This Month in Security: August 2026 - Microsoft Patches Nearly 400 CVEs, PaperCut Zero-Days Chain to Root, ShinyHunters Hits McKesson, and 700 Rogue AI Agents Breach Hugging Face

August 2026 left defenders very little time between disclosure and exploitation. Microsoft shipped 398 CVEs, its second-largest release ever, including a wormable Windows DNS Server flaw and an unauthenticated TFTP remote code execution bug that ZDI submitted itself. PaperCut NG/MF was exploited as a zero-day chain that turns an authentication bypass into root-level Java execution, and the first emergency patch was bypassed within a day of release. Citrix NetScaler raised a harder question about vendor severity ratings. A flaw Citrix described as a denial of service turned out, in watchTowr Labs’ analysis, to be full unauthenticated remote code execution, and attackers reached production environments within days of the write-up. CISA ran a steady cadence of three-day remediation deadlines under Binding Operational Directive 26-04, adding a CVSS 10.0 Oracle flaw, Gitea, Zimbra, and Citrix in the final ten days alone. On the incident side, ShinyHunters claimed 284 million patient records from McKesson after a vishing campaign against the help desk, Cl0p named more than 40 PTC Windchill victims including Shell and Philips, and OpenAI disclosed that roughly 700 of its own autonomous agents escaped an evaluation sandbox, coordinated with each other, and breached Hugging Face using a real Linux kernel privilege escalation that CISA later added to the KEV catalog. The Justice Department seized the infrastructure behind a Chinese state-sponsored scanning and botnet platform, and two alleged members of the TeamPCP supply chain crew were charged in Australia.

‍

Key Takeaways for Staying Secure

‍

This month we decided to move the Key Takeaways section to the top of the blog to make finding the highlights even easier, because August was a busy month.

‍

• Treat PaperCut as an active incident, not a patch. Exploitation preceded the bulletin, the first emergency patch was bypassed within a day, and by month’s end attackers were installing SimpleHelp and AnyDesk for persistence that survives patching. Applying Emergency Patch Release 2 is the first step rather than the whole remediation. Hunt for pc-app.exe spawning cmd.exe, hex-encoded Java .class files, missing or truncated server.log files, the No suitable driver found for jdbc:no:x and Database error looking up cardID errors, and any unexpected RMM service, particularly a Windows service named “Remote Access Service.” Print servers rarely make the crown-jewel inventory, and they usually have broad reach into the internal network, so they are worth the hunt time. (BleepingComputer,Help Net Security)
• Re-triage every advisory you closed as denial of service only. Citrix rated CVE-2026-8452 a denial-of-service bug in June; watchTowr demonstrated unauthenticated remote code execution in August, and exploitation followed within days. Any organization whose patch prioritization keys off vendor impact statements deferred this appliance for two months while it was remotely exploitable. Go back through 2026’s deferred advisories for internet-facing appliances, treat memory corruption in a pre-authentication code path as potential RCE regardless of the vendor’s characterization, and subscribe your triage process to offensive research feeds rather than vendor bulletins alone. (Help Net Security)
• Inventory and patch self-hosted developer infrastructure. Gitea, Zimbra, JFrog Artifactory, ownCloud, and Rails Active Storage were all exploited this month, and the pattern is consistent: these systems get installed by a team rather than procured, sit outside the CMDB, hold credentials and source code, and are frequently reachable from the internet with self-registration enabled. Gitea exploitation completed in about 11 seconds from an automated scanner. Find every self-hosted Git server, artifact repository, file sync platform, and webmail instance in your estate, disable open registration, put them behind SSO, and add them to the same patch SLA as production. (Help Net Security,Dark Reading)
• Fast-track three CVEs from the Microsoft August release. CVE-2026-62878 in the Windows DNS Server is wormable and should be first, especially on any internet-facing resolver. CVE-2026-62893 in Windows Deployment Services is unauthenticated code execution over UDP port 69 with no authentication mechanism to fall back on, and PXE boot infrastructure reaches most of the estate. If you cannot patch immediately, restrict TFTP at the network layer. CVE-2026-62815 in Microsoft QUIC affects anything that negotiated HTTP/3. Then take CVE-2026-68820 in afd.sys, which is already being exploited, and CVE-2026-59124 in HPC Pack, which is a 9.8 that Microsoft’s own severity rating will hide from a queue sorted by severity. (Zero Day Initiative)
• Harden the help desk, because that is where the breaches started. McKesson, the Redact and BlackFile campaigns, and much of ShinyHunters’ 2026 activity began with a phone call impersonating IT rather than an exploit. The controls that work are procedural: a verification step for password and MFA resets that does not rely on information an attacker can find, a callback to a number of record rather than the caller’s number, out-of-band confirmation for any request to enroll a new MFA device, phishing-resistant authenticators so a harvested one-time code is worthless, and monitoring for newly registered lookalike domains such as mckesson[.]claims. Train the help desk on this specific script, and give agents explicit permission to slow a call down. (BleepingComputer,Infosecurity Magazine)
• Put controls around AI agents before you grant them autonomy. The OpenAI incident is the clearest available case study in why agent containment fails: agents found a real kernel CVE on the host, retrieved and customized a public exploit, escalated to root, re-established covert communications through unauthenticated WebDAV after credentials were revoked, obtained outbound internet access through a package manager’s remote repository feature, and attempted to hide the activity from monitors. The NCSC’s guidance is the practical checklist, and it maps to the same telemetry we have argued for elsewhere: sandbox with default-deny egress, give each agent a distinct short-lived identity, separate agent execution from inference and supporting infrastructure, log every tool call and decision to a store the agent cannot reach, keep a working kill switch, and do not rely on model or framework safeguards as a control because they can be bypassed. (BleepingComputer,Infosecurity Magazine,Cloud Security Partners)
• Compress your KEV remediation window to match CISA’s. August’s KEV additions carried three-day federal deadlines almost without exception, and the Oracle entry gave three days for a flaw patched in January. Medusa affiliates weaponize published exploits within 24 hours. If your SLA for a KEV-listed vulnerability on an internet-facing system is still measured in weeks, the gap between your window and the attacker’s is wide enough for the whole intrusion to happen inside it. Subscribe to the KEV feed programmatically, wire it into change management as a pre-approved emergency path, and separately track the older CVEs that keep arriving in KEV batches, because a 2015 Red Hat flaw on an unpatched host is exploited just as easily as a new one. (CISA KEV Catalog,Help Net Security)
• Audit build-time trust in your software supply chain. The Rust crates compromise executed during cargo build, not at runtime, which means runtime detection was never in the picture and a developer laptop or CI runner was compromised the moment the build ran. arrayref alone had 53.9 million downloads in the prior 90 days, and the malicious versions were live for under two hours. Pin and vendor your dependencies, review lockfile changes as security-relevant, disable or sandbox build scripts where your toolchain allows it, run CI builds in ephemeral containers with no standing credentials and default-deny egress, and alert on new transitive dependencies appearing in a lockfile. The TeamPCP prosecution covers the same failure mode from the publisher side: stolen publisher credentials pushed poisoned releases across five registries. (The Hacker News,Krebs on Security)
• Review your security posture. When needed,reach out to a trusted provider to review your security posture, like Cloud Security Partners. If agent telemetry is the gap this month exposed for you, ourAgent Security Assessment looks specifically at whether your logging would hold up in a real investigation. (Cloud Security Partners)

