Framework confirmed a customer data leak after attackers compromised its Metabase instance, exposing personal and business records tied to customers. The stolen data included full names, email addresses, login IP addresses, billing and shipping addresses, phone numbers, and company names. The exposure raises risk of phishing, account targeting, and identity abuse for affected customers.

A Metabase unauthenticated SQL injection zero-day put Metabase Cloud and self-hosted installations at risk of administrator takeover, credential theft, and data export. The flaw affected versions 1.58 and above and was confirmed actively exploited before disclosure on Aug. 7, 2026. Metabase said it blocked the attack endpoints and rolled out a fix for the vulnerability. Organizations running exposed self-hosted installs were told to upgrade immediately or temporarily block `/api/session/reset_password` while applying the patch.

Unlimited Technology Systems disclosed a data breach that exposed personal information for 3,803,750 people after an unauthorized actor accessed files in its commercial data center. The intrusion is tied to activity between October 5 and October 10, 2025, and the company later confirmed the exposure in July 2026. The breach involved sensitive patient data handled for healthcare providers, increasing identity-theft and privacy risk. The company said no ransomware or data-extortion group has publicly claimed responsibility.

The WEL1DROPPER malware chain is delivering RAT and infostealer payloads through nearly 800 malicious npm packages, expanding cross-platform risk for Windows, macOS, and Linux systems. The packages use a README-driven require() path to trigger the loader, which fingerprints the host and retrieves a matching payload from Cloudflare Workers or fallback wel1[.]ru domains. On Windows, the final stage includes ETW/AMSI patching, sandbox checks, and persistence via a Registry Run key and scheduled task. On Linux, the chain can deploy Sliver, an open-source C2 framework, showing the loader is part of a broader malicious distribution operation.

A new npm supply-chain campaign has published nearly 800 malicious packages to push RAT and infostealer payloads onto Windows, Mac, and Linux systems. The packages use a README-driven require() path instead of the more common lifecycle-hook trigger, which helps the delivery blend into normal developer workflows. The operation is tracked as Flooding Dropper and appears to extend a prior Moika package-publishing pattern. The malware chain uses Cloudflare Workers, wel1[.]ru DNS TXT delivery, and platform-specific payloads to reach infected hosts.

A Go-based macOS stealer delivered through ClickFix-style attacks is stealing browser passwords, Apple iCloud Keychain data, and cached credentials while also siphoning cryptocurrency from infected wallets. The malware's DRAIN routine increases financial risk for macOS users by redirecting wallet contents to attacker-controlled accounts.

Levi Strauss & Co. disclosed a social-engineering breach that let attackers access and exfiltrate corporate data from three employees’ company-issued computers. The company said its rapid response contained and terminated the unauthorized access and that no consumer data was impacted. Levi’s also said it has seen no operational disruption from the incident.

A Rust-based clipboard hijacker was observed swapping copied cryptocurrency wallet addresses with attacker-controlled destinations, putting payment workflows across 21 blockchain types at risk. The malware used Binance Smart Chain for command-and-control resolution through EtherHiding. A victim could still see a normal-looking transaction even though the destination had already been changed locally before signing.

A banking-malware campaign used compromised corporate mailboxes to reach users in Czechia, Slovakia, Poland and Lithuania, pushing the attack into victims' banking sessions. The messages looked like routine shipment, invoice and scanned-document emails, which helped the lure blend into normal business traffic. The attachment launched JavaScript, then PowerShell, then shellcode, before the malware altered proxy settings and installed a browser add-on. The chain showed how a trusted account can deliver the first stage of an operation while later steps reshape the browser session used for banking.

WordPress patched CVE-2026-64638, a pre-auth reflected XSS in the login screen that affects every version of the CMS. The flaw can be chained under additional conditions into PHP code execution, but the advisory reports no in-the-wild exploitation. WordPress fixed it in 7.0.3 and backported the patch through the 4.7 branch.

WordPress 7.0.3 shipped a security fix for CVE-2026-64638, and the release was backported through the 4.7 branch. WordPress urged operators to update immediately and said sites with automatic background updates should receive the patch automatically. The patch closes a pre-auth reflected XSS issue in the login screen that can be chained into deeper compromise under additional conditions.

