These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional —
let us know and we'll correct or remove it.
CISA, the NSA, the FBI, the Department of Energy and the EPA issued a joint advisory confirming, for the first time in a government cybersecurity bulletin, that threat actors are using AI-generated scripts to attack internet-exposed Siemens S7 Series PLCs. Attackers scan with tools like Censys and ZoomEye to find controllers with the S7comm port open, then use AI to generate Python scripts that read and rewrite the logic controlling physical industrial processes. Siemens S7 controllers run water, energy and manufacturing sites across Europe as much as the US, and the barrier to writing a working exploit just dropped for everyone.
Citrix has patched CVE-2026-19490, a critical authentication bypass in NetScaler ADC and NetScaler Gateway that lets an unauthenticated remote attacker slip past login controls on appliances configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or as an AAA virtual server. With a CVSS v4.0 score of 9.3 and NetScaler’s long history of being mass-exploited within days of disclosure, security researchers and even NHS England have told organisations to patch on an emergency basis rather than wait for a routine maintenance window.
Varonis Threat Labs disclosed CoSnitch, a critical Microsoft Copilot Personal flaw that let a single clicked link silently exfiltrate data from a victim’s connected accounts. Microsoft patched it on August 18, 2026, almost eight months after being told, and the discovery method was as notable as the bug itself: researchers prompted Copilot to explain why the attack would not work, and its own answers mapped out the undocumented parameter that made it work. It is the third Copilot vulnerability Varonis has found this year.
Mandiant has disclosed details of its Agentic Vulnerability Discovery Harness, an internal tool that chains specialised AI agents together to hunt for exploitable flaws in source code. In one incident response case involving stolen corporate repositories, AVDH surfaced more than 100 critical, verified vulnerabilities in two days, a task that would take a manual review team weeks. Across ten months of use on tens of millions of lines of code, it has already produced twelve assigned CVEs. The lesson for any organisation running its own code is uncomfortable, whatever a well-resourced attacker can now do to code they steal, they can do fast.
CISA, the FBI and the US Department of Health and Human Services have issued an updated joint advisory on Medusa ransomware, confirming the group has breached more than 500 critical infrastructure organisations since it first appeared in 2021. Medusa runs a double-extortion model with a 48-hour ransom deadline and recruits initial access brokers on criminal forums for between 100 and 1 million dollars a network. Separate 2026 tracking data shows Medusa accounts for 9 percent of all reported UK ransomware victims, against 2 percent worldwide, making this an advisory European incident response teams should read closely, not skim.
A new proof of concept called ShieldBreak, tracked as CVE-2026-69414, bypasses the patch Microsoft shipped in July for RoguePlanet, an earlier Windows Defender privilege escalation flaw. Where RoguePlanet was an unreliable race condition, ShieldBreak reportedly gets a local attacker to SYSTEM with a 100 percent success rate on Windows 11 25H2 and Windows Server 2025. Microsoft has assigned a CVSS score of 7.8 and flagged exploitation as more likely, but has not published a fix, a workaround, or a list of affected builds.
France’s Direction Generale des Finances Publiques disclosed on August 14 that an attacker used stolen or impersonated credentials belonging to a DGFiP employee and an authorised third party to access tax and property records on 678,000 individuals and businesses, after a threat actor calling itself ZeroBytes listed the data for sale on a hacking forum on August 12. The intrusion ran undetected through June and July before DGFiP disabled the affected accounts and notified CNIL, France’s data protection authority. No exotic exploit was needed, just credentials that worked.
Check Point Research has uncovered a new wave of Operation Dream Job, a long-running Lazarus Group campaign that impersonates recruiters and privacy technology company Enveil to target defence, aerospace and aviation organisations, with documented compromises at companies headquartered in France and Germany. Targets are told to download SecurityPDF, a trojanized PDF viewer that checks documents for a hidden marker and, when found, decrypts and launches a Windows zero-day exploit chain that installs a new variant of the FudModule rootkit. Microsoft patched the underlying flaw, CVE-2026-68820, on August 11, roughly two months after Lazarus began using it.
A threat actor using the handle TheHatman is selling millions of employee records allegedly pulled from the Azure and Entra tenants of Fortune 500 organisations including Vodafone, McDonald’s, TCS, HCL Technologies and IHG, with the McDonald’s dataset alone running past 1.7 million records. Researchers at Hudson Rock have traced the access to compromised credentials tied to infostealer malware infections on employee machines at several of the affected companies, not a flaw in Azure itself. For any organisation running its identity infrastructure on Azure AD or Entra ID, the exposure was sitting on an endpoint, not in Microsoft’s cloud.
CISA added CVE-2025-62593, a code injection flaw in the Ray AI compute framework, to its Known Exploited Vulnerabilities catalog on August 17, 2026, citing evidence of active exploitation. The bug lets an attacker combine a trivial User-Agent header bypass with a DNS rebinding attack so that simply visiting a malicious webpage in Firefox or Safari can hand a remote attacker code execution on a developer’s local Ray instance, no exposed dashboard required. It follows the 2024 ShadowRay campaign, which found thousands of Ray clusters compromised for crypto mining and credential theft after being left open to the internet with no authentication at all.
This site uses cookies. By continuing to use this website, you agree to their use.
We’ll help you resolve your infrastructure challenges
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