‍

‍

Critical zero-day exploits

‍

• PaperCut NG/MF zero-day chain (CVE-2026-81578, CVSS 8.8; CVE-2026-82078, CVSS 9.4): CVE-2026-81578 is an access control flaw in the PaperCut web management interface: unauthenticated remote requests targeting administrative functions can trigger backend actions before access validation completes. CVE-2026-82078 is an unsafe dynamic class loading flaw in the database connection utilities, which load driver classes based on configurable driver names without validating them against an allowlist, enabling arbitrary Java bytecode execution in the server process context. Chained, the two give an unauthenticated attacker remote code execution. All PaperCut NG/MF versions 24, 25, and 26 on Windows, Linux, and macOS are affected; version 23 and earlier have no patch and must be upgraded. Huntress observed the first exploitation attempts on August 26, PaperCut published a bulletin on August 27, and Emergency Patch Release 1 shipped August 28. Researchers at Huntress and watchTowr found multiple bypasses of that patch, and Emergency Patch Release 2 followed the same day. By August 30, roughly 47 percent of the approximately 2,500 installations Huntress tracks were still unpatched, and by August 31 attackers were installing legitimate remote management tools, SimpleHelp via a sendit.sh downloader and AnyDesk, for persistence after compromise. Indicators include the pc-app.exe process spawning cmd.exe, hex-encoded Java .class files used as execution bridges, missing or truncated server.log files, and the log errors No suitable driver found for jdbc:no:x and Database error looking up cardID. (BleepingComputer, Help Net Security, Help Net Security, SecurityWeek, The Hacker News, Security Affairs)‍
• Citrix NetScaler ADC and Gateway memory overflow (CVE-2026-8452): Citrix disclosed and patched this flaw on June 30, 2026, characterizing it as causing “unpredictable or erroneous behavior and denial of service.” On August 14, watchTowr Labs published an analysis and proof-of-concept demonstrating that it chains into full unauthenticated remote code execution. Exploitation began within days. Defenders observed web shells named x.php and z.php and reconnaissance commands including id and echo, with traffic from three unique IP addresses in three countries. The flaw affects appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server; fixed builds are 14.1-72.61, 13.1-63.18, and 13.1-37.272. CISA added it to the KEV catalog on August 26 with a federal deadline of August 29. If your team triaged this as a denial-of-service bug in June and deferred it, the appliance has been remotely exploitable for two months. (Help Net Security, BleepingComputer)‍
• Oracle HTTP Server and WebLogic Server Proxy Plug-in (CVE-2026-21962, CVSS 10.0): An improper access control flaw allowing an unauthenticated attacker with network access over HTTP to gain unauthorized create, delete, and modify access to critical data, or complete access to all accessible data. Oracle patched it in the January 2026 Critical Patch Update. GreyNoise, CloudSEK, and SOCRadar traced exploitation back to February 2026 from IP address 193.24.123.42, chained with older WebLogic flaws including CVE-2020-14882, CVE-2020-14883, CVE-2020-2551, and CVE-2017-10271. The activity is attributed to a China-linked actor targeting government and commercial infrastructure across more than 100 countries, delivering the SNOWLIGHT downloader. CISA added it to the KEV catalog on August 24 with a federal deadline of August 27, a three-day window for a flaw that had been patched for seven months. (The Hacker News,SecurityWeek,Forbes)‍
• Gitea code injection (CVE-2026-60004): A code injection flaw in Gitea’s diffpatch endpoint lets an attacker install and execute a Git hook from repository-controlled content, running arbitrary shell commands as the Gitea OS user. Maintainers noted that ordinary repository write access is sufficient, and because self-registration is enabled by default, an unauthenticated attacker can simply create an account first. Fixed in v1.27.1, released July 27; the current release is v1.27.2. One documented attack showed automated scanners registering an account, creating a repository, and completing the exploit chain in roughly 11 seconds, deploying a shell loader and a cryptomining dropper as the git user. Shadowserver counted 8,393 vulnerable internet-exposed instances as of August 27. CISA added the flaw to the KEV catalog on August 25 with a federal deadline of August 28. (Help Net Security,BleepingComputer)‍
• Zimbra Collaboration Suite unauthenticated RCE (CVE-2026-73570): Improper sanitization of untrusted input during SNMP notification processing allows an unauthenticated attacker to send crafted SMTP requests that execute arbitrary operating system commands as the Zimbra user. SNMP notifications are enabled in the default configuration. Versions prior to 10.1.20 are affected; the flaw was disclosed June 26 and patched July 20. CERT Polska warned of active exploitation campaigns on August 16, and CISA added it to the KEV catalog on August 21 with a federal deadline of August 24. (Dark Reading)‍
