Cybersecurity Newsfeed - 20/08/26
Daily cybersecurity news covering vulnerabilities, adversaries, trends, breaches, and other notable security developments.
Cybersecurity Newsfeed
📅 20/08/26
🛡️ Vulnerabilities
MLflow SSRF Vulnerability (CVE-2026-64849): CISA added an MLflow Server-Side Request Forgery flaw to its KEV catalog following confirmed active exploitation. Attackers can abuse input parameters to send unauthorized HTTP requests from the underlying server. Federal agencies are mandated to check for compromise before patching. More info
CISA Adds macOS, SharePoint, vCenter, and IKE Flaws to KEV: CISA expanded its catalog with four actively exploited vulnerabilities: Apple macOS Screen Sharing (CVE-2026-65400) abused to install Monero miners; Microsoft SharePoint authentication bypass (CVE-2026-55040); VMware vCenter path traversal (CVE-2026-59310) used by China-linked actors; and Microsoft IKE double free (CVE-2026-33824). Federal agencies must patch immediately. More info More info Critical Memory Corruption Bugs in Google Chrome: Google released Chrome version 151.0.7922.169/.170 fixing 15 security flaws, including two critical buffer overflows in WebGL (CVE-2026-76034) and Dawn/WebGPU (CVE-2026-76036). Remote attackers can execute arbitrary code outside the browser sandbox via malicious HTML pages. More info
Windows IKE Extension Flaw Exploited in Attacks (CVE-2026-33824): CISA alerted that unauthenticated attackers are actively exploiting a critical double free flaw in Microsoft Internet Key Exchange Extensions. Sending crafted UDP packets to ports 500 or 4500 enables remote code execution across Windows endpoints and servers. More info
Microsoft Copilot “CoSnitch” Flaws (CVE-2026-24301): Varonis detailed three vulnerabilities in Copilot Personal enabling one-click data exfiltration and long-term memory manipulation via URL prompt injection. Attackers can automatically trigger prompts to steal data from connected services or inject persistent instructions. Microsoft patched the issues on August 18. More info
Apple Image Processing Code Execution (CVE-2026-65346): Apple released updates across iOS, iPadOS, and macOS Tahoe addressing an integer overflow in the ImageIO framework. The vulnerability allows arbitrary code execution or privilege escalation simply by processing a specially crafted image file. More info
- Ransomware Gangs Exploit Windows Task Host Flaw (CVE-2025-60710): CISA updated its KEV entry to warn that ransomware operators are actively exploiting a Windows Task Host link-following flaw patched in late 2025. Local users with basic rights can escalate to SYSTEM privileges on Windows 11 and Windows Server 2025. More info
🎯 Adversaries
CameraSwarm Campaign Compromises 14,500 Dahua Cameras: A 35-day campaign compromised over 14,500 Dahua IP cameras across Ukraine and Russia using TCP brute-forcing, CVE-2021-33044/33045 exploitation via a custom “p2pwn” tool, and cloud-relay attacks. The created backdoor accounts survive factory resets on most firmware. More info
Fake Crypto Exec Targets Security Researcher Post-DEF CON: A targeted social engineering campaign hit a researcher using a booby-trapped Google Doc sent by an actor impersonating a cryptocurrency executive. The document contained an embedded malicious payload designed to compromise the endpoint upon interaction. More info
Grandoreiro Banking Trojan Targets Latin America: Acronis observed a new Grandoreiro campaign with 40% of detections in Mexico. Attackers leverage DLL sideloading via a modified mingwm10.dll file alongside a renamed Duplicate Files Finder utility, incorporating heavy evasion and multi-stage loading routines. More info
Medusa Ransomware Hits Over 500 Critical Infrastructure Orgs: A joint CISA, FBI, and HHS advisory revealed Medusa ransomware has impacted over 500 critical organizations globally. Operating a RaaS model, the group pays initial access brokers up to $1M for exclusive access to target environments. More info
Clop Gang Uses Custom JSP Web Shell on Windchill Servers: ReliaQuest identified a custom JSP web shell deployed by Clop exploiting CVE-2026-12569 in PTC Windchill and FlexPLM servers. Interfacing directly with internal APIs and database schemas, the shell decrypts LDAP credentials and exfiltrates files via custom HTTP headers. More info
“Ransom Busters” Affiliate Poses as Recovery Firm: GuidePoint Security uncovered a rogue ransomware affiliate operating as “Ransom Busters” that contacts breach victims posing as a recovery service. The actor offers to delete stolen data or provide decryption keys for $20K–$60K to bypass RaaS revenue-sharing models. More info More info - Evooo1Bot Targets Edge Devices and Firewalls: Fortinet discovered a new Mirai-based botnet targeting Linux edge devices, firewalls, and IoT hardware. Evooo1Bot uses AES-256/ChaCha20 encryption over port 443, embeds 18 exploits, and features a !socks module to convert hosts into proxy nodes for routing malicious traffic. More info
📈 Trends
Unmoderated “Kriminal” AI Platform Emerges: ThreatDown uncovered a subscription-based cybercrime platform providing unmoderated AI tools for OSINT, social engineering, and exploit drafting. The platform aggregates existing models (Grok, Claude, Llama) via OpenRouter routed through Cloudflare and Google Cloud. More info
Password Spraying Attacks Surge 155x via Azure CLI: Huntress reported a massive spike in password spraying targeting Microsoft’s Azure CLI. Originating from an IPv6 range, attackers leveraged leaked credential lists to exploit legacy Resource Owner Password Credentials (ROPC) OAuth flows and bypass MFA. More info
💥 Breaches & Leaks
Sakura Internet Breach Exposes Data of 1.36 Million Accounts: Japanese provider Sakura Internet disclosed a breach where unauthorized actors accessed its sales management system, exposing contract and membership data of up to 1.36M member accounts following a separate intrusion on its rental server platform. More info
CareCloud Breach Impacts 3.7 Million Patients: Healthtech firm CareCloud disclosed that a March 2026 AWS breach affected over 3.75 million individuals. Threat actors exfiltrated database records containing sensitive personal information, causing an eight-hour network disruption. More info