CVE-2026-64564 in Linux's SCTP networking code can let local users reach root on SCTP-reachable hosts, and lab testing also showed a container escape path. The flaw was publicly disclosed on August 6, while fixes had already shipped in stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148 on August 3. No public exploit code had surfaced at the time of publication, but systems running older kernels remain exposed until they update or remove SCTP access. The bug has existed since 2008, making it a long-lived privilege-escalation risk in environments that still allow SCTP traffic.

Linux stable kernels shipped fixes for CVE-2026-64564, closing an SCTP use-after-free that could give local users root on hosts with SCTP reachable. The patched builds are 7.1.6, 6.18.42, 6.12.101 and 6.6.148, all released August 3. Systems still running older kernels with SCTP enabled should update promptly.

Beacon disclosed a data leak that put information from around 1,500 UK charities at risk, including groups in healthcare and victim support. The exposed material is believed to include names, email addresses, telephone numbers and donation records, with attachments also likely downloaded. The provider said the incident was contained, but the exposure creates ongoing notification and follow-on fraud risk for affected charities and their supporters.

Beacon confirmed a systems access incident after an attacker used a compromised access key to reach its environment, creating risk for customer data held in the platform. The provider said the incident was contained with external cybersecurity experts and that it had not observed ongoing unauthorized access.

An active email-driven AitM phishing campaign is hijacking Microsoft 365 accounts and exposing payroll and HR mailboxes across multiple sectors. The operation has targeted hundreds of organizations in the U.S., Canada, and Europe, making the credential theft and session hijacking effort broad enough to affect many enterprises at once.

A desynchronization zero-day in Apache Traffic Server was exposed and later patched, leaving a concrete server request-handling flaw tied to CVE-2026-63078. The weakness can disrupt how front-end and back-end responses are matched, creating risk for request confusion and downstream exposure. Public record checks at publication time did not yet show the CVE in CVE.org or NVD, so the fixed-release mapping remained uncertain.

HTTP Terminator generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors, expanding the attack surface for parser-confusion flaws. The research also validated response queue poisoning (RQP) and introduced a dangling-byte method that makes it more reliable. A separate path exposed a patched Apache Traffic Server zero-day tracked as CVE-2026-63078, showing direct product impact. The work further identified Shared-Parser Confusion, where response-processing logic can be misapplied to requests.

CVE-2026-63913 in Linux Netfilter conntrack lets a crafted SYN plus invalid reset packet prematurely close a NAT entry, creating session-state manipulation risk for affected systems. The flaw was fixed in stable Linux releases including 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1. The issue was disclosed through the broader NatJack research and carries a CVSS score of 8.2.

NatJack exposes Windows NAT used by Hyper-V and Linux Netfilter conntrack to session hijacking, DNS spoofing, and NAT-table exhaustion. Researchers assigned CVE-2026-56181 and CVE-2026-63913 to the affected implementations, turning the attack class into a concrete vulnerability target. The issue affects systems that share NAT infrastructure across Windows and Linux environments, especially where untrusted workloads can manipulate connection state. Available updates reduce risk, but the broader attack class still needs isolation and traffic-protection controls.

NatJack exposes a new NAT connection-state attack class that can hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, increasing risk across systems that share the same translation boundary. The findings show affected behavior in Windows and Linux, with concrete implementation flaws tracked as CVE-2026-56181 and CVE-2026-63913. The research matters because it turns an assumed trust boundary inside NAT infrastructure into a practical path for traffic manipulation and denial of service.

The Gentlemen and Qilin continued a ransomware dominance battle in July 2026, together accounting for 33% of claimed attacks and concentrating a large share of the market in two crews. The Gentlemen claimed 135 attacks while Qilin claimed 125, keeping them ahead of other groups by a wide margin. A prior March-May 2026 comparison had already placed The Gentlemen ahead of Qilin, showing that leadership at the top of the ransomware ecosystem is still shifting.