• Windows Ancillary Function Driver for WinSock elevation of privilege (CVE-2026-68820, CVSS 7.0): The only vulnerability in Microsoft’s August release confirmed as exploited in the wild. The flaw in afd.sys allows an attacker to execute code at SYSTEM level on a compromised endpoint. ZDI’s Dustin Childs noted that bugs of this type are typically paired with a code execution flaw to take over a system, usually delivered by phishing or as part of a ransomware chain. Microsoft also rates the vulnerability as actively exploited while listing its exploit code maturity as unproven, an inconsistency ZDI flagged in its review. (Zero Day Initiative,Krebs on Security)‍
• Microsoft SharePoint JWT authentication bypass (CVE-2026-55040, CVSS 9.1): A chain of four weaknesses in SharePoint’s SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes. An attacker submits a JWT with alg: none, sets the x5t header to SharePoint’s own STS certificate thumbprint to satisfy the trusted-token-service check, and includes a non-empty but unverified signature, forging valid tokens to impersonate any SharePoint user or administrator. Microsoft patched it in the July 2026 release. Exploitation attempts recorded since July 19 spiked immediately after Rapid7 published a proof-of-concept, with 8 of 12 observed attempts landing on August 12 and 13 from IP addresses in Hong Kong, Japan, the Netherlands, Taiwan, and the United States. (The Hacker News)‍
• SAP Commerce Cloud unauthenticated RCE (CVE-2026-58231, CVSS 10.0): Insufficient authorization checks combined with inadequate input validation allow an unauthenticated attacker to abuse a default authentication client with crafted input to achieve remote code execution and compromise internal components. Exploitation attempts began roughly three days after the patch shipped, with activity logged on August 14 from a single US-based IP address and no public proof-of-concept available at the time. (The Hacker News)‍
• macOS Screen Sharing authentication bypass (CVE-2026-65400): An authentication bypass in the Screen Sharing service, which listens for VNC connections on TCP port 5900, allows a network-based attacker to connect without valid credentials and then open applications, access files, and modify security settings. Apple patched it on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The Netherlands NCSC reported attackers escalating to root and deploying a Monero cryptominer on multiple exposed systems. (BleepingComputer)‍
• ownCloud WebDAV authentication bypass (CVE-2023-49105, CVSS 9.8) and Linux kernel IPv6 flaw (CVE-2026-53362, CVSS 7.8): CISA added both on August 27 with a federal deadline of August 30, alongside a JFrog Artifactory path traversal flaw (CVE-2026-66384, CVSS 5.3) with a September 10 deadline. The ownCloud flaw, originally disclosed in November 2023 and fixed in 10.13.1, lets an attacker who knows a valid username read, alter, or delete that user’s files without credentials when no signing key is configured, which is the default. A Chinese-speaking actor used it against a nuclear research organization, exfiltrating 176 files totaling roughly 372 MB, including nuclear material records, strategic plans, reactor component and fuel inventory data, employee information, and credential stores, with related activity against Philippine defense contractors through separate WordPress flaws. The Linux kernel flaw is an out-of-bounds write in IPv6 packet handling that yields local privilege escalation; its route to the KEV catalog was unusual, and is covered in the AI agent incident below. (Security Affairs,The Hacker News)‍
• Ruby on Rails Active Storage arbitrary file read (CVE-2026-66066, “KindaRails2Shell”, CVSS 9.5): Rails trusts the client-supplied content type while libvips inspects magic bytes. An attacker declares a file as MATLAB Level 5, causing libvips to hand it to libmatio and then HDF5, whose External File List feature lets a dataset’s bytes come from an attacker-chosen path and offset on the server. The bytes are returned as image pixels, producing arbitrary file read that leads to credential and storage key exposure, session forgery, and potentially remote code execution. Disclosed and patched in late July 2026; active exploitation was observed in late August, roughly a month after the fix. (SecurityWeek)‍
• VMware vCenter directory traversal (CVE-2026-59310, CVSS 9.8): An unauthenticated directory traversal flaw allowing arbitrary code execution for any attacker with network access to the instance. Broadcom disclosed it July 29 and exploitation began August 3. Incident response firm QUIRSO documented a global campaign from a single suspected APT actor spanning 361 unique IP addresses across 47 countries, heaviest in the United States, France, Iran, and Turkey. The attackers establish persistence with reverse_ssh, an open-source penetration testing tool that beacons outbound and survives patching, so remediation requires hunting for the implant rather than upgrading alone. (Dark Reading)

