Industrial Control Systems (ICS)
New Nozomi Networks research, unveiled at Black Hat, shows how unprotected TSN (Time-Sensitive Networking) protocols could let attackers disrupt or manipulate physical processes in OT networks. It is lab research, not an active campaign, and segmentation is the first defense.
Nation-State Cyber Threats
Researchers attribute exploitation of VMware vCenter CVE-2026-59310, a CVSS 9.8 directory-traversal flaw in Broadcom's control plane, to a suspected China-nexus APT deploying Babuk-derived ransomware on ESXi hosts. Patching alone may not evict an established intruder.
Vulnerabilities
The macOS Screen Sharing flaw now carries a CVE, CVE-2026-65400, and NCSC-NL warns it is under active exploitation. Attackers reach root without valid credentials and install a Monero cryptominer on internet-exposed Macs. Apple's fix shipped August 6; patch and close port 5900.
Vulnerabilities
Wireshark 4.6.8 lands with fixes for 28 vulnerabilities and 25 bugs. Every one of the 28 is a dissector or file-parser crash, not remote code execution, but because analysts open untrusted captures on their own machines, patching and sandboxing both matter.
Vulnerabilities
Rapid7 shipped 13 new Metasploit modules on August 14, led by the Fragnesia Linux kernel LPE (CVE-2026-46300) plus unauthenticated RCE modules for Langflow, WordPress core, Joomla JCE, and SonicWall SMA1000. Treat every named product as a patch-priority check.
Vulnerabilities
A pre-authentication flaw in macOS Screen Sharing, CVE-2026-65400, lets a network attacker log into any Mac without a password. Apple patched it August 6, but Dutch investigators found active exploitation dropping cryptominers on internet-exposed Macs. Patch and close port 5900 now.
Supply Chain Attack
The 2,500-organization compromise reported this week did not start with LiteLLM. It started with Trivy, Aqua Security's open-source scanner, and more than 95% of affected companies were exposed before any malicious LiteLLM package shipped.
Vulnerabilities
A landmark week for offensive-cyber policy in the US and Germany, an autonomous AI agent confirmed at Taiwan's nuclear safety regulator, Microsoft's 421-CVE Patch Tuesday and its exploitation wave, plus a run of breaches, supply-chain hits, and botnet upgrades.
Vulnerabilities
Two flaws tied to recent patch cycles are under active attack at once. VMware vCenter CVE-2026-59310 fell five days after Broadcom's disclosure, and SharePoint CVE-2026-55040 after a public proof-of-concept. Neither is in CISA's KEV catalog yet — patch internet-facing systems first.
Vulnerabilities
Fortinet patched high-severity authentication flaws in FortiWeb and FortiManager. One lets a remote attacker log in with random usernames and passwords; the other lets an attacker impersonate any FortiGate managed by FortiManager. No active exploitation is reported — patch now.
Vulnerabilities
Adobe's mid-August release patches three CVSS 10.0 flaws — one in ColdFusion (CVE-2026-48362, an OS command injection) and two in Campaign Classic — alongside a critical Commerce fix. No exploitation is known yet, but Adobe rates the updates Priority 1 and advises patching within 72 hours.
Nation-State Cyber Threats
Check Point pins the exploited afd.sys zero-day, CVE-2026-68820, on North Korea's Lazarus Group. In this wave of Operation Dream Job, the attackers used a post-quantum handshake to shield exploit delivery before dropping the ForestTiger backdoor. CISA set an August 25 patch deadline.