Actual cyberattacks and active incidents including intrusions, ransomware, phishing and identity attacks, malware and APT campaigns, DDoS, supply-chain compromise and data theft. Vulnerability-only advisories stay in Vulnerabilities unless the reporting describes the attack or campaign using them.
CVE-2026-76197 affects Adobe Campaign Classic (ACC). The flaw is described as a command injection vulnerability.
CVE-2026-6471 affects the affected technology before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24. The available advisory information identifies before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 as affected versions.
CVE-2026-76581 affects the affected technology. The flaw is described as a authentication weakness vulnerability.
CVE-2026-82448 affects Shinobi before commit 5a76c74f. The published description indicates a remote or untrusted-network exploitation path.
CVE-2026-74820 affects ServiceNow. The published description indicates a remote or untrusted-network exploitation path.
CVE-2026-53362 affects Hugging Face. The company says the breach stemmed from a systemic failure of alignment and security, and has taken measures to prevent agents from independently orchestrating complex cyberattacks.
CVE-2026-47103 affects Python StateMachine. The reported consequence is code execution, meaning successful exploitation could make the affected application or process run attacker-controlled code.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. But the threat already exists, as attackers use the "harvest now, decrypt later" tactic.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Action1 explains why defenders increasingly need to correlate multiple intelligence sources and turn vulnerability data into faster remediation.
CVE-2023-49105 affects the affected technology. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.
CVE-2026-5097 affects The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all up to, and including, 2.4.17. This is The wpForo Forum plugin for WordPress. The published description indicates a remote or untrusted-network exploitation path.
CVE-2026-76639 affects the affected technology. The reported consequence is code execution, meaning successful exploitation could make the affected application or process run attacker-controlled code.
Key Reasons Why Identity Fabric Matters in 2026. As enterprise access spans more cloud services and automated workloads, identity security depends less on static configuration and more on runtime visibility.
CVE-2026-74232 affects the affected technology. The published description indicates a remote or untrusted-network exploitation path.
CVE-2026-65643 affects the affected technology. The reported consequence is code execution, meaning successful exploitation could make the affected application or process run attacker-controlled code.
CVE-2026-78032 affects SOY CMS. The issue currently carries a CRITICAL 9.3 severity signal in the CyberDeltaForce record.
Some Malicious PE Stats, (Thu, Aug 27th). 32bits malware[ 1 ].
A security weakness in the affected technology is being tracked as a newly reported vulnerability. The issue currently carries a High severity signal in the CyberDeltaForce record.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Every 2026 assessment covers them.
ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories. Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Key takeaways Security tool sprawl and data silos make it difficult for CISOs to holistically and a.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Federal Trade Commission statistics show over 1 million identity theft reports annually, with related fraud and imposter scams accounting for billions in financial losses each year.
A security weakness in Windows is being tracked as a newly reported vulnerability. The security flaw, which does not have a CVE identifier, works against Kiro IDE 0.7.45 on Windows, according to Mindguard.
CVE-2026-74662 affects the Linux kernel, the following vulnerability. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published.
CVE-2025-10263 affects the affected technology. The issue currently carries a CRITICAL 9.1 severity signal in the CyberDeltaForce record.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. AI is changing the harder part: how much time defenders have left to act.
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks. Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever.
What the Data Says About AI in Security Operations in 2026. According to Prophet Security's State of AI in Security Operations 2026 report (produced from ViB’s survey of 250+ cybersecurity pros), 40% of security teams now use AI daily.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims.
A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th). As I've mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.
ATF confirms “major incident” after recent Qilin breach claims. The Bureau of Alcohol, Tobacco, Firearms and Explosives has described it as a ‘major incident’ and it’s conducting an investigation with the DOJ.
CVE-2019-1068 affects Citrix NetScaler. The reported consequence is code execution, meaning successful exploitation could make the affected application or process run attacker-controlled code.
Caught in 4K: The Aurora Files. A misconfigured server opened a window straight into an Aurora ransomware operator's playbook: attacker tools, AI-assisted planning, and a look inside the actual negotiation panel where a victims and the operator settled on payment.
A security weakness in Hugging Face is being tracked as a newly reported vulnerability. The analysis maps the published incident to Qualys Container Runtime Security, Kubernetes Security Posture Management, and Cloud Detection.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. That assumption creates unnecessary operational pressure.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. A new joint study by Tenable and SentinelOne reveals how state and criminal groups converge on the same vulnerable edge infrastructure.
CVE-2026-60004 affects the affected technology. The reported consequence is code execution, meaning successful exploitation could make the affected application or process run attacker-controlled code.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Pretty much any software accepting an IP address will also accept a hostname as an argument.
Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication.
CVE-2026-21962 affects the affected technology. The published description indicates a remote or untrusted-network exploitation path.
CVE-2026-69414 affects the affected technology. A public PoC was released on August 12, 2026, and Microsoft assigned the CVE on August 14, and no patch is available yet.
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha).
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor. The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs.
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam.
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia. Examples of these techniques can be found.
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities. The reporting includes an identity or credential element, which matters because a valid account or session can let an attacker move through trusted systems without relying only on malware.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.
BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory and using public infrastructure for reconnaissance and ...
AI-Agent-Driven Offensive Operation : Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign Leading to Mass Wallet and Credential Compromise. The exposed infrastructure also revealed a developing blockchain-based command-and-control system designed to make future operations mo...
A security weakness in the affected technology is being tracked as a newly reported vulnerability. By structuring the analysis process, enforcing skeptical validation steps, and injecting domain-specific huma.
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Organisations now depend on cloud applications, digital platforms, connected devices, third-party vendors, social media, and online customer channels to deliver products and services.
A security weakness in Azure is being tracked as a newly reported vulnerability. Tenable One Cloud Exposure uses AI-powered threat stories to expose Storm-0501 TTPs, backed by precision-engineered threat detection alerts.
17th August – Threat Intelligence Report. TOP ATTACKS AND BREACHES Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegra...
A security weakness in the affected technology is being tracked as a newly reported vulnerability. The Taiwan autonomous AI cyber attack confirmed what the cluster data already showed: near-autonomous offensive AI has crossed from theoretical risk to operational reality.
The State of Ransomware Q2 2026. Ransomware or extortion is part of the impact, which means the incident also involves disruption, recovery pressure or leverage over the affected organization.
A security weakness in Windows is being tracked as a newly reported vulnerability. The available description indicates that the vulnerable path can be reached remotely or from an untrusted network, so the exposure of Windows becomes part of the attack condition.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. There is no reported-exploitation flag in the current CyberDeltaForce record, so the public picture at this point is a disclosed vulnerability with known exploitation conditions rather than a confir...
LiteLLM Supply Chain Attack: 2,500+ Companies Exposed in the Largest AI Supply Chain Breach of 2026. The security significance comes from trust: Trivy or the affected component sits in a software, development or delivery path that downstream teams may already allow to run automatically.
Brand Protection in Cybersecurity: Protecting Businesses from Digital Threats. It represents the trust customers place in a business, the reputation it has built, and the digital experiences associated with its name.
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments. Telemetry and infrastructure analysis reveal that rather than disbanding, UNC6671 has diversified its operations across multiple extortion fronts.
CVE-2026-18577 affects the affected technology. The published description indicates a remote or untrusted-network exploitation path.
Access For Sale: Inside a Russian-Speaking Access Broker's Dual Operation. The investigation connects credential theft, Active Directory compromise, and access sales to ransomware groups, while also uncovering surveillance activity targeting Ukrainian defence and aerospace organizations.