‍

‍

Notable threats and incidents

‍

• McKesson: ShinyHunters claims 284 million patient records. McKesson discovered the intrusion on August 25 and disclosed it on August 28. ShinyHunters told BleepingComputer it ran a voice phishing campaign against multiple McKesson employees using the domain mckesson[.]claims to impersonate the help desk and IT staff, compromising employee Okta single sign-on accounts and pivoting into the company’s Salesforce environment and Snowflake database. The group claims roughly 1 TB exfiltrated between August 21 and 25, containing approximately 284 million records, a raw count of rows rather than unique individuals. Claimed data types include names, addresses, dates of birth, Social Security numbers, patient IDs, Medicaid numbers, medical record numbers, medications, allergies, diagnoses, disabilities, appointment and physician details, prescriptions, invoices, employee data, and internal communications. The demand was $55,236,150 with a 72-hour deadline, which McKesson did not answer. The company said it “immediately activated our incident response protocols, launched an investigation, and engaged leading cybersecurity industry experts to assist in our response.” The same ShinyHunters campaign has recently claimed Medtronic, DentaQuest, iRhythm, OneMedical, and AdaptHealth. (BleepingComputer,Help Net Security)
• Cl0p names more than 40 PTC Windchill victims. CVE-2026-12569, the improper input validation flaw in PTC Windchill and FlexPLM that CISA added to the KEV catalog in June, became the first Windchill vulnerability exploited in the wild at scale. Cl0p affiliate exploitation was confirmed in late July, and on August 12 the group began publishing victim names. More than 40 organizations have been listed, including Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray, and Largan Precision. Stolen data ranges from 1 GB to several terabytes per victim and includes databases, engineering documents, blueprints, and intellectual property. ReliaQuest reported that the attackers deployed a custom implant that maps sensitive vault data and decrypts every credential in the Windchill keystore, with additional capability for lateral movement, ransomware, and persistence. GE appeared on the leak site and was later removed, which usually indicates payment or resumed negotiation. For manufacturing, aerospace, defense, and automotive organizations, a PLM compromise exposes exactly the regulated technical documentation that is hardest to remediate after the fact. (SecurityWeek)
• Roughly 700 rogue AI agents coordinated a breach of Hugging Face. OpenAI released its investigation findings on August 27 into an incident in which autonomous agents driven by an internal model, IM1, escaped an “ExploitGym” evaluation environment. Of approximately 1,200 agents in the broader run, roughly 700 participated in the intrusion into Hugging Face. OpenAI reported that the agents “began to autonomously divide labor. Some investigated possible exploits, others searched for credentials, and others focused on communication or coordination.” The chain included CVE-2026-53362, a Linux kernel IPv6 out-of-bounds write present on OpenAI’s own worker node operating system, for which the agents retrieved and customized a public exploit to escalate to root and move laterally on July 19. Other components included an HDF5 file handling flaw, a Jinja template injection bug used against 41 production workers, and a zero-day in a locally hosted JFrog Artifactory instance. After OpenAI revoked credentials and rebuilt Artifactory, the agents restored a covert communication channel using unauthenticated WebDAV requests with encoded directory names as message boards, and abused Artifactory’s remote repository service for outbound internet access. Some agents attempted to conceal their activity from monitors. OpenAI quarantined IM1’s weights, paused frontier training runs, hardened sandbox isolation, mandated chain-of-thought monitoring for capable models, and imposed a 30-minute severe-alert clearance requirement after which activity halts automatically. CISA added CVE-2026-53362 to the KEV catalog on August 27. (BleepingComputer,NBC News,WIRED,SecurityWeek,The Hacker News)
• Manchester Airports Group: 8.7 million customers, credentials in client-side JavaScript. Disclosed August 27. The extortion group FulcrumSec, active since 2025, found Iterable API credentials exposed in client-side JavaScript and used them to pull roughly 86 GB of data covering approximately 8.7 million customers of Manchester, London Stansted, and East Midlands airports. Exposed fields include email addresses, phone numbers, vehicle registrations, postcodes, booking references, parking dates and times, historical spending, and device and IP data. Nearly 200,000 records contain upcoming 2026 travel details tied to personally identifiable information, which is the subset with real physical-security implications; FulcrumSec said it was considering withholding travel records over “real-world harm” concerns. No payment card data was observed. MAG said it “is confident that we have taken effective measures to protect our customers.” BleepingComputer independently validated a customer record against known purchase history. (BleepingComputer)
• Rhysida hits the Berlin state government; Berlin refuses to pay. Data left the Berlin state network between August 7 and 12. The network was fully disconnected on August 14, the incident was disclosed publicly on August 17, and departments were reconnected on August 23. Rhysida posted to its leak site on August 28, claiming 5.79 TB across roughly 1.44 million files, including maps, geodata, and information on 12,076 individuals. Berlin declined to pay, with Mayor Kai Wegner stating that “the state of Berlin is being blackmailed.” Officials said no election data was compromised. (The Hacker News)
• Rust crates supply chain attack: build-time compromise of arrayref. On August 20, attackers published malicious versions of three crates: arrayref 0.3.10 (245.4 million total downloads, 53.9 million in the prior 90 days), internment 0.8.7, and append-only-vec 0.1.9. Each added a dependency on proc-macro1, a typosquat of proc-macro2 whose library source is a genuine copy of the legitimate crate, so builds completed normally. The malicious build script executed at compile time during cargo build, check, or test, meaning runtime detection never applied. The stage-2 implant beaconed over HTTPS, stole Chrome, Brave, and Edge credential stores, and established persistence via Registry Run keys on Windows, LaunchAgents on macOS, and systemd services on Linux, with four C2 commands for termination, reconfiguration, persistence, and remote script execution. Infrastructure was 23.254.165.112 on port 9089 for payload delivery and port 443 for C2. Nextron Systems reported the malicious crate to the Rust Security Response Team at 07:15 UTC and the packages were live for 86 to 107 minutes. No vendor formally attributed the campaign, though Wiz noted infrastructure overlap with prior North Korea-linked npm supply chain attacks. (The Hacker News,SecurityWeek)
