‼️Critical GitLab vulnerability could let unauthenticated attackers delete public projects.

CVE-2026-19478 affects self-managed CE and EE under certain conditions. Fixes are in 19.2.4, 19.1.6, 19.0.8, and 18.11.11.

What admins need to know: https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html

⚠️ An actively exploited Ray flaw can lead to browser-based RCE.

CISA has added CVE-2025-62593 to its KEV catalog. The documented attack path uses DNS rebinding and requires a developer running Ray to visit a malicious site or be served a malicious ad in Firefox or Safari.

See how the attack works: https://thehackernews.com/2026/08/cisa-flags-actively-exploited-ray-flaw.html

AI-related DevOps incidents nearly tripled year over year.

GitProtect Lab tracked 84 in H1 2026. A poisoned file or public comment can trick an overprivileged AI agent into exposing source code, API keys, or environment secrets.

See how the attacks work: https://thehackernews.com/expert-insights/2026/08/why-your-ai-developer-tools-might-be.html

🛑 Nearly 40,000 SafePal customers had personal data exposed.

An order-tracking flaw exposed customer records. SafePal says wallet credentials, balances, and financial data were not affected.

Customers are being warned about phishing, fake support messages, and unexpected hardware deliveries.

Read: https://thehackernews.com/2026/08/safepal-hardware-wallet-maker-says-flaw.html

🚨 16 typosquatted RubyGems packages steal credentials and crypto wallets.

The malicious gems abuse the extconf.rb install hook to deliver StubMaker, a Windows stealer that also targets seed phrases and Telegram data.

Read: https://thehackernews.com/2026/08/16-typosquatted-rubygems-packages-steal.html

‼️ AI “mind viruses” can spread from one agent to another.

Researchers showed self-propagating payloads can travel through persistent prompt files, survive 20-hop agent chains, and even trigger file deletion in controlled tests.

Read how the technique works: https://thehackernews.com/2026/08/ai-mind-viruses-can-spread-between.html

🚨 See inside a scheme targeting crypto, finance, healthcare, and other high-value industries, captured in real time with ANY.RUN.
Read the investigation → https://thn.news/lazarus-part2-tg

A single server has been pulling records from Salesforce and ServiceNow portals.

The City Forum campaign targets over-permissive guest access across multiple industries. One Salesforce target logged more than 560,000 events from the same IP.

See how the campaign works: https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html

🚨 TWINLOOT hides C2 in Microsoft services and steals Windows passwords.

The Python implant uses SharePoint for tasking, Teams TURN for interactive access, and the victim’s Edge browser for Graph traffic. A reverse SOCKS5 tunnel lets operators pivot into internal systems using captured credentials.

Read: https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html

Prevention recovered to 69% at the perimeter in the Blue Report 2026, based on 338M attack simulations. Once an attacker gains authenticated access, only 37% of their actions get blocked.

Same credential theft tool: blocked 94% from LSASS memory, 3% from the registry.

Get your report: https://thn.news/sec-benchmarks2026

🛑 Ransom Busters says it hacked ransomware servers, then charged the victims.

The actor wants $20,000 to $60,000 to recover data and delete stolen copies.

GuidePoint says it may actually be a ransomware affiliate turning on its own partners.

Read: https://thehackernews.com/2026/08/ransom-busters-claims-it-hacked.html

🚨 Attackers are exploiting an MLflow flaw to steal cloud credentials.

CVE-2026-64849 lets them reach internal cloud metadata services and extract secrets. Researchers detected scanning within hours of the CVE assignment.

Read: https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html

‼️ One click could exfiltrate data from Copilot-connected apps.

New attack chain "CoSnitch" lets a crafted Copilot Personal link auto-run an attacker prompt in a signed-in session and pull data from services the user already authorized.

See how the chain works: https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html

⚠️ Clop-linked Windchill web shell decrypts credentials and maps engineering data.

Deployed after CVE-2026-12569 exploitation, the custom implant can extract LDAP and admin credentials and load Java payloads in memory.

See what the implant can do: https://thehackernews.com/2026/08/clop-linked-windchill-web-shell.html

🚨 MacSync Stealer is actively exfiltrating Mac credentials and sensitive data.

Microsoft linked 30+ domains through recurring execution and exfiltration patterns. Targets include Keychain, browser data, SSH keys, AWS credentials, and Kubernetes configs.

Read the findings: https://thehackernews.com/2026/08/microsoft-links-30-rotating-domains-to.html

Manual pentest handoffs may delay action by days or weeks.

A flaw found early in an engagement may not reach engineering until the final report clears review. Retesting then confirms whether remediation actually worked.

See the path from finding to verified fix: https://thehackernews.com/expert-insights/2026/08/the-long-road-from-pentest-finding-to.htm

🚨 Four Critical Flaws Under Active Exploitation:

• macOS CVE-2026-65400
• SharePoint CVE-2026-55040
• vCenter CVE-2026-59310
• Microsoft IKE CVE-2026-33824

Reported attacks include Monero mining, persistent access, and Babuk-derived ransomware.

Read: https://thehackernews.com/2026/08/critical-macos-sharepoint-vcenter-and.html

🛑 Nearly 2,000 hacked WordPress sites are spreading malware.

The StopAndProtect operation uses fake CAPTCHA prompts to trigger PowerShell and deploy tools for file theft, surveillance, lateral spread, and sometimes ransomware.

Read: https://thehackernews.com/2026/08/stopandprotect-uses-nearly-2000-hacked.html

🚨 Over 14,500 Dahua devices were reportedly hacked.

The campaign used credential attacks and two old auth-bypass flaws. A separate P2P relay reportedly reached 283 cameras by serial number, while 1,923 had a persistent account.

Read: https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html

AI agents are scaling personalized phishing to thousands of targets.

They can research an organization, map its people, build a tailored pretext, and repeat the process at scale. Deepfakes can then carry the deception into voice and video, as the $25 million Arup case showed.

See what Phishing 3.0 looks like: https://thehackernews.com/2026/08/phishing-30-fight-moves-to-agent-versus.html