🛑 Exploited Cisco firewall flaw can remotely crash affected devices.

CVE-2026-20349 affects certain ASA and FTD configurations. A crafted HTTP request can force a device reload and cause a denial-of-service condition.

Cisco says exploitation is already underway and no workaround exists.

Patch now: https://thehackernews.com/2026/08/cisco-asa-and-ftd-flaw-exploited-in.html

‼️ Microsoft patched RoguePlanet. Now the researcher has dropped another zero-day that claims to bypass the fix.

ShieldBreak is said to fully bypass Defender’s CVE-2026-50656 patch. The underlying flaw can lead to SYSTEM-level privileges.

Read more: https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html

⚠️ Warning: SAP Commerce Cloud flaw could enable arbitrary code execution.

CVE-2026-58231 carries a CVSS 10.0 score and can be triggered by an unauthenticated attacker abusing a default authentication client with crafted input.

SAP has released a fix. Patch and redeploy.

Read: https://thehackernews.com/2026/08/sap-commerce-cloud-flaw-could-let.html

‼️ BREAKING: A 40-minute LiteLLM PyPI compromise potentially exposed 2,100+ organizations.

Tied to Trivy's supply-chain attack, the malicious releases stole cloud, SSH, Kubernetes, and database credentials. Researchers later obtained roughly 434,000 captured files mapping potential exposure across thousands of organizations.

See what the stolen data reveals: https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html

🚨 Watch out: Attackers are exploiting VMware vCenter for persistence.

After exploiting CVE-2026-59310, they planted a malicious cron job running reverse_ssh to maintain access. Researchers identified up to 361 victim IPs across 47 countries.

Read more: https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html

🚨 Three Adobe flaws hit CVSS 10.0 and could enable code execution.

Adobe patched the maximum-severity bugs in ColdFusion and Campaign Classic, plus a CVSS 9.1 Commerce flaw that could allow privilege escalation. No exploitation has been seen in the wild.

Read: https://thehackernews.com/2026/08/adobe-patches-three-cvss-100-coldfusion.html

‼️ Researchers found a way to make a weaker AI decode a stronger model's hidden reasoning.

They extracted hidden traces from OpenAI, Anthropic, and Google APIs, recovering secret API keys and passwords, along with other credentials, in publicly shared agent logs.

Read more: https://thehackernews.com/2026/08/openai-anthropic-google-api-flaw-let.html

Once attackers get inside, defenses stop just 37%.

Across 338M+ attack simulations, reconnaissance was stopped only 10% of the time, while just 14% of simulated attacks triggered an alert.

The quiet moves are getting through.

Read more: https://thehackernews.com/2026/08/enterprise-defenses-recovered-at-edge.html

🚨 737 Chrome VPN extensions routed browser traffic through threat actor-controlled servers.

They drew 75,486 installs, with 274 impersonating 66 VPN and privacy brands. Most sent entire browser sessions through SOCKS5 proxies.

Read: https://thehackernews.com/2026/08/737-chrome-vpn-extensions-caught.html

Check if you installed one.

How much malware is hiding beyond what's reported?

Stairwell analyzed 1,085 public threat reports and found that every published malware hash corresponded to an average of 2.4 additional malicious variants, uncovering more than 54,000 related malicious files that weren't included in the original research.

Organizations may be investigating only part of an attack while related malware remains active inside their environments.

Stairwell’s Backstory was built to solve exactly that problem. The agentic investigation platform traces related malware variants, identifies affected systems, and maps an incident's full blast radius in seconds.

Read the Hidden Malware Report: https://thn.news/malware-report-2026

🚨 Lazarus-linked attacks exploit a Windows zero-day for SYSTEM access.

Dream Job lures defense and aerospace targets with fake recruiter messages. One chain exploits CVE-2026-68820 for privilege escalation; another uses a trojanized PDF viewer to load the new Troy backdoor.

See how the attacks work: https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html

🛑 Attackers are exploiting a SharePoint authentication bypass.

CVE-2026-55040 lets unauthenticated attackers forge JWTs and impersonate any SharePoint site user, including administrators. Eight of 12 recorded exploit attempts occurred on August 12 and 13, after Rapid7 published a PoC.

See how the exploit works: https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html

AI assistants sometimes repeated attackers’ install steps.

Island’s Alon Biran says its team found ~7,600 malicious GitHub repos, 800+ posing as AI Skills or MCP servers. In tests, assistants surfaced them and sometimes repeated the install steps as legitimate guidance.

Read more: https://thehackernews.com/expert-insights/2026/08/agents-work-everywhere-now-governance.html

🚨 737 Chrome VPN extensions routed browser traffic through threat actor-controlled servers.

They drew 75,486 installs, with 274 impersonating 66 VPN and privacy brands. Most sent entire browser sessions through SOCKS5 proxies.

Read: https://thehackernews.com/2026/08/737-chrome-vpn-extensions-caught.html

Check if you installed one.

🚨 WindRelay turns Android phones into live contactless payment proxies.

Attackers use SpyNote access to silently install the NFC relay malware. When victims tap a physical card on the infected phone, WindRelay streams its NFC data in real time to a fraudster's device, enabling fraudulent payments.

Read how it works: https://thehackernews.com/2026/08/windrelay-android-malware-turns-victims.html

⚠️ AmnesiaStealer gives attackers live control of authenticated browser sessions.

macOS ClickFix lure → paste command in Terminal → steals passwords & browser data → opens a hidden Chromium browser attackers can click, type, scroll & navigate in real time.

Details: https://thehackernews.com/2026/08/amnesiastealer-hijacks-chromium.html

🛑 APT36-linked hackers target Afghan telecom and Indian networks with new backdoors.

PATCHCORD spreads via fake telecom tools, while SHEETCORD uses Google Sheets for C2.

See how it works: https://thehackernews.com/2026/08/new-patchcord-backdoor-targets-afghan.html

AI has fundamentally changed email attacks.

See how attackers create convincing AI-powered phishing campaigns, why traditional email security struggles to stop them, and how AI-native detection catches malicious intent.

Join Adaptive's live webinar on August 25 at 11am PT / 2pm ET: https://thn.news/rethinking-ai-security

⚡ This week’s threats came from everywhere.

AI agents tricked through poisoned data. Cloud services exposed through guest access. Fake software dropping spyware. DDoS attacks getting bigger. New scams, malware tricks, security flaws, and fixes.

#ThreatsDay Bulletin packs the stories you may have missed into one quick read.

Read the full roundup: https://thehackernews.com/2026/08/threatsday-ghostjacking-ai-attacks.html

The threat doesn’t always break in. Sometimes it gets hired.

North Korean IT workers can pass interviews, get legitimate credentials, and gain trusted access.

A new investigation reveals the red flags CISOs should catch before a fraudulent hire gets inside.

Read the findings: https://thehackernews.com/2026/08/north-korean-remote-workers-are.html