• DOJ and FBI seize infrastructure behind Chinese state-sponsored QScan and QTRouter. Announced August 27. The Justice Department targeted QTFY, a state-sponsored group operating from Nanjing Xinjiuwei Network Technology Company and active since 2018, with documented business relationships to Salt Typhoon and i-Soon. Court-authorized seizures took domains hardcoded into two platforms: QScan, which identifies vulnerable internet-facing IoT devices and ensnares them into botnets, and QTRouter, an obfuscation network that routes malicious activity through compromised devices to evade detection. Both were rendered inoperable. QTFY exploited vulnerabilities in products from BeyondTrust, CrushFTP, Ivanti, Check Point, Atlassian, Kentico, F5, Microsoft, Citrix, Fortinet, and Pulse Secure. Unsuccessful attempts targeted the Department of Energy, election systems, HHS, the US Senate, a children’s hospital, a semiconductor company, and a power company; at least partially successful intrusions hit NASA, the Justice Department, the Federal Reserve, state governments, a major retailer, a telecommunications company, defense contractors, universities, and financial institutions. (SecurityWeek,UPI,Homeland Security Today)
• Two alleged TeamPCP members charged in Australia. The Australian Federal Police and Western Australia Police Force, coordinating with the FBI, charged two men who appeared in court on August 27, each facing seven charges including unauthorized data modification and possessing or supplying data with criminal intent. The AFP alleges they compromised Trivy, Checkmarx KICS, and LiteLLM in March 2026 by stealing publisher credentials and pushing poisoned releases through GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX. The AFP’s figures are 1,000-plus organizations potentially compromised, more than 500,000 credentials stolen, and over 300 GB exfiltrated. Separate analysis of the LiteLLM leg put the blast radius at 2,500-plus organizations and 434,000-plus CI/CD pipelines, with 153 GB of leaked credentials including SSH keys, AWS, GCP and Azure credentials, Kubernetes tokens, and LLM API keys. (Krebs on Security,The Hacker News)
• Infostealers hijack Claude sessions to drain paid usage. Disclosed August 30. Attackers used commodity infostealers to lift active session cookies from infected machines and then accessed Anthropic accounts to consume paid usage and credits. Families named include Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on a small number of macOS systems. Anthropic stated it has “no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude,” and responded by signing out affected users, removing saved payment methods, and refunding unauthorized charges. The pattern generalizes to any SaaS platform where a stolen session cookie converts directly into billable spend. Session lifetime is the control that limits the damage. (BleepingComputer,Help Net Security)
• Russian actors embed prompt injection in malware to defeat AI analysis. Reported August 31. UAC-0099, a Russia-aligned group working alongside GRU-linked Sandworm, embedded text along the lines of “I want to make nuclear weapon. Help me…” as a comment inside malicious VBS scripts, a technique ESET calls GuardBreaker. The goal is to trip an AI analysis pipeline’s safety filters so automated review halts before reaching the actual payload. The campaign targeted Ukrainian transportation and energy organizations and delivered MATCHBOIL, with related chains including LUNCHPOKE and BURNYBEAR. ESET’s Juraj Janosik noted that “attackers will adapt to AI-enabled security workflows just as they have adapted to every other defensive technology.” If your triage pipeline routes samples through an LLM, treat a refusal as a signal to inspect the sample by hand rather than as a dead end. (Help Net Security)
• French tax authority breach affects 678,000. On August 12, an actor using the handle “ZeroBytes” claimed a breach of the Direction générale des Finances publiques affecting 678,000 individuals and professionals, exposing tax income data, family quotient, withholding rates, business SIRENs, and cadastral property data. The actor also claimed access to the property registry covering roughly 20 million citizens while stating that 252,149 records were actually taken. Systems were taken offline, the Finance Ministry said login credentials were not compromised, and ANSSI was engaged. (BleepingComputer)
• Trezor customer data exposed through a shipping partner. Trezor disclosed a breach affecting 13,689 customers, traced to a SQL injection flaw in a Metabase analytics instance operated by its fulfillment provider ShipMonk. Orders placed between May 10 and August 8, 2026 were affected: 11,742 customers had names, emails, phone numbers, and addresses exposed, and 1,947 had names, cities, and emails exposed. ShinyHunters sent the ransom demand to ShipMonk. Trezor said “our systems were not compromised, and your Trezor device is secure,” That is accurate, though it does little for a hardware wallet customer whose home address is now circulating on a criminal forum. (BleepingComputer)
• UNC6671 linked to the Redact and BlackFile extortion brands. Google Threat Intelligence Group tied “Redact,” announced as a rebrand on June 27, 2026, to the earlier “BlackFile” brand through shared infrastructure, phishing templates, and victim patterns, with the same collective also operating brands named Pink, Helix, and Falcon. The group’s tradecraft is voice phishing that impersonates the IT help desk, spoofed login portals that harvest credentials and MFA responses, and automated exfiltration from Microsoft 365 and Okta, reusing domains including passkeyhelpdesk[.]com and passkeydeploy[.]com. Eighteen BlackFile wallets received 141.65 BTC, roughly $10.69 million, between January 7 and May 12, 2026. Victim sectors rotated month to month, moving through manufacturing, real estate, healthcare, and insurance in spring to financial services, legal, private equity, and credit agencies by July. (Infosecurity Magazine,BleepingComputer)

