Ticker feed
Six US and South Korean agencies, including CISA, the FBI, the NSA, and Korea's National Police Agency, issued joint advisory AA26-222A on Monday, August 10, about Gunra, a ransomware gang that emerged in spring 2025 and has been hitting critical infrastructure worldwide. Built on leaked Conti source code, it added a Dark Web affiliate program in early 2026.
The FBI observed Gunra exploiting two Fortinet authentication bypass flaws — CVE-2024-55591 (CVSS 9.8, critical) and CVE-2025-24472 (8.1, high) — to gain initial access. Both affect FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12, and both have been in CISA's KEV catalog since early 2025, with deadlines that expired in January and April that year.
Attackers also hijacked VPN sessions, stole cookies, and modified authentication processing files on the corporate VDI portal server so that one Gunra-designated one-time password value always succeeded, leaving every login looking legitimate to the identity provider. Backups at both the primary data center and the disaster recovery site were deleted before encryption.
The advisory does carry a recovery route for Linux victims. Breakglass Intelligence found that Gunra's Linux build seeds its random number generator with srand(time(NULL)) — the system clock in seconds when encryption began — allowing the key to be reconstructed from the encrypted files' timestamps. Rebooting, overwriting, or wiping the system destroys that option.
Victims span healthcare, finance, manufacturing, transportation, and government, from South Korea and Brazil to Spain, Australia, and North America. Agencies urge upgrading FortiOS to 7.0.17 or later and FortiProxy to 7.0.20 or 7.2.13, maintaining immutable backups in physically separate locations, and network segmentation.
Source: Dark Reading
Six US and South Korean agencies, including CISA, the FBI, the NSA, and Korea's National Police Agency, issued joint advisory AA26-222A on Monday, August 10, about Gunra, a ransomware gang that emerged in spring 2025 and has been hitting critical infrastructure worldwide. Built on leaked Conti source code, it added a Dark Web affiliate program in early 2026.
The FBI observed Gunra exploiting two Fortinet authentication bypass flaws — CVE-2024-55591 (CVSS 9.8, critical) and CVE-2025-24472 (8.1, high) — to gain initial access. Both affect FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12, and both have been in CISA's KEV catalog since early 2025, with deadlines that expired in January and April that year.
Attackers also hijacked VPN sessions, stole cookies, and modified authentication processing files on the corporate VDI portal server so that one Gunra-designated one-time password value always succeeded, leaving every login looking legitimate to the identity provider. Backups at both the primary data center and the disaster recovery site were deleted before encryption.
The advisory does carry a recovery route for Linux victims. Breakglass Intelligence found that Gunra's Linux build seeds its random number generator with srand(time(NULL)) — the system clock in seconds when encryption began — allowing the key to be reconstructed from the encrypted files' timestamps. Rebooting, overwriting, or wiping the system destroys that option.
Victims span healthcare, finance, manufacturing, transportation, and government, from South Korea and Brazil to Spain, Australia, and North America. Agencies urge upgrading FortiOS to 7.0.17 or later and FortiProxy to 7.0.20 or 7.2.13, maintaining immutable backups in physically separate locations, and network segmentation.
Source: Dark Reading
Supporters of Yorkshire's Brain Tumour Charity were emailed on 12 August: an unauthorised third party had reached Beacon CRM, the database the Leeds charity uses, and exported all of it — names, addresses, donation records and health information. Beacon detected the intrusion on 29 July and warned customers on 4 August.
This isn't a YBTC problem. Beacon told every customer to assume all data stored in the platform has been downloaded. Sheffield Hospitals Charity was caught in the same incident. Beacon put the affected organizations at more than 1 000; later reporting puts it nearer 1 500 — close to its whole customer base. How many individuals, nobody knows.
The likely way in was an AWS access key exposed in publicly accessible JavaScript on Beacon's own site, embedded there by automated build tooling. Beacon says it has fixed the vulnerability, rotated its keys, forced password resets and added monitoring, and that no unauthorized access remains.
YBTC chief executive David Grant-Roberts says there's no evidence the data has been published, disclosed or otherwise misused, and asks supporters to be wary of unexpected emails, calls or texts mentioning YBTC, Beacon or donations. Affected charities have their own duty: report to the ICO within 72 hours, and the Charity Commission published guidance on 7 August.