The TeamPCP campaign lineage now ties together ShadowRay 2.0/IronErn and TA-NATALSTATUS, showing a multi-year operation that abused AI infrastructure and Redis servers for botnet and miner deployment. The activity spans 2020-2026 and evolved from internet-facing compromise into broader cloud-native and software supply chain targeting. That continuity points to a persistent operator ecosystem that repeatedly reused overlapping domains, staging paths, backend infrastructure, and tradecraft across campaigns.

The ClickFix campaign is delivering a Go-based macOS stealer through Terminal commands pasted from lure pages, creating a path to browser password theft, Apple Keychain theft, cached-credential theft, and cryptocurrency diversion. The infection chain drops a Bash profiler/loader and then a Mach-O payload matched to the victim's CPU architecture. The malware uses a fake system prompt, com.apple.verified, and a removed com.apple.quarantine attribute to reduce warnings and prompt credential entry. Infrastructure tied to the activity includes AS 210644 and Aeza Group.

A Go-based malware delivered through ClickFix is targeting macOS users to steal cryptocurrency assets, browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The Bash profiler/loader fetches a Mach-O payload matched to the victim's CPU architecture, and the chain uses a fake prompt to obtain credentials and evade macOS defenses. The malware also includes a DRAIN routine that can siphon funds from wallets, including partial theft rather than only emptying an entire wallet. Researchers linked the payload and C2 infrastructure to Aeza Group, a sanctioned Russian bulletproof hosting provider.

UNC6671 has shifted to a multi-brand extortion model, widening its operating footprint across Redact, Pink, Helix, and Falcon and increasing the difficulty of tracking the same intrusion group across separate public labels. The ecosystem shift matters because the same core crew is now linked to help-desk vishing, cloud data theft, and extortion activity against financial organizations. Analysts assess that a single core intrusion group is driving the activity behind these brands, consolidating operations under a flexible public-facing structure.

Switzerland’s Federal Office for Information Technology and Telecommunication (BIT) confirmed a breach of its Microsoft SharePoint servers that compromised about 200 accounts. The intrusion was detected after unusual activity appeared on July 28, and BIT later found that several login credentials had been compromised on July 31. BIT blocked external SharePoint access, patched the suspected vulnerabilities, and reset affected passwords. The agency said it has found no evidence of data theft beyond the compromised credentials.

Safe RET Interrupt Vulnerability affects Zen 1 through Zen 4 processors, where a local attacker can time an interrupt injection to weaken Safe RET and expose kernel memory. Researchers from MIT CSAIL described the attack on February 5 after showing a Linux timing window between branch-predictor sanitization and kernel use. On August 6, AMD issued AMD-SB-7061 and said the issue appears tied to the Linux implementation of Safe RET, with potential information disclosure on affected systems.

MIT CSAIL researchers disclosed INTERRUPT INJECTION, a TONTOU timing primitive that can bypass Spectre v2 defenses on Linux by using unprivileged code to schedule a hardware interrupt during kernel execution. The technique can re-poison branch predictors after neutralization and leak kernel memory on AMD and Intel systems; on an AMD Zen 2 host running Linux version 6.14.0-37-generic, it extracted /etc/shadow contents with 91.97% accuracy at 5.47 bytes/s and succeeded in 5 of 10 attempts, averaging 18 minutes per attempt. On August 6, AMD-SB-7061 named Zen 1 through Zen 4 as affected by the Safe RET Interrupt Vulnerability, and AMD warned that a precise interrupt could weaken Safe RET and lead to information disclosure. The researchers also tied the exploit path to interrupt-handler poisoning and compared the behavior with prior Inception-related RSB pollution techniques.

CVE-2026-64561 discloses a Linux kernel weakness in KVM/x86 shadow MMU that can let a privileged L1 guest VM escape KVM isolation and execute code on the host. The flaw affects systems where nested virtualization is exposed to untrusted guests. A public proof-of-concept shows a path to host root execution, but the issue is not described as exploited in the wild. The upstream fix is merged, and unpatched hosts need a fixed stable kernel or vendor backport.