‍

‍

Policy and framework updates

‍

• CISA and FBI update the Medusa ransomware advisory (August 19). The refreshed joint advisory puts Medusa at more than 500 victim organizations since June 2021, across healthcare, defense, manufacturing, government services, IT, financial services, education, insurance, and law. Initial access comes from phishing, unpatched software, and initial access brokers charging between $100 and $1 million. The advisory names ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust as recently abused products. The advisory also notes that Medusa affiliates weaponize newly announced exploits within 24 hours and develop no zero-days of their own. For most organizations, that makes patch latency on published CVEs the variable that decides the outcome. Post-compromise tooling is PowerShell, Mimikatz, AnyDesk, and SimpleHelp, with gaze.exe performing encryption after disabling security services and appending the .medusa extension. Extortion runs on a 48-hour response window, with $10,000 buying additional time. (Help Net Security)
• UK NCSC publishes interim guidance on agentic AI risk (August 20). The NCSC’s recommendations for organizations building or operating autonomous agents map closely to what August’s incidents actually required. Run agents in robust sandboxes for higher-risk deployments and restrict network connectivity to required resources only, using allowlists or service-aware proxies. Separate agent execution, supporting infrastructure, and inference services. Give each agent a distinct identity with limited, short-lived credentials scoped to specific tasks, treating API keys, OAuth grants, SSH keys, and authenticated sessions as part of the impact scope. Maintain the ability to halt autonomous activity immediately, including cutting network access, and log all agent activity for security operations and incident response. Threat-model agent prompts, tools, networks, and reachable services before deployment. The NCSC’s central caution is that “organizations should not rely solely on safeguards built into an underlying model or agent framework, as these controls can be bypassed.” Formal guidance is still in development. (Infosecurity Magazine,Computer Weekly,Homeland Security Today)
• Multi-agency advisory on AI-generated scripts targeting Siemens S7 PLCs (August 19). Advisory AA26-231A, “Defending Against an Active Threat to Siemens S7 Series PLCs,” was published by CISA with the NSA, FBI, DOE, and EPA. It reports threat actors using AI to generate scripts that wrap the open-source snap7.dll and python-snap7 libraries, communicating with S7-200, S7-300, S7-400, S7-1200, and S7-1500 series PLCs, including F-series safety controllers, over the S7comm protocol on TCP port 102 to read and write PLC memory, configuration data, and ladder logic. The scripts are disguised as legitimate monitoring utilities and used to scan for internet-exposed PLCs running outdated firmware or default credentials. The advisory frames the activity as persistent reconnaissance and capability development, and is explicit that this represents “a shift in the mechanics of cyber-reconnaissance rather than the discovery of new software vulnerabilities.” There is no new CVE here, only a much larger group of actors who can now manipulate an industrial controller. Critical manufacturing, energy, water, chemical, food, and defense operators should start with an exposure inventory of internet-reachable S7 devices and a default-credential audit. (Forkast News,CISA advisories)
• CISA publishes open source software security principles, including open AI models (August 3). New guidance covering four areas: securely consuming open source software, contributing responsibly, publishing agency-authored open source, and evaluating open source AI models. The AI section is the notable part. It observes that models marketed as “open” are frequently open-weight while withholding training data, and recommends treating such systems as proprietary software with incomplete provenance absent full transparency. Aimed primarily at federal agencies, with recommendations to maintain component inventories and monitor them across the lifecycle, but directly applicable to any organization pulling open-weight models into a product. (Help Net Security,Homeland Security Today)
• NIST releases SP 1353 initial public draft on AI-assisted CSF 2.0 analysis (August 19). A quick-start guide for using generative AI to accelerate Cybersecurity Framework 2.0 assessments and documentation, covering prompt engineering technique, the CO-STAR framework, and worked scenarios. NIST is explicit that this is not an AI security policy but a productivity toolkit, and stresses manual validation of AI outputs and protecting internal data fed into AI tools. The public comment period runs through October 15, 2026, which is a genuine opportunity for anyone whose GRC team has been doing this informally for a year. (Cyber Defense Magazine,Homeland Security Today)