Source: BBC News
Supporters of Yorkshire's Brain Tumour Charity were emailed on 12 August: an unauthorised third party had reached Beacon CRM, the database the Leeds charity uses, and exported all of it — names, addresses, donation records and health information. Beacon detected the intrusion on 29 July and warned customers on 4 August.
This isn't a YBTC problem. Beacon told every customer to assume all data stored in the platform has been downloaded. Sheffield Hospitals Charity was caught in the same incident. Beacon put the affected organizations at more than 1 000; later reporting puts it nearer 1 500 — close to its whole customer base. How many individuals, nobody knows.
The likely way in was an AWS access key exposed in publicly accessible JavaScript on Beacon's own site, embedded there by automated build tooling. Beacon says it has fixed the vulnerability, rotated its keys, forced password resets and added monitoring, and that no unauthorized access remains.
YBTC chief executive David Grant-Roberts says there's no evidence the data has been published, disclosed or otherwise misused, and asks supporters to be wary of unexpected emails, calls or texts mentioning YBTC, Beacon or donations. Affected charities have their own duty: report to the ICO within 72 hours, and the Charity Commission published guidance on 7 August.
Source: BBC News
A critical Microsoft SharePoint Server flaw (CVE-2026-55040, CVSS 9.1) is drawing exploitation attempts after Rapid7 published proof-of-concept code on August 11, 2026. Discovered by Rapid7 senior principal researcher Stephen Fewer, it lets unauthenticated attackers forge JWT tokens and assume the identity of any SharePoint site user or administrator — no credentials needed.
Microsoft rescored its advisory from medium to critical on the day it shipped the fix. An attacker needs to know the account they're impersonating, but Rapid7's script enumerates Active Directory SIDs to find the site administrator itself. SharePoint Online isn't affected.
Worse, the bypass is half of a chain Rapid7 built for full unauthenticated remote code execution. The other half, CVE-2026-63520 (CVSS 8.1, High), was patched only on August 11, and it also hits Project Server and Office Web Apps Server — Microsoft split the fix across two cycles, so July's update closes the bypass and nothing more.
Exploitation so far is telemetry, not confirmed victims: Defused saw Rapid7's PoC fired at its SharePoint honeypots within a day, and KEVIntel sensors have logged attempts since July 19. Microsoft hasn't confirmed in-the-wild exploitation, and it isn't in CISA's KEV catalog.
Patch both. July's fix is KB5002882 (Subscription Edition, build 16.0.19725.20434), KB5002883 (Server 2019, 16.0.10417.20175) and KB5002891 (Enterprise Server 2016, 16.0.5561.1001); August's updates take those to 16.0.19725.20522, 16.0.10417.20198 and 16.0.5565.1001. If you haven't applied either, time to do it now.
Sources: The Hacker News | Rapid7
A critical Microsoft SharePoint Server flaw (CVE-2026-55040, CVSS 9.1) is drawing exploitation attempts after Rapid7 published proof-of-concept code on August 11, 2026. Discovered by Rapid7 senior principal researcher Stephen Fewer, it lets unauthenticated attackers forge JWT tokens and assume the identity of any SharePoint site user or administrator — no credentials needed.
Microsoft rescored its advisory from medium to critical on the day it shipped the fix. An attacker needs to know the account they're impersonating, but Rapid7's script enumerates Active Directory SIDs to find the site administrator itself. SharePoint Online isn't affected.
Worse, the bypass is half of a chain Rapid7 built for full unauthenticated remote code execution. The other half, CVE-2026-63520 (CVSS 8.1, High), was patched only on August 11, and it also hits Project Server and Office Web Apps Server — Microsoft split the fix across two cycles, so July's update closes the bypass and nothing more.
Exploitation so far is telemetry, not confirmed victims: Defused saw Rapid7's PoC fired at its SharePoint honeypots within a day, and KEVIntel sensors have logged attempts since July 19. Microsoft hasn't confirmed in-the-wild exploitation, and it isn't in CISA's KEV catalog.
