These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional —
let us know and we'll correct or remove it.
CVE-2026-8452, a memory overflow in NetScaler ADC and Gateway appliances running VPN or AAA virtual servers, was patched as a denial-of-service fix but has now been confirmed as an unauthenticated path to remote code execution as root. CISA added it to its Known Exploited Vulnerabilities catalogue on August 26 with a federal remediation deadline of August 29, and defenders have already found webshells planted on compromised appliances. More than 22,000 NetScaler ADC instances and nearly 1,800 Gateway instances remain internet-exposed with unknown patch status.
CVE-2026-60004 lets anyone who can create an account on a Gitea instance execute arbitrary shell commands as the Gitea service account, by submitting a malicious patch through the diffpatch API endpoint. Because Gitea ships with self-registration enabled by default, an attacker needs no prior credentials at all, just the ability to sign up. CISA has confirmed active exploitation, including a cryptocurrency-miner-style payload, and Shadowserver counts more than 8,300 internet-facing Gitea instances still unpatched against the fix in version 1.27.1.
Researchers have disclosed HOOKEDGE, a previously undocumented Windows backdoor attributed with moderate confidence to the Russian state-sponsored group APT28, used in a diplomatic-themed phishing campaign against government and diplomatic organisations in Romania, Spain and Turkiye between September 2025 and April 2026. Delivered through macro-enabled Word documents, HOOKEDGE routes its command-and-control and data exfiltration through webhook.site, a legitimate free service developers use for testing webhooks, letting malicious traffic blend into ordinary web activity that most security tools have no reason to block.
The Rhysida ransomware group claims to have stolen 5.79 terabytes of Berlin state agency data, including 46,500 contracts, emails, phone numbers and passwords, and is auctioning it starting at 30 bitcoin after the city refused to pay. The attack lands less than a month before Berlin’s September 20 election, and it is the latest in a long run of Rhysida attacks on European government and public-sector targets.
CISA has added CVE-2023-49105, a critical WebDAV authentication bypass in the German-built ownCloud file-sync platform, to its Known Exploited Vulnerabilities catalog after attackers used it to exfiltrate files from a nuclear research body. The flaw has been public and patchable since early 2024, and CISA’s deadline for federal remediation is August 30, 2026, tomorrow. Any organisation self-hosting ownCloud for the data sovereignty it offers needs to confirm it is not still running an unpatched core.
Mirage2FA, a phishing-as-a-service kit active since 2024, has surged to compromise thousands of Microsoft 365 accounts across 3,500-plus organisations in the US and EU as of August 2026. Its adversary-in-the-middle proxy relays the password and one-time code straight to Microsoft in real time, then keeps the resulting session cookie, which means a password reset alone does not remove the attacker. Technology, manufacturing, and MSSPs are the hardest-hit sectors.
CISA added CVE-2026-33824, a CVSS 9.8 unauthenticated remote code execution flaw in Windows IKE Service Extensions, to its Known Exploited Vulnerabilities catalog on August 18, four months after Microsoft patched it in April. Palo Alto Networks Unit 42 observed a Chinese-speaking threat actor manually sending reverse-shell callbacks to three IKE VPN endpoints, hands-on-keyboard activity against selected VPN concentrators rather than opportunistic scanning, a pattern that points toward espionage staging and initial access brokering rather than smash-and-grab ransomware.
ENISA’s Threat Landscape data shows phishing accounts for roughly 60 percent of initial intrusions across the EU, and countries that made DMARC enforcement mandatory saw phishing success rates fall from 69 percent to 14 percent, while countries without a mandate stayed high. NIS2 now treats email authentication as a supervised control rather than a best practice, with fines reaching 10 million euros or 2 percent of global turnover for essential and important entities, and Germany’s national NIS2 law took effect on December 6, 2025. Despite that, most organizations still have a DMARC record without ever moving it to enforcement, which is where the actual protection lives.
SAP patched CVE-2026-58231, a maximum-severity CVSS 10.0 unauthenticated remote code execution flaw in SAP Commerce Cloud, on August 11. By August 14, honeypots run by security researcher Defused Cyber were already recording exploitation attempts, despite no public proof-of-concept existing at the time. SAP Commerce Cloud underpins large-scale B2B and B2C sales operations at companies including Mercedes-Benz, Shell and BP, and the flaw lets an unauthenticated attacker abuse a default authentication client to run arbitrary code on internet-facing instances.
Two consecutive hardware failures in Hetzner’s NBG object storage cluster overwhelmed automatic redundancy for a subset of data, forcing Hetzner to take roughly a third of the cluster offline for manual restoration to avoid permanent loss. The incident began August 25 and Hetzner targeted a fix by August 26 at 11:00 CEST, with affected buckets inaccessible in the meantime. For any team treating a single object storage provider as its only copy of critical data, this is the scenario that redundancy promises are supposed to prevent, and sometimes cannot.
This site uses cookies. By continuing to use this website, you agree to their use.
We’ll help you resolve your infrastructure challenges
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
