Vulnerabilities & Patching
Attackers are opportunistically exploiting two unauthenticated bypasses in the miniOrange SAML 2.0 SSO plugin, CVE-2026-61979 and CVE-2026-15981, to sign in as any WordPress user including administrators. A silent, multi-edition patch means your dashboard may wrongly report you as safe.
Law Enforcement
INTERPOL's eight-month Operation Jackal IV led to 58 arrests and 263 identified suspects across 22 countries, and exposed a 196-person crime-as-a-service network in Argentina that rented domains and laundering to West African fraud groups like Black Axe.
Industrial Control Systems (ICS)
CISA's red team got initial access to both a water utility and a government organization using nearly identical tradecraft. The water sector isolated and shut it down in minutes. The government sector never detected it. Detection and isolation, not prevention, decided the outcome.
Nation-State Cyber Threats
The US Treasury sanctioned five Mabna Institute hackers and 30 crypto wallets under Operation Economic Outcast, an expansion of its Iran campaign that also names whole sectors and hands financial-services and crypto compliance teams an urgent screening job.
Phishing
ANY.RUN says the commercial Mirage2FA toolkit hit roughly 4,500 US and EU companies from 2024 to 2026, letting Microsoft 365 users finish a normal login before stealing the authenticated session. It bypasses 2FA, and 48% of targeted addresses were potentially compromised.
Vulnerabilities & Patching
The Shadowserver Foundation has confirmed at least 274 internet-facing Zimbra servers compromised through CVE-2026-73570, the code-injection flaw Synacor patched in ZCS v10.1.20 on July 20. Here is how defenders should triage patching and hunt for signs of compromise.
Artificial Intelligence (AI)
Oasis Security disclosed a weakness in NVIDIA NemoClaw that lets an attacker-controlled webpage seize the unauthenticated local Ollama server behind an AI agent and plant hidden instructions inside the model. Reported to NVIDIA PSIRT, with the CVE and patch status still murky.
CISA added CVE-2026-21962, a maximum-severity Oracle HTTP Server and WebLogic Proxy Plug-in flaw, to its Known Exploited Vulnerabilities catalog with a three-day federal deadline. Oracle shipped the fix in January 2026, but unauthenticated HTTP exploitation has run for months. Patch and hunt now.
Alabama Attorney General Steve Marshall has subpoenaed OpenAI over the Hugging Face hack its own cybersecurity model caused, opening the first state-level investigation into whether the company's safety failures violated consumer-protection law.
A suspected Iran-linked cyberattack kept a small UK power plant offline for four days in July 2026, the same month more than 30 US water utilities were hit. The government says the wider grid was never at risk. Here is what defenders should verify.
The Dutch Data Protection Authority hit Uber with an EUR 825 million fine (about USD 1 billion), ruling that software deactivated driver accounts from 2018 to 2022 with no human review. Uber is appealing. Here is what platform operators should audit now.
Red Hat and the Keycloak project have patched CVE-2026-18963, a CVSS 9.1 flaw in the reset-credentials flow that let an unauthenticated attacker reset any user's password and seize the account, administrators included. Fixed in Keycloak 26.7.2, 26.6.6, and 26.4.15.
AWS attaches a quarantine policy to keys it detects as leaked, but Corey Quinn argues in The Register that the deny-list still lets an attacker assume other roles, destroy audit logs, read secrets, and lock storage. Treat a leaked key as a full compromise.
An independent Guidelight assessment graded five frontier AI labs on six control practices and found few publicly documented plans for containing a rogue model. The scores measure public disclosure, not private preparedness, but only OpenAI cleared even a partial mark on containment.
New Nozomi Networks research, unveiled at Black Hat, shows how unprotected TSN (Time-Sensitive Networking) protocols could let attackers disrupt or manipulate physical processes in OT networks. It is lab research, not an active campaign, and segmentation is the first defense.
The U.S. Justice Department says TikTok and ByteDance will pay $400 million to resolve a 2024 child-privacy lawsuit alleging COPPA violations. The deal pays $300 million now and $100 million once a court vacates an earlier Musical.ly consent decree.
Wiz researchers linked the crates.io compromise of three Rust crates to recent North Korean supply-chain operations, pointing to command-and-control infrastructure shared with the Mastra and axios npm attacks. It is a strong lead built on overlap, not a confirmed verdict.
Researchers at Abnormal documented iAuthFlow V2, a $10,000 phishing toolkit that registers an attacker-controlled passkey on a compromised account. Because a passkey is a credential, not a password token, it survives the reset and session revocation that normally evict a phisher.
Trend Micro's TrendAI team disclosed 14 trojanized npm packages that pose as calendar and streak utilities while dropping RedC2 4.0, a cross-platform Linux backdoor with AI-assisted command-and-control. Here is what the disclosure confirms, what it does not, and what defenders should audit now.