Patch both. July's fix is KB5002882 (Subscription Edition, build 16.0.19725.20434), KB5002883 (Server 2019, 16.0.10417.20175) and KB5002891 (Enterprise Server 2016, 16.0.5561.1001); August's updates take those to 16.0.19725.20522, 16.0.10417.20198 and 16.0.5565.1001. If you haven't applied either, time to do it now.
Sources: The Hacker News | Rapid7
A March 2026 supply chain attack on LiteLLM, an open source Python library, exposed more than 2,500 organizations and 434,000 CI/CD pipelines — with the malicious packages live on PyPI for only about 40 minutes. CloudSEK calls those figures reconstructed exposure, not proof that any given organization was breached.
It came in sideways. Attackers took over the release process for Aqua Security's Trivy scanner via a leaked automation token, and LiteLLM's CI pipeline installed Trivy without pinning it to a verified version. The tainted scanner then pushed two poisoned releases, 1.82.7 and 1.82.8, to PyPI.
The payload shipped as a .pth file, so it ran at Python startup with no import needed, anywhere the package was merely installed — putting cloud keys, SSH keys, repository tokens, Kubernetes secrets and AI provider keys in reach. Nvidia, AWS, Samsung, Cisco and Volkswagen appear on CloudSEK's exposure list.
Public reporting attributes the wider campaign to the financially motivated cluster TeamPCP, which never targeted LiteLLM directly, and the FBI issued a FLASH alert on it in July. If you shipped either version, treat every secret that process could reach as compromised and rotate it — then pin your dependencies.
Source: SecurityWeek
A March 2026 supply chain attack on LiteLLM, an open source Python library, exposed more than 2,500 organizations and 434,000 CI/CD pipelines — with the malicious packages live on PyPI for only about 40 minutes. CloudSEK calls those figures reconstructed exposure, not proof that any given organization was breached.
It came in sideways. Attackers took over the release process for Aqua Security's Trivy scanner via a leaked automation token, and LiteLLM's CI pipeline installed Trivy without pinning it to a verified version. The tainted scanner then pushed two poisoned releases, 1.82.7 and 1.82.8, to PyPI.
The payload shipped as a .pth file, so it ran at Python startup with no import needed, anywhere the package was merely installed — putting cloud keys, SSH keys, repository tokens, Kubernetes secrets and AI provider keys in reach. Nvidia, AWS, Samsung, Cisco and Volkswagen appear on CloudSEK's exposure list.
Public reporting attributes the wider campaign to the financially motivated cluster TeamPCP, which never targeted LiteLLM directly, and the FBI issued a FLASH alert on it in July. If you shipped either version, treat every secret that process could reach as compromised and rotate it — then pin your dependencies.
Source: SecurityWeek
North Korea's Lazarus group has been actively exploiting a Windows kernel zero-day, CVE-2026-68820, buried inside AFD.sys — the driver managing network sockets — to deploy an upgraded FudModule rootkit. Microsoft patched the flaw on August 11 following responsible disclosure by Check Point Research. It's the group's second AFD.sys zero-day, after CVE-2024-38193.
The attacks are part of Operation Dream Job, targeting defense, aerospace and aviation sectors across Europe, India and Brazil. Lazarus posed as recruiters to trick employees into opening malicious files, and also seeded SEO-optimised phishing sites pushing a fake "SecurityPDF" app. The payload delivers SYSTEM-level access and FudModule v3.1, which blinds EDR tools and over 90 ETW providers.
Command and control runs through hijacked legitimate sites rather than dedicated servers — Roundcube webmail instances plus WordPress and PrestaShop sites running a web shell called RelayShell, across at least 17 relay nodes.
Windows 11 builds 26100 and 26200 are affected — apply August's Patch Tuesday update immediately, and check outbound traffic to Roundcube and CMS infrastructure.
Source: Cybersecurity News
North Korea's Lazarus group has been actively exploiting a Windows kernel zero-day, CVE-2026-68820, buried inside AFD.sys — the driver managing network sockets — to deploy an upgraded FudModule rootkit. Microsoft patched the flaw on August 11 following responsible disclosure by Check Point Research. It's the group's second AFD.sys zero-day, after CVE-2024-38193.