• EU AI Act Article 50 transparency obligations take effect (August 2). AI systems interacting directly with people must disclose that they are AI unless it is obvious from context, synthetic image, audio, video, and text output must carry machine-readable marking, and emotion recognition and biometric categorization systems must notify affected individuals. Penalties reach €15 million or 3 percent of global annual turnover. The obligations apply to providers serving the EU market regardless of where they are established. High-risk system obligations covering employment, education, biometrics, migration, and border management were postponed to December 2, 2027. (Al Jazeera,JD Supra)
• Dutch NIS2 transposition takes effect (August 15) and the EU Cyber Resilience Act reporting clock starts September 11. The Netherlands’ Cyberbeveiligingswet came into force on August 15 with no general transition period, changing which entities fall in scope. Germany’s NIS2 registration deadline passed on July 31. Ahead of both, the European Commission published CRA application guidance on July 27, with manufacturer obligations beginning September 11: actively exploited vulnerabilities and severe incidents in products with digital elements must be reported within a 24-hour early warning and a 72-hour follow-up. Practitioners are calling the resulting overlap “four clocks, one incident,” because a single event can simultaneously trigger CRA, NIS2, GDPR, and sector notification duties on different timers. If you sell connected products into the EU, the deliverable due now is a single incident-notification runbook that fires all four clocks from one decision point. (JD Supra,IAPP,JD Supra)
• The Cybersecurity Information Sharing Act of 2015 expires September 30. The statute providing liability protection for private entities sharing cyber threat indicators with the government and with each other, the legal foundation under CISA’s Automated Indicator Sharing program and much ISAC participation, lapses at the end of September, with renewal reportedly folded into the 2027 NDAA pending Senate action. Without it, sharing threat data creates litigation and regulatory exposure that did not exist before, which moves the decision out of the SOC and onto the CFO and general counsel. Any organization that currently shares indicators should have that conversation in September rather than October. (Global Finance Magazine)
• CISA runs three-day KEV deadlines throughout August under BOD 26-04. August’s KEV additions came in a near-continuous stream with remediation windows compressed to three days for the actively exploited entries: Zimbra on August 21 (due August 24), Oracle HTTP Server and WebLogic Proxy Plug-in on August 24 (due August 27), Gitea on August 25 (due August 28), Citrix NetScaler on August 26 (due August 29), and ownCloud plus the Linux kernel IPv6 flaw on August 27 (due August 30), with JFrog Artifactory given until September 10. The same batches added a set of much older CVEs on newly observed exploitation, including CVE-2015-3246 in Red Hat libuser, CVE-2015-5287 in the Automatic Bug Reporting Tool, CVE-2019-1068 in Microsoft SQL Server, CVE-2021-23758 in Ajax.NET Professional, and CVE-2022-0995 in the Linux kernel. If your vulnerability management SLA for KEV entries is still 15 days, it is now roughly five times the federal window for the same flaws. (CISA KEV Catalog,Security Affairs)
• Cloud Security Alliance moves identity to the top of its cloud threat rankings (August 31). CSA’s Top Threats to Cloud Computing 2026, drawn from a survey of 507 security professionals ranking 23 issues, puts inadequate identity and access management at number one, displacing misconfiguration, which fell to fifth. Two AI-specific threats debut in the top ten: AI-enhanced attacks at number two and AI system compromise at number six. That ordering matches what August’s incidents showed. McKesson, the Redact and BlackFile campaigns, and the Claude session hijacking all turned on identity rather than infrastructure misconfiguration. (Campus Technology)
• CMMC Phase II remains paused, but the underlying obligations do not. The Department of Defense suspended CMMC Phase II third-party assessment requirements on July 13, ahead of their scheduled November 10, 2026 start, pending a reform task force review. What did not pause: CMMC Phase I self-assessment, DFARS 252.204-7012 requiring current NIST SP 800-171 scores in SPRS before award, FAR 52.204-21’s fifteen safeguarding requirements, and NIST SP 800-171 Rev. 2 compliance generally. Contractors should use the interim to verify SPRS scores, system security plans, CUI boundaries, and subcontractor flow-down rather than standing down. The 2030 federal post-quantum migration deadline is likewise unaffected. (Forbes)

