🚨 SilkParasite targets Central Asian governments with five newly documented RATs.

The espionage campaign uses seven RAT families, DLL sideloading, and Google Drive C2. Bitdefender also found traces of AI-assisted development.

See how the campaign works: https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html

☀️ Sun, sand, and free CPEs await at CRX’26 - Connect with your peers and explore emerging infosec trends with experts in cyber risk and AI governance — plus, earn up to 17 CPE credits for attending!

Can’t make it? You can still enjoy CRX from anywhere with our virtual experience.

Register now: https://thn.news/crx-2026-guide

⚡ OpenAI paused frontier RL training to tighten safeguards against unsafe model behavior.

New controls include stronger sandboxes, internet isolation, and monitoring for unauthorized access, data theft, destructive behavior, and safeguard evasion.

Read: https://thehackernews.com/2026/08/openai-pauses-frontier-rl-training-as.html

‼️ A Spectre attack leaked a JWT from a co-located Cloudflare Worker.

Researchers demonstrated the attack in Cloudflare’s production environment at up to 12 bits/second, 360× faster than the 2021 result. No customer data was accessed.

Cloudflare says the attack is now mitigated.

Read full details here: https://thehackernews.com/2026/08/cloudflare-workers-spectre-attack-leaks.html

⚠️ Unauthenticated attackers could turn Elementor Pro uploads into RCE.

CVE-2026-32475 lets an attacker skip the file-extension blocklist and upload PHP when a published Form widget has a File Upload field. Elementor fixed it in 4.2.2.

Read: https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html

⚠️ 40 Firefox extensions pose as Web3 products to steal wallet secrets.

They impersonate OKX, Rabby Wallet, TronLink and others, capturing recovery phrases, private keys, keyrings, credentials or clipboard data. Some began as sports or utility add-ons.

Read: https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html

⚠️ ToxicPanda and GoldDigger are moving beyond credential theft.

ToxicPanda 2.0 adds 167 remote commands, PIN harvesting, lock-screen credential replacement, and shell access. GoldDigger can control banking apps, view screens live, and initiate fraudulent transactions.

Read the full report: https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html

‼️ NASA AIT-GUI could let unauthenticated attackers issue spacecraft commands.

The operator console also exposed script and sequence execution, while malicious web pages could reach command routes through cross-origin POST requests.

Read the details: https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html

🚨 Manic can exfiltrate data even when a phone is offline.

New Manic Android malware uses nearby infected devices as C2 relays, with four hops by default. It targets 169 apps and can capture PINs, one-time codes, messages, files, and location data.

Here's how it works: https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html

⚡ A low-bandwidth HTTP/3 stream can be amplified up to 350x against the origin behind a CDN.

Researchers demonstrated "CDN Tsunami" on six major CDNs, abusing HTTP/3-to-HTTP/1.1 translation to drain origin bandwidth or exhaust its connections.

See how the attacks work: https://thehackernews.com/2026/08/cdn-tsunami-attack-abuses-http3.html

‼️ Warning - Expired Visa payment cards can be revived for real purchases.

New “Zombie Card” attack rewrites the expiry date a contactless terminal reads over NFC, while the card’s cryptography still validates.

See how it works - https://thehackernews.com/2026/08/zombie-card-attack-can-revive-expired.html

⚠️ Attackers are exploiting a Zimbra flaw that can lead to unauthenticated RCE.

CVE-2026-73570 affects ZCS before 10.1.20 when zimbra-snmp is installed and SNMP notifications are enabled. Crafted SMTP requests may execute OS commands as the Zimbra user.

What to check: https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html

🚨 Critical NetScaler flaw can bypass authentication on certain Gateway and AAA configurations.

Citrix patched CVE-2026-19490 (CVSS 9.3). Exposure depends on the NetScaler version and configuration, with SAML required in some cases.

More details: https://thehackernews.com/2026/08/critical-netscaler-flaw-can-bypass.html

An approved Meta AI agent triggered a Sev 1 incident.

After the agent posted an unapproved response on an internal forum, an employee followed its advice, exposing sensitive company and user data to unauthorized engineers for over two hours.

Learn what went wrong: https://thehackernews.com/2026/08/why-shady-ai-is-securitys-next-big.html

⚠️ A flaw in isolated-vm can let sandboxed JavaScript break out into the host.

The bug is in ExternalCopy, where a guest with an ivm.Reference can corrupt host memory. Researchers went as far as hijacking host control flow, showing the potential for RCE.

The escape path - https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html

⚠️ A crafted web page could make Grok send private session data to an attacker.

Researchers say their PoC hides instructions in encrypted page content. Grok decrypts them in its code sandbox, then opens an attacker-controlled URL carrying the user's name, approximate location, subscription tier, and chat prompts.

See how the attack works - https://thehackernews.com/2026/08/new-cryptographic-context-injection.html

They wanted autonomous AI.
The AI wanted 260 chicken nuggets.
Everybody got what they wanted except the customer.

Big Burger’s AI Risk Score just dropped to 420 📉

Monitor AI risk like you monitor your credit score.
UMAI | External AI Risk Intelligence

Big Burger is fictional. The AI incident that inspired this post wasn’t. https://umai.entelijan.com

🚨 AI-generated exploit scripts are targeting Siemens S7 PLCs.

U.S. agencies say threat actors scan for exposed or poorly protected PLCs and use AI assistance to build scripts for initial access, credential access, DoS, and other objectives.

What defenders should check: https://thehackernews.com/2026/08/ai-generated-exploit-scripts-target.html

🔥 15 NEW Stories. Trust got weaponized everywhere.

Defender driver EDR bypass • ClickFix + BYOVD • Grandoreiro sideloading • CircleCI MCP RCE • Gogs 10.0 RCE • n8n RCE • refrigeration controller flaws • C2 hidden in whitespace • PostScript memory leaks • Salt Typhoon • $10M Iran reward • guardrail-free AI • private AI • ATT changes • AI exploit gains

This week’s ThreatsDay: https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html

🚨 Suspected Russian hackers are abusing real sign-in flows to hijack accounts.

Google says the campaigns target government, defense, academia, and think tanks using OAuth phishing, app passwords, and WhatsApp device linking.

Read how it works: https://thehackernews.com/2026/08/suspected-russian-hackers-abuse-google.html