The attacks are part of Operation Dream Job, targeting defense, aerospace and aviation sectors across Europe, India and Brazil. Lazarus posed as recruiters to trick employees into opening malicious files, and also seeded SEO-optimised phishing sites pushing a fake "SecurityPDF" app. The payload delivers SYSTEM-level access and FudModule v3.1, which blinds EDR tools and over 90 ETW providers.
Command and control runs through hijacked legitimate sites rather than dedicated servers — Roundcube webmail instances plus WordPress and PrestaShop sites running a web shell called RelayShell, across at least 17 relay nodes.
Windows 11 builds 26100 and 26200 are affected — apply August's Patch Tuesday update immediately, and check outbound traffic to Roundcube and CMS infrastructure.
Source: Cybersecurity News
Two sophisticated iPhone exploit chains — Coruna and DarkSword — have escaped nation-state and mercenary containment and are spreading fast among ordinary cybercriminals. iVerify has tracked roughly 17,000 domains hosting second-generation versions of both, with infections continuing months after public disclosure earlier this year.
DarkSword targets iOS 18.4 through 18.6.2 using six known CVEs, stealing everything from iCloud data to crypto wallets. Devices on iOS 18.7.3 or later are not vulnerable. Coruna, the older chain (thought to have cost $30–40M to build), hits iOS 13–17.2.1 via watering-hole attacks. Threat actors are blending both into hybrid variants iVerify has informally dubbed "Darkuna." Researchers expect to see more mass exploitation as the chains spread.
Update to the latest iOS version now — both chains rely on vulnerabilities Apple has already patched.
Source: Dark Reading
Two sophisticated iPhone exploit chains — Coruna and DarkSword — have escaped nation-state and mercenary containment and are spreading fast among ordinary cybercriminals. iVerify has tracked roughly 17,000 domains hosting second-generation versions of both, with infections continuing months after public disclosure earlier this year.
DarkSword targets iOS 18.4 through 18.6.2 using six known CVEs, stealing everything from iCloud data to crypto wallets. Devices on iOS 18.7.3 or later are not vulnerable. Coruna, the older chain (thought to have cost $30–40M to build), hits iOS 13–17.2.1 via watering-hole attacks. Threat actors are blending both into hybrid variants iVerify has informally dubbed "Darkuna." Researchers expect to see more mass exploitation as the chains spread.
Update to the latest iOS version now — both chains rely on vulnerabilities Apple has already patched.
Source: Dark Reading
A critical zero-day in Metabase, the popular open-source business intelligence platform, is being actively exploited in the wild. Tracked as GHSA-vwf4-m7j8-wcjf with a perfect CVSS score of 10.0, the flaw lets unauthenticated attackers inject SQL through the password reset endpoint and promote themselves to full administrator.
Metabase discovered the breach on August 3 after its own cloud platform was compromised. Cloud customers were patched automatically, but self-hosted users must upgrade manually — versions 1.58 (0.58) through 0.63 are affected, with fixes in 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5. At least four companies — Framework, Tally, n8n and Kilo Code — have already reported customer data theft. Admins should patch immediately and treat any instance showing the exploit's log signature as compromised.
Source: Cybersecurity News
A critical zero-day in Metabase, the popular open-source business intelligence platform, is being actively exploited in the wild. Tracked as GHSA-vwf4-m7j8-wcjf with a perfect CVSS score of 10.0, the flaw lets unauthenticated attackers inject SQL through the password reset endpoint and promote themselves to full administrator.
Metabase discovered the breach on August 3 after its own cloud platform was compromised. Cloud customers were patched automatically, but self-hosted users must upgrade manually — versions 1.58 (0.58) through 0.63 are affected, with fixes in 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5. At least four companies — Framework, Tally, n8n and Kilo Code — have already reported customer data theft. Admins should patch immediately and treat any instance showing the exploit's log signature as compromised.
Source: Cybersecurity News
A cyber attack on Beacon CRM has exposed personal data belonging to supporters of Lincoln Cathedral and leisure centre users across Lincolnshire. Beacon became aware of the incident on 29 July and notified customers on 3 August. An unauthorised third party accessed parts of its system and copied database backups — which Beacon says were likely downloaded — holding names, addresses, emails, and phone numbers, but no payment or banking details.
