‼️ Attackers are already probing an unpatched GeoServer zero-day.

The SQL injection flaw drew hundreds of attempts within hours of disclosure and, under certain configurations, can lead to remote code execution.

No patch is available yet.

Read the details: https://thehackernews.com/2026/08/unpatched-geoserver-zero-day-targeted.html

⚠️ China-linked Jewelbug runs espionage and crypto fraud from the same platform.

XG-Web lets operators control browsers, steal credentials and cookies, and execute commands on Windows hosts. One espionage operation hit 15 government webmail tenants and collected over 580,000 cookies.

Read how Jewelbug operates: https://thehackernews.com/2026/08/china-linked-jewelbug-uses-xg-web-for.html

‼️ U.S. firms could soon be authorized to hack foreign crime groups.

A Trump memo directs the NCC to create a program for vetted companies to access data and disrupt, degrade, or destroy TCO systems under U.S. government approval.

Read what it allows: https://thehackernews.com/2026/08/trump-memo-paves-way-for-us-firms-to.html

⚠️ Mercenary spyware may have targeted users in 110 countries.

Apple has sent a fresh round of high-confidence alerts to people it says were individually singled out. Journalists, activists, politicians, and diplomats are typical targets.

Read the full story: https://thehackernews.com/2026/08/apple-warns-users-in-110-countries-they.html

🚨 Live Chrome and Edge sessions can be hijacked without cookie replay.

Researchers show how CDP can be enabled inside an already-running Windows browser, letting an attacker use its existing authenticated state after gaining code execution.

Read how it works: https://thehackernews.com/2026/08/chrome-devtools-technique-enables.html

Fake job interviews are stealing Google and Facebook credentials.

CTM360 uncovered RecruitTrap across 3,000+ phishing URLs posing as recruiter and interview pages. Some fake logins relay MFA prompts in real time, letting attackers obtain an authenticated session.

See how the attack works: https://thehackernews.com/2026/08/ctm360-uncovers-over-3000-recruitment.html

🚨 CoolClient now uses a signed rootkit to hide at the Windows kernel level.

The Mustang Panda-linked backdoor can hide its process, files, registry entries, and some C2 activity.

Kaspersky found victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities.

Read more: https://thehackernews.com/2026/08/mustang-panda-adds-signed-windows.html

‼️ Nearly $7 million spent buying expired domains for cybercrime.

Experts say Sable Squirrel controls 10,000+ domains used across illegal streaming, gambling, and malware infrastructure. At least 31,000 malware samples have communicated with them.

Read - https://thehackernews.com/2026/08/hackers-spend-nearly-7-million-on.html

⚠️ Attackers are exploiting a macOS Screen Sharing flaw to install Monero miners.

CVE-2026-65400 is being abused on multiple Macs exposing port 5900 to the internet. Apple patched the flaw in emergency macOS updates.

What you need to know: https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html

⚡ UPDATE: GeoServer has patched the actively targeted SQL injection flaw.

The issue affects PostGIS-backed deployments and is a regression of CVE-2023-25158.

Update now: https://thehackernews.com/2026/08/unpatched-geoserver-zero-day-targeted.html

An IAM audit can pass while access gaps stay hidden.

Local accounts, service credentials, and legacy systems may sit outside centralized IAM visibility.

Compliance means proving controls are enforced, not just documented.

Read more: https://thehackernews.com/2026/08/iam-compliance-requirements-and-best.html

🚨 Exploitation attempts hit SAP just three days after the patch.

CVE-2026-58231 is a CVSS 10.0 Commerce Cloud flaw that could let unauthenticated attackers execute arbitrary code.

Inside the attacks: https://thehackernews.com/2026/08/sap-commerce-cloud-cve-2026-58231.html

🚨 VMware vCenter exploitation leads to Babuk-derived #ransomware on ESXi.

A suspected China-nexus actor exploited CVE-2026-59310 just five days after disclosure, compromising an estimated 361 IPs across 47 countries.

Read: https://thehackernews.com/2026/08/suspected-china-nexus-actor-exploits.html

🚨 Evooo1Bot turns infected edge devices into SOCKS5 proxies.

The Linux botnet exploits known flaws in routers, firewalls, cameras, and other internet-facing devices, adding credential sniffing, SSH brute forcing, DDoS attacks, and other capabilities to Mirai-based code.

How it works: https://thehackernews.com/2026/08/evooo1bot-linux-botnet-exploits-known.html

⚡ A VoLTE exploit chain can give attackers full Android kernel access.

The Unisoc chain starts with modem RCE, then lets modem code modify Android kernel memory. It requires attacker-controlled 4G infrastructure and the victim to answer the video call.

No patch is available.

Details: https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html

MCP servers can expose more than tools.

They can give AI agents access to enterprise data, APIs, and internal systems, widening the attack surface.

What security teams need to know: https://thehackernews.com/2026/08/how-mcp-servers-can-expose-enterprise.html

‼️ Security had a very normal week.

A VMware flaw got weaponized. A Windows 0-day surfaced. Browser sessions became attack paths. Supply-chain fallout kept spreading. Routers and cloud accounts joined the mess.

The recap: https://thehackernews.com/2026/08/weekly-recap-vmware-exploits-windows-0.html

⚠️ Cavern C2 now hides inside legitimate web traffic.

The Iranian-linked framework uses DNS to switch each transaction between direct HTTPS and Google Apps Script, making its command-and-control traffic harder to spot with network-based detection.

How it works: https://thehackernews.com/2026/08/cavern-c2-uses-dns-and-google-apps.html

🚨 Forminator flaw can give unauthenticated attackers RCE.

CVE-2026-15748 affects 600,000+ active WordPress installs. On susceptible forms, attackers can upload malicious PHP files and potentially take over the site.

Read: https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html

‼️ A crafted public GitHub issue exposed an internal Jira token.

Snowflake’s workflow inserted issue title and body data directly into a shell step. During authorized testing, Wiz used the flaw to execute commands and obtain the token.

How the flaw worked: https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets_0330881554.html