⚡ UPDATE: GeoServer has patched the actively targeted SQL injection flaw.

The issue affects PostGIS-backed deployments and is a regression of CVE-2023-25158.

Update now: https://thehackernews.com/2026/08/unpatched-geoserver-zero-day-targeted.html

An IAM audit can pass while access gaps stay hidden.

Local accounts, service credentials, and legacy systems may sit outside centralized IAM visibility.

Compliance means proving controls are enforced, not just documented.

Read more: https://thehackernews.com/2026/08/iam-compliance-requirements-and-best.html

🚨 Exploitation attempts hit SAP just three days after the patch.

CVE-2026-58231 is a CVSS 10.0 Commerce Cloud flaw that could let unauthenticated attackers execute arbitrary code.

Inside the attacks: https://thehackernews.com/2026/08/sap-commerce-cloud-cve-2026-58231.html

🚨 VMware vCenter exploitation leads to Babuk-derived #ransomware on ESXi.

A suspected China-nexus actor exploited CVE-2026-59310 just five days after disclosure, compromising an estimated 361 IPs across 47 countries.

Read: https://thehackernews.com/2026/08/suspected-china-nexus-actor-exploits.html

🚨 Evooo1Bot turns infected edge devices into SOCKS5 proxies.

The Linux botnet exploits known flaws in routers, firewalls, cameras, and other internet-facing devices, adding credential sniffing, SSH brute forcing, DDoS attacks, and other capabilities to Mirai-based code.

How it works: https://thehackernews.com/2026/08/evooo1bot-linux-botnet-exploits-known.html

⚡ A VoLTE exploit chain can give attackers full Android kernel access.

The Unisoc chain starts with modem RCE, then lets modem code modify Android kernel memory. It requires attacker-controlled 4G infrastructure and the victim to answer the video call.

No patch is available.

Details: https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html

MCP servers can expose more than tools.

They can give AI agents access to enterprise data, APIs, and internal systems, widening the attack surface.

What security teams need to know: https://thehackernews.com/2026/08/how-mcp-servers-can-expose-enterprise.html

‼️ Security had a very normal week.

A VMware flaw got weaponized. A Windows 0-day surfaced. Browser sessions became attack paths. Supply-chain fallout kept spreading. Routers and cloud accounts joined the mess.

The recap: https://thehackernews.com/2026/08/weekly-recap-vmware-exploits-windows-0.html

⚠️ Cavern C2 now hides inside legitimate web traffic.

The Iranian-linked framework uses DNS to switch each transaction between direct HTTPS and Google Apps Script, making its command-and-control traffic harder to spot with network-based detection.

How it works: https://thehackernews.com/2026/08/cavern-c2-uses-dns-and-google-apps.html

🚨 Forminator flaw can give unauthenticated attackers RCE.

CVE-2026-15748 affects 600,000+ active WordPress installs. On susceptible forms, attackers can upload malicious PHP files and potentially take over the site.

Read: https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html

‼️ A crafted public GitHub issue exposed an internal Jira token.

Snowflake’s workflow inserted issue title and body data directly into a shell step. During authorized testing, Wiz used the flaw to execute commands and obtain the token.

How the flaw worked: https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets_0330881554.html

‼️Critical GitLab vulnerability could let unauthenticated attackers delete public projects.

CVE-2026-19478 affects self-managed CE and EE under certain conditions. Fixes are in 19.2.4, 19.1.6, 19.0.8, and 18.11.11.

What admins need to know: https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html

⚠️ An actively exploited Ray flaw can lead to browser-based RCE.

CISA has added CVE-2025-62593 to its KEV catalog. The documented attack path uses DNS rebinding and requires a developer running Ray to visit a malicious site or be served a malicious ad in Firefox or Safari.

See how the attack works: https://thehackernews.com/2026/08/cisa-flags-actively-exploited-ray-flaw.html

AI-related DevOps incidents nearly tripled year over year.

GitProtect Lab tracked 84 in H1 2026. A poisoned file or public comment can trick an overprivileged AI agent into exposing source code, API keys, or environment secrets.

See how the attacks work: https://thehackernews.com/expert-insights/2026/08/why-your-ai-developer-tools-might-be.html

🛑 Nearly 40,000 SafePal customers had personal data exposed.

An order-tracking flaw exposed customer records. SafePal says wallet credentials, balances, and financial data were not affected.

Customers are being warned about phishing, fake support messages, and unexpected hardware deliveries.

Read: https://thehackernews.com/2026/08/safepal-hardware-wallet-maker-says-flaw.html

🚨 16 typosquatted RubyGems packages steal credentials and crypto wallets.

The malicious gems abuse the extconf.rb install hook to deliver StubMaker, a Windows stealer that also targets seed phrases and Telegram data.

Read: https://thehackernews.com/2026/08/16-typosquatted-rubygems-packages-steal.html

‼️ AI “mind viruses” can spread from one agent to another.

Researchers showed self-propagating payloads can travel through persistent prompt files, survive 20-hop agent chains, and even trigger file deletion in controlled tests.

Read how the technique works: https://thehackernews.com/2026/08/ai-mind-viruses-can-spread-between.html

🚨 See inside a scheme targeting crypto, finance, healthcare, and other high-value industries, captured in real time with ANY.RUN.
Read the investigation → https://thn.news/lazarus-part2-tg

A single server has been pulling records from Salesforce and ServiceNow portals.

The City Forum campaign targets over-permissive guest access across multiple industries. One Salesforce target logged more than 560,000 events from the same IP.

See how the campaign works: https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html

🚨 TWINLOOT hides C2 in Microsoft services and steals Windows passwords.

The Python implant uses SharePoint for tasking, Teams TURN for interactive access, and the victim’s Edge browser for Graph traffic. A reverse SOCKS5 tunnel lets operators pivot into internal systems using captured credentials.

Read: https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html