Beacon CRM, used by over 1,000 charities and organisations, brought in external cybersecurity experts and reported the incident to the Information Commissioner's Office. Magna Vitae, which runs leisure centres in Skegness, Horncastle, Mablethorpe, and Louth, also confirmed it was affected. No ransom demand has been made, and there is no evidence the data has appeared online — but affected users are urged to watch for suspicious messages.
Source: BBC News
A cyber attack on Beacon CRM has exposed personal data belonging to supporters of Lincoln Cathedral and leisure centre users across Lincolnshire. Beacon became aware of the incident on 29 July and notified customers on 3 August. An unauthorised third party accessed parts of its system and copied database backups — which Beacon says were likely downloaded — holding names, addresses, emails, and phone numbers, but no payment or banking details.
Beacon CRM, used by over 1,000 charities and organisations, brought in external cybersecurity experts and reported the incident to the Information Commissioner's Office. Magna Vitae, which runs leisure centres in Skegness, Horncastle, Mablethorpe, and Louth, also confirmed it was affected. No ransom demand has been made, and there is no evidence the data has appeared online — but affected users are urged to watch for suspicious messages.
Source: BBC News
The INC Ransomware group has emerged as the most active threat actor exploiting two critical SonicWall SMA1000 vulnerabilities — CVE-2026-15409 (CVSS 10) and CVE-2026-15410 (CVSS 7.2) — which allow unauthenticated attackers to tunnel into restricted services and escalate privileges to root.
Zero-day exploitation of the chain began at least 22 June, attributed by Volexity to a separate actor tracked as UTA0533. Patches and CISA KEV listings arrived 14 July. INC's own victims start appearing from 17 July, and since early August it has accelerated attacks, listing victims from the US, Australia, UAE, Colombia, and Switzerland on its leak site.
In a disturbing twist, some victims received follow-up calls from someone named "Andrew" offering ransomware help — a known pressure tactic. Patch immediately: the fixes are platform hotfix versions 12.4.3-03453 and 12.5.0-02835.
Source: SecurityWeek
The INC Ransomware group has emerged as the most active threat actor exploiting two critical SonicWall SMA1000 vulnerabilities — CVE-2026-15409 (CVSS 10) and CVE-2026-15410 (CVSS 7.2) — which allow unauthenticated attackers to tunnel into restricted services and escalate privileges to root.
Zero-day exploitation of the chain began at least 22 June, attributed by Volexity to a separate actor tracked as UTA0533. Patches and CISA KEV listings arrived 14 July. INC's own victims start appearing from 17 July, and since early August it has accelerated attacks, listing victims from the US, Australia, UAE, Colombia, and Switzerland on its leak site.
In a disturbing twist, some victims received follow-up calls from someone named "Andrew" offering ransomware help — a known pressure tactic. Patch immediately: the fixes are platform hotfix versions 12.4.3-03453 and 12.5.0-02835.
Source: SecurityWeek
Levi Strauss disclosed a data breach after hackers used social engineering to manipulate three employees into surrendering access to their work computers. The attackers extracted corporate files before being detected and shut out. No consumer data was compromised, and business operations weren't disrupted.
The San Francisco-based denim giant filed the incident with the SEC, saying in the filing — signed by senior vice president and general counsel David Jedrzejek — that it does not believe the incident will materially affect its business strategy, operations, financial condition or results of operations. The exact manipulation method — whether phishing, vishing, or impersonation — hasn't been confirmed. Levi Strauss joins over 200 companies targeted by similar social engineering attacks in just the past five weeks.
Source: Cybersecurity News
Levi Strauss disclosed a data breach after hackers used social engineering to manipulate three employees into surrendering access to their work computers. The attackers extracted corporate files before being detected and shut out. No consumer data was compromised, and business operations weren't disrupted.
The San Francisco-based denim giant filed the incident with the SEC, saying in the filing — signed by senior vice president and general counsel David Jedrzejek — that it does not believe the incident will materially affect its business strategy, operations, financial condition or results of operations. The exact manipulation method — whether phishing, vishing, or impersonation — hasn't been confirmed. Levi Strauss joins over 200 companies targeted by similar social engineering attacks in just the past five weeks.
Source: Cybersecurity News
