⚠️ Microsoft 365 accounts are being hijacked and quietly kept alive.

A widespread AitM phishing campaign steals credentials and MFA codes, then uses rotating residential proxies to refresh sessions every eight hours while targeting payroll, HR, and finance mailboxes.

See how the attack works: https://thehackernews.com/2026/08/microsoft-365-aitm-phishing-hijacks.html

🛑 18-year-old Linux kernel flaw could let local users escape containers and reach host root.

CVE-2026-64564 affects Linux SCTP code dating back to 2008. Tencent says SCTPhantom escaped a container and reached host root in 6 of 8 tests.

How the flaw works: https://thehackernews.com/2026/08/18-year-old-linux-sctp-flaw-could-let.html

📊 New 2026 SANS AI Survey Insights

The latest SANS research finds 78% of organizations now use AI in security, but governance hasn't kept pace.

See how security teams are governing AI, responding to AI-enabled threats, and preparing for what's next with insights from the 2026 SANS AI Survey. Inside the report, you'll learn:


✅ How AI adoption is changing cybersecurity
✅ Where organizations are strengthening AI governance
✅ Common AI-enabled attack trends
✅ Workforce readiness priorities
✅ Practical recommendations from SANS experts

Get the report: https://thn.news/2026-sans-insights

‼️ BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.

XSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.

Update your WordPress sites ASAP 🠖 https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html

Open source isn’t dying. But regulated enterprises may soon be unable to rely on much of it.

The forecast: projects will increasingly need to prove they’re maintained, reachable, patchable, and accountable as AI-driven vulnerability discovery, supply-chain attacks, and new rules raise the bar.

Read the argument: https://thehackernews.com/2026/08/growing-up-hard-way.html

⚠️ UNC6671 is calling employees on their personal phones, posing as IT help desk staff.

One successful vishing call can expose credentials and MFA tokens, giving attackers access to Microsoft 365, Okta, and other SaaS apps for data theft.

See how the attacks work - https://thehackernews.com/2026/08/unc6671-vishing-attacks-target-personal.html

🚨 A ClickFix command pasted into macOS Terminal can end with a drained crypto wallet.

The Go-based malware can siphon part or all of a wallet balance while also stealing browser passwords, Apple Keychain data, and cached credentials.

See what happens after the paste: https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html

🛑 Nearly 800 malicious npm packages are delivering a cross-platform RAT and infostealer.

The campaign targets Windows, macOS, and Linux, with WEL1DROPPER fetching platform-specific payloads and falling back to DNS TXT records when HTTPS fails.

Inside the infection chain: https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html

🚨 Attackers are exploiting a LoadMaster flaw for command execution.

CVE-2026-8037 lets unauthenticated attackers run arbitrary commands on affected appliances. KEVIntel logged 792 exploitation attempts from 65 IPs in 41 days.

What defenders need to know: https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html

🛑 N-central exploitation continues, and Hotfix 2 is now required.

N-able says the new hotfix must be applied even if Hotfix 1 is already installed. Observed attackers gained remote admin access, reached managed systems, and established persistence after N-central server access was revoked.

What Hotfix 2 changes: https://thehackernews.com/2026/08/n-central-attackers-reach-managed.html

🚨 An exploited Metabase zero-day can grant admin access.

The CVSS 10.0 SQL injection lets unauthenticated attackers reach administrator access, steal connected-database credentials, and read or export accessible data.

Metabase Cloud is patched; self-hosted users should update immediately.

Patch details: https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html

‼️ CSS inside webmail can capture passwords and take over accounts.

New research demos also show CSS/HTML attack paths across Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail that can leak tokens, hijack UI actions, or lead to account takeover.

See what email CSS can now do: https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html

🛑 Atlassian's AI assistant Rovo can be tricked into sending Jira and Confluence data to attackers.

Two prompt-injection paths can make Rovo pull data the signed-in user can access and send it to an attacker-controlled server.

See how both chains work: https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html

⚡ OpenAI hits pause on some work involving Astra, its next AI model.

Internal tests were strong enough that OpenAI says it cannot rule out “Critical” cyber capabilities, prompting tighter security controls.

Here's what triggered the pause: https://thehackernews.com/2026/08/openais-next-ai-model-astra-shows-cyber.html

🚨 Malicious VS Code extensions steal wallet data and developer secrets.

Solidity Pro targets crypto wallet vaults, API keys, SSH keys, and source-control tokens. Some versions wait hours or days before activating, after quick automated scans have already moved on.

Read: https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html

🚨 Head Mare poisons TrueConf installers with PhantomCore malware.

The group exploits two flaws in unpatched TrueConf servers to gain SYSTEM privileges, then replaces the legitimate client distribution with an infected copy.

Full attack chain: https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html

🔥 10–50× more code. Security still moves at human speed.

AI can multiply dependencies, vulnerabilities, and fixes faster than teams can review them. More scanning can just mean a bigger backlog.

Learn how to secure AI-speed development without slowing it down.

Watch the webinar: https://thehackernews.com/2026/08/shipping-1050-more-code-watch-this.html

‼️ New research shows passkey protections can be bypassed without breaking FIDO2 cryptography.

Three demonstrated paths:

• Replay Windows-exposed assertions against Entra ID
• Recover synced passkey private keys from Google Password Manager
• Use Windows Hello keys from a compromised session

See how each works: https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html

⚠️ Phishing can succeed in under a minute.

Median click: 21 seconds. Data entry: 28 seconds later.

Blocking the email isn’t enough if the attacker’s domains and links stay live.

See what email security is still missing: https://thehackernews.com/expert-insights/2026/08/the-blind-spot-in-modern-email-security.html

🚨 Kimsuky is moving AI onto its own servers.

The North Korean espionage group is running or configuring Ollama, GPT4All, and Msty locally, alongside RAG, coding, and transcription tools. The stack has not been seen used against a victim yet.

See what it found: https://thehackernews.com/2026/08/kimsuky-builds-offline-ai-stack-that.html