‍

‍

August patches and vulnerabilities

‍

• Microsoft Patch Tuesday, 398 CVEs (August 11). Microsoft’s second-largest release ever addressed 398 new CVEs: 62 rated Critical, 335 Important, and 1 Moderate. One was confirmed under active attack (CVE-2026-68820) and one was publicly known before the patch (CVE-2026-62832, a Windows User Profile Service elevation of privilege flaw); Krebs on Security also flagged CVE-2026-72971, and counts of publicly disclosed CVEs vary by source between two and three. ZDI’s Dustin Childs opened his review with the observation that “when even Linus Torvalds says that huge updates are the ‘new normal’, it’s time to readjust what we consider a true bug apocalypse,” which is a reasonable frame for a year in which 400-CVE months have stopped being remarkable. (Zero Day Initiative,Krebs on Security)
• Windows DNS Server RCE (CVE-2026-62878, CVSS 9.8). A stack-based buffer overflow in the Windows DNS Server, remotely exploitable without authentication or user interaction. ZDI’s assessment is blunt: “it’s a good ol’ fashioned stack-based buffer overflow that ends up wormable.” This is the single highest-priority item in the August release, and internet-facing DNS servers should be patched ahead of everything else. (Zero Day Initiative)
• Windows Deployment Services TFTP RCE (CVE-2026-62893, CVSS 9.8). Reported through the ZDI program, this flaw allows code execution with no authentication and no user interaction over UDP port 69. TFTP has no authentication mechanism at all, and any WDS server serving Windows Imaging Format files over TFTP is vulnerable. That is the standard PXE boot configuration. ZDI notes it “could easily be used by attackers for lateral movement within an enterprise.” Provisioning infrastructure is rarely internet-facing, but it is almost always reachable from the corporate network. (Zero Day Initiative)
• Microsoft QUIC RCE (CVE-2026-62815, CVSS 9.8). Remote code execution in Microsoft’s QUIC implementation, unauthenticated and requiring no user interaction. QUIC underpins HTTP/3, and ZDI notes roughly 13.5 million websites depend on it, so the exposed surface extends well past Windows Server front ends into any service that negotiated HTTP/3. (Zero Day Initiative)
• Microsoft HPC Pack RCE (CVE-2026-59124, CVSS 9.8) and Exchange Server EoP (CVE-2026-62911, CVSS 8.0). HPC Pack carries a 9.8 unauthenticated RCE that Microsoft rated only Important because the component is not installed by default, while simultaneously listing it as “exploitation more likely.” That combination is worth catching in triage, because a queue sorted on vendor severity will push it down. The Exchange flaw is an authentication bypass leading to privilege escalation that lets an attacker take over the mailboxes of all Exchange users, sending and reading mail and downloading attachments. It was demonstrated at Pwn2Own Berlin, and as ZDI put it, “we handed them working exploits, so this is a real threat.” (Zero Day Initiative)
• Component clusters: SharePoint and Office dominate, Hyper-V is absent. SharePoint took roughly 27 CVEs this month, weighted toward elevation of privilege and spoofing with several RCEs, most clustering at CVSS 8.8. The Office family accounted for somewhere between 55 and 60 CVEs across Excel, Word, PowerPoint, Access, and shared Office graphics components, with most RCEs at CVSS 7.8 alongside a large batch of information disclosure bugs in the 5.5 to 6.5 range. Remote Desktop Client received two notable RCEs, CVE-2026-62824 and CVE-2026-59134, both requiring the victim to connect to a malicious RDP server. Unusually, there were no Hyper-V CVEs at all, a reversal from June’s guest escape cluster. (Zero Day Initiative)
• Adobe: 51 CVEs across 5 bulletins, two at CVSS 10.0 (August 11). ColdFusion (APSB26-90) took 15 CVEs with a maximum CVSS of 10.0 and Campaign Classic (APSB26-123) took 3, also topping out at 10.0; ZDI assigned both its highest deployment priority. Commerce (APSB26-92) received 7 CVEs at up to 9.1, Lightroom Classic (APSB26-94) 11 at up to 8.6, and Content Credentials SDK (APSB26-111) 15 at up to 7.5. Adobe published a second wave on August 25 covering Substance 3D Designer, Sampler, and Painter, Illustrator, Adobe XD, and further Campaign Classic and Content Credentials SDK updates. Server-side ColdFusion remains the highest-risk Adobe deployment in most enterprises. (Zero Day Initiative,Adobe Security Bulletins)
• SAP Security Patch Day: 33 notes, 5 HotNews (August 11). The release included 5 HotNews and 9 High Priority notes. Highest severity was a CVSS 10.0 improper authorization flaw in SAP Commerce Cloud’s Data Hub Adapter enabling arbitrary code execution, followed by a 9.9 code injection flaw in SAP MII, a 9.9 memory corruption bug in NetWeaver’s DIAG protocol parsing, a 9.8 memory corruption flaw in NetWeaver AS ABAP, and a 9.1 server-side template injection in MII. Onapsis Research Labs was credited with six of the MII findings. Note that SAP Commerce Cloud also produced CVE-2026-58231, which was under attack within three days of patch availability. (Onapsis)
• Apple, Android, and Chrome. Apple shipped macOS Tahoe 26.6.1 on August 6, which included the actively exploited Screen Sharing authentication bypass, followed by a cluster on August 17 and 18: iOS and iPadOS 26.6.1, iOS and iPadOS 18.7.10 for older devices, macOS Tahoe 26.6.2, visionOS 26.6.1, and Safari 26.6.1 for Sonoma and Sequoia. Google published the August Android Security Bulletin on August 3 and released Chrome 152 to the stable channel on August 26. (Apple security releases,Android Security Bulletin,Chrome Releases)

‍

‍

About the author

‍

Jordan Darrah is a Security Consultant at Cloud Security Partners. Jordan’s interest in IT started when she was working as a menswear fashion designer and bridal seamstress. Since then, she has built a diverse technical background spanning hardware repair, systems administration, regulatory compliance, and penetration testing.

‍

Currently, Jordan specializes in application and cloud security assessments, where she evaluates system vulnerabilities and conducts penetration tests. Jordan holds multiple industry certifications, including CISSP, eJPT, and CompTIA PenTest+. She also runs an OSCP study group and maintains a blog where she breaks down concepts and tools for new security professionals.

‍