Prevention recovered to 69% at the perimeter in the Blue Report 2026, based on 338M attack simulations. Once an attacker gains authenticated access, only 37% of their actions get blocked.

Same credential theft tool: blocked 94% from LSASS memory, 3% from the registry.

Get your report: https://thn.news/sec-benchmarks2026

🛑 Ransom Busters says it hacked ransomware servers, then charged the victims.

The actor wants $20,000 to $60,000 to recover data and delete stolen copies.

GuidePoint says it may actually be a ransomware affiliate turning on its own partners.

Read: https://thehackernews.com/2026/08/ransom-busters-claims-it-hacked.html

🚨 Attackers are exploiting an MLflow flaw to steal cloud credentials.

CVE-2026-64849 lets them reach internal cloud metadata services and extract secrets. Researchers detected scanning within hours of the CVE assignment.

Read: https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html

‼️ One click could exfiltrate data from Copilot-connected apps.

New attack chain "CoSnitch" lets a crafted Copilot Personal link auto-run an attacker prompt in a signed-in session and pull data from services the user already authorized.

See how the chain works: https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html

⚠️ Clop-linked Windchill web shell decrypts credentials and maps engineering data.

Deployed after CVE-2026-12569 exploitation, the custom implant can extract LDAP and admin credentials and load Java payloads in memory.

See what the implant can do: https://thehackernews.com/2026/08/clop-linked-windchill-web-shell.html

🚨 MacSync Stealer is actively exfiltrating Mac credentials and sensitive data.

Microsoft linked 30+ domains through recurring execution and exfiltration patterns. Targets include Keychain, browser data, SSH keys, AWS credentials, and Kubernetes configs.

Read the findings: https://thehackernews.com/2026/08/microsoft-links-30-rotating-domains-to.html

Manual pentest handoffs may delay action by days or weeks.

A flaw found early in an engagement may not reach engineering until the final report clears review. Retesting then confirms whether remediation actually worked.

See the path from finding to verified fix: https://thehackernews.com/expert-insights/2026/08/the-long-road-from-pentest-finding-to.htm

🚨 Four Critical Flaws Under Active Exploitation:

• macOS CVE-2026-65400
• SharePoint CVE-2026-55040
• vCenter CVE-2026-59310
• Microsoft IKE CVE-2026-33824

Reported attacks include Monero mining, persistent access, and Babuk-derived ransomware.

Read: https://thehackernews.com/2026/08/critical-macos-sharepoint-vcenter-and.html

🛑 Nearly 2,000 hacked WordPress sites are spreading malware.

The StopAndProtect operation uses fake CAPTCHA prompts to trigger PowerShell and deploy tools for file theft, surveillance, lateral spread, and sometimes ransomware.

Read: https://thehackernews.com/2026/08/stopandprotect-uses-nearly-2000-hacked.html

🚨 Over 14,500 Dahua devices were reportedly hacked.

The campaign used credential attacks and two old auth-bypass flaws. A separate P2P relay reportedly reached 283 cameras by serial number, while 1,923 had a persistent account.

Read: https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html

AI agents are scaling personalized phishing to thousands of targets.

They can research an organization, map its people, build a tailored pretext, and repeat the process at scale. Deepfakes can then carry the deception into voice and video, as the $25 million Arup case showed.

See what Phishing 3.0 looks like: https://thehackernews.com/2026/08/phishing-30-fight-moves-to-agent-versus.html

🚨 SilkParasite targets Central Asian governments with five newly documented RATs.

The espionage campaign uses seven RAT families, DLL sideloading, and Google Drive C2. Bitdefender also found traces of AI-assisted development.

See how the campaign works: https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html

☀️ Sun, sand, and free CPEs await at CRX’26 - Connect with your peers and explore emerging infosec trends with experts in cyber risk and AI governance — plus, earn up to 17 CPE credits for attending!

Can’t make it? You can still enjoy CRX from anywhere with our virtual experience.

Register now: https://thn.news/crx-2026-guide

⚡ OpenAI paused frontier RL training to tighten safeguards against unsafe model behavior.

New controls include stronger sandboxes, internet isolation, and monitoring for unauthorized access, data theft, destructive behavior, and safeguard evasion.

Read: https://thehackernews.com/2026/08/openai-pauses-frontier-rl-training-as.html

‼️ A Spectre attack leaked a JWT from a co-located Cloudflare Worker.

Researchers demonstrated the attack in Cloudflare’s production environment at up to 12 bits/second, 360× faster than the 2021 result. No customer data was accessed.

Cloudflare says the attack is now mitigated.

Read full details here: https://thehackernews.com/2026/08/cloudflare-workers-spectre-attack-leaks.html

⚠️ Unauthenticated attackers could turn Elementor Pro uploads into RCE.

CVE-2026-32475 lets an attacker skip the file-extension blocklist and upload PHP when a published Form widget has a File Upload field. Elementor fixed it in 4.2.2.

Read: https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html

⚠️ 40 Firefox extensions pose as Web3 products to steal wallet secrets.

They impersonate OKX, Rabby Wallet, TronLink and others, capturing recovery phrases, private keys, keyrings, credentials or clipboard data. Some began as sports or utility add-ons.

Read: https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html

⚠️ ToxicPanda and GoldDigger are moving beyond credential theft.

ToxicPanda 2.0 adds 167 remote commands, PIN harvesting, lock-screen credential replacement, and shell access. GoldDigger can control banking apps, view screens live, and initiate fraudulent transactions.

Read the full report: https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html

‼️ NASA AIT-GUI could let unauthenticated attackers issue spacecraft commands.

The operator console also exposed script and sequence execution, while malicious web pages could reach command routes through cross-origin POST requests.

Read the details: https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html

🚨 Manic can exfiltrate data even when a phone is offline.

New Manic Android malware uses nearby infected devices as C2 relays, with four hops by default. It targets 169 apps and can capture PINs, one-time codes, messages, files, and location data.

Here's how it works: https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html