatted dependency executed a build-time payload during compilation, creating a credential-stealing risk for developers on Linux, Windows, and macOS. The payload reconstructed its infrastructure from base64-encoded fragments and chose host-matched code for each platform. It then targeted browser secrets from Chrome, Brave, and Edge while establishing persistence on the endpoint.

Gogs path traversal to Git hooks RCE (CVE-2026-52813)

Vulnerability

Updated: 20.08.2026 20:23 · First: 20.08.2026 20:23 · 📰 1 src / 1 articles · H score: 73

Gogs fixed CVE-2026-52813, a maximum-severity flaw that could lead to remote code execution through Git hooks. The bug accepted organization names containing ../ path traversal sequences, letting attackers write repository data to unintended filesystem locations and overwrite hooks configuration. The issue was addressed in version 0.14.3.

ErrTraffic and Cruciferra ClickFix BYOVD malware activity

Malware Activity

Updated: 20.08.2026 20:23 · First: 20.08.2026 20:23 · 📰 1 src / 1 articles · H score: 72

The ErrTraffic framework is now being used to deliver Cruciferra through ClickFix lures, adding a BYOVD escalation path that can terminate security processes. The activity routes victims from compromised WordPress sites through an obfuscated JavaScript loader before fetching the next stage from a Polygon smart contract. Recent uses of the framework have also pushed Remus Stealer, Vidar Stealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader. The chain broadens the malware's reach and makes the delivery path harder to inspect.

DoJ charges Mabna Institute members and State Department offers reward

Law Enforcement

Updated: 20.08.2026 20:23 · First: 20.08.2026 20:23 · 📰 1 src / 1 articles · H score: 70

The U.S. Department of Justice charged 17 Mabna Institute members in a cyberintrusion case, and the U.S. Department of State announced a $10 million reward tied to the investigation.

Zimbra Collaboration Suite actively exploited command injection RCE (CVE-2026-73570)

Vulnerability

Updated: 20.08.2026 12:46 · First: 20.08.2026 12:46 · 📰 3 src / 3 articles · H score: 40

CVE-2026-73570 in Zimbra Collaboration Suite (ZCS) is now actively exploited, giving attackers unauthenticated remote code execution against exposed servers. The flaw is a command injection issue in the SNMP monitoring component when SNMP notifications are enabled. Zimbra 10.1.20 was released on July 20 to patch the vulnerability, and exposed deployments remain a live target.

Elementor Pro Forms File Upload unauthenticated upload RCE (CVE-2026-32475)

Vulnerability

Updated: 20.08.2026 09:04 · First: 20.08.2026 09:04 · 📰 2 src / 2 articles · H score: 24

CVE-2026-32475 in Elementor Pro lets an unauthenticated attacker bypass file-upload validation in the Forms module's File Upload field, write a PHP file into a public directory, and reach remote code execution on affected WordPress sites. The flaw affects plugin versions prior to and including 4.2.1 on sites that expose a published Elementor page with the vulnerable form field. Version 4.2.2 was released on 2026-08-19 to address the issue.

Elementor Pro 4.2.2 security update for CVE-2026-32475

Security Patch Release

Updated: 20.08.2026 09:04 · First: 20.08.2026 09:04 · 📰 2 src / 2 articles · H score: 27

Elementor Pro released version 4.2.2 to fix CVE-2026-32475, closing an unauthenticated file-upload RCE path in the WordPress plugin. The update targets the Forms module's File Upload field and removes a flaw that could let an attacker write a PHP file into a public directory. Sites still running 4.2.1 or earlier need the patch to eliminate the exposed code-execution path.

Encrypted prompt injection in xAI's Grok web chat exfiltrates session context

Technical Analysis

Updated: 20.08.2026 17:36 · First: 20.08.2026 17:36 · 📰 1 src / 1 articles · H score: 22

Researchers disclosed Cryptographic Context Injection, an encrypted prompt-injection technique that can make xAI's Grok web chat leak private session data through an outbound tool call. The chain can expose a user's name, approximate location, subscription tier, and ongoing conversation prompts to an attacker-controlled server. The payload hides behind PBKDF2 and AES-256-GCM, so the malicious instructions are recovered inside the model runtime rather than being seen as ordinary page text.

JFrog security patch release for CVE-2026-69106

Security Patch Release

Updated: 20.08.2026 17:30 · First: 20.08.2026 17:30 · 📰 1 src / 1 articles · H score: 30

JFrog has issued fixes for JFrog Artifactory after disclosure of CVE-2026-69106 and CVE-2026-65922, two flaws that could let anonymous or low-privileged users manipulate package metadata and create software supply chain compromise risk. The issues affect JFrog Artifactory deployments handling repository metadata, including paths that can be poisoned or trusted improperly. Administrators should move to the patched release and reduce exposure of anonymous access where it is not required.