Cybersecurity Newsfeed - 21/08/26
Daily cybersecurity news covering vulnerabilities, adversaries, trends, breaches, and other notable security developments.
Cybersecurity Newsfeed
📅 21/08/26
🛡️ Vulnerabilities
MLflow SSRF Flaw Under Active Attack (CVE-2026-64849): CISA added a critical DNS-rebinding server-side request forgery (SSRF) flaw in MLflow’s unauthenticated model-registry webhooks API to its KEV catalog. Remote attackers are scanning exposed instances to query internal endpoints and exfiltrate cloud IAM credentials from metadata services like AWS IMDS. More info More info Critical Unauthenticated RCE in Elementor Pro (CVE-2026-32475): A CVSS 9.0 flaw in the Elementor Pro WordPress plugin (versions prior to 4.2.2) stems from inconsistent early-exit logic in its Forms module file upload processing. Unauthenticated attackers can bypass file extension blocklists using multi-part requests to write arbitrary PHP scripts into public directories for remote code execution. More info More info Auth Bypass and Memory Overflow in Citrix NetScaler (CVE-2026-19490 / CVE-2026-19489): Citrix issued urgent fixes for NetScaler ADC and Gateway. CVE-2026-19490 (CVSS 9.3) allows unauthenticated access on AAA virtual servers/Gateways with SAML enabled, while CVE-2026-19489 (CVSS 8.8) causes memory overflow and DoS condition via SIP ALG configurations. More info
JFrog Artifactory Supply Chain Flaws: Oligo Security uncovered two flaws in JFrog Artifactory: CVE-2026-69106 (CVSS 8.8), which abuses
X-Orig-Client-Uriheaders to enable cross-user cache poisoning, and CVE-2026-65922 (CVSS 5.4), which lets authenticated users bypass controls via REST APIs to alter metadata, npm signing keys, and OCI referrers. More infoVM Escape and RCE in Node.js isolated-vm (GHSA-864f-rcv7-6rh4): A type confusion bug during object serialization in the C++ binding layer of
isolated-vmallows sandboxed guest JavaScript code to corrupt host process memory. Attackers can leverage this to break out of Google V8 isolation instances and execute host code. More infoActive Exploitation of Zimbra SNMP Flaw (CVE-2026-73570): CERT Polska warned that threat actors are actively exploiting a command injection vulnerability (CVSS 8.9) in Zimbra Collaboration Suite versions prior to 10.1.20 when
zimbra-snmpis enabled. Crafting specific SMTP requests triggers OS command execution under the Zimbra context. More info- Cisco ASA/FTD Denial of Service Added to KEV (CVE-2026-20349): CISA updated its KEV catalog to mandate remediation for a Cisco Adaptive Security Appliance and Firepower Threat Defense DoS bug following active exploitation in enterprise networks. More info
🎯 Adversaries
Russian Espionage Clusters Target Western Defense & OAuth (UNC6293/UNC5976/UNC7005): Google TIG detailed Russian threat activity abusing Google OAuth flows, WhatsApp device-linking prompts, and custom tools (HEADRUSH, ChocoShell, CornFlake RAT) to target government and academic sectors. The CaptiveCrunch campaign also compromised MSPs and hotel Wi-Fi to intercept session tokens via DNS poisoning. More info
UAT-10147 Deploys SPECTRE Implant and Integrates Agentic AI: Chinese-speaking actor UAT-10147 was observed deploying “SPECTRE”—a cross-platform C backdoor featuring process hollowing, BYOVD EDR unhooking on Windows, and a custom Linux kernel rootkit. Simultaneously, the group is integrating agentic AI frameworks (DeepAudit, PentestGPT) to automate post-compromise exploitation and privilege escalation. More info More info Manic Android Malware Uses Mesh Relays for Offline Exfiltration: ThreatFabric uncovered “Manic,” a new banking malware targeting Ukrainian users that abuses Accessibility Services to log UI inputs and capture screen PINs. Crucially, Manic uses Wi-Fi Direct, Bluetooth RFCOMM, and BLE GATT to pass stolen data up to four hops across nearby infected devices when direct internet connectivity is lost. More info More info ToxicPanda 2.0 and GoldDigger Expand Mobile Banking Targets: ToxicPanda 2.0 updated its operations to target 140 banking and crypto applications globally, abusing Accessibility Services to enable ADB Wireless Debugging and run elevated shell commands. Meanwhile, GoldDigger campaigns in the UK and South Africa rely on “dpt-shell” packing to conduct automated real-time fraud. More info More info - Fake Google Gemini Installer Delivers Vidar Infostealer: Attackers engineered a social engineering campaign routing users via Google Colab pages to a fake Windows Software Hub. The malicious
Download_Google_Gemini_For_Windows.exeinstaller drops a Go-based Vidar variant that steals browser credentials and exfiltrates data through Telegram. More info
📈 Trends
Poisoned Rust Crates Target Build Pipelines (arrayref): A supply-chain compromise of the popular arrayrefcrate maintainer account led to malicious updates forarrayref(0.3.10),append-only-vec(0.1.9), andinternment(0.8.7). The packages injected a build-time dependency on typosquattedproc-macro1to drop cross-platform infostealers duringcargo buildcompilation steps before being yanked by Rust admins. More infoMore info ThreatsDay Roundup: Gogs 10.0 RCE, n8n, and EDR Bypasses: The latest security roundup covers critical vulnerabilities including a path-traversal RCE in Gogs (CVE-2026-52813), prototype pollution in n8n (CVE-2026-33696), weaponization of Microsoft Defender’s
BTR.sysdriver for EDR bypass, and DoJ indictments targeting 17 Iranian actors. More info- “Zombie Card” Attack Bypasses Expired Contactless Cards: UMass Amherst researchers demonstrated a flaw in Visa Kernel 3 architecture where NFC relays can modify the unauthenticated Application Expiration Date (tag 5F24) while preserving Track 2 data, tricking terminals and issuers into approving expired physical payment cards. More info
📚 Others
- CUSTODY Framework Released to Restrain Autonomous AI Agents: Cybersecurity expert Jake Williams published “CUSTODY,” an open-source framework outlining condition-of-release rules, temporary authority constraints, and stop triggers to prevent enterprise AI agents from performing unmonitored external network operations or reward-hacking. More info