🚨 New GoCaracal malware can retrieve fallback C2 addresses from Ethereum smart contracts.

Seen in a June intrusion at a Venezuelan communications organization, GoCaracal can read a replacement address from Ethereum after repeated primary C2 failures, then retry normal off-chain communications.

How the fallback works: https://thehackernews.com/2026/08/gocaracal-malware-uses-ethereum-smart.html

🚨 Spark RAT targets Cambodia using a vulnerable driver to kill security processes.

The campaign abuses CVE-2026-36425 in an OPSWAT driver to terminate processes tied to Microsoft Defender, Huorong, and Tencent PC Manager before deploying the RAT.

How the attack chain works: https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html

A single public GitHub issue was enough to take over a Google Cloud project.

New research from Pillar Security details how an unauthenticated attacker could move from a comment on Google's Gemini CLI to Editor-level access inside a GCP project.

Prompt injection through the issue text reached an agent whose tool allowlist had gone inactive, which led to code execution on the CI runner, cloud credentials stored in plaintext, and an over-broad permission that allowed service-account impersonation up to Editor.

The permission traced back to Google's official setup script for Gemini CLI in GitHub Actions, so any team that followed the recommended setup could have inherited the same path. Google has since shipped fixes.

Research by Dan Lisichkin.

Learn more: https://thn.news/gcp-project-risk

🚨 A malicious Amazon Kiro workspace can leak sensitive local data.

After opening the workspace, sending any message to the agent can trigger repository-controlled instructions that send local data to an external server. Amazon fixed the flaw in Kiro 0.8.140.

How the flaw works: https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html

28% of security alerts go uninvestigated.

In a survey of 250+ security pros, 60% said a missed or ignored alert later became a serious issue. Meanwhile, 40% of teams use AI daily, and 72% of AI users report cutting investigation time by at least 25%.

What AI is changing inside the SOC: https://thehackernews.com/2026/08/what-data-says-about-ai-in-security.html

⚠️ Next.js patched two critical flaws that can enable unauthenticated RCE.

One affects Windows-hosted apps. The other requires AVIF optimization. No exploitation has been reported.

Details: https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html

⚠️ APT28-linked HOOKEDGE targets European governments and diplomats through Word lures.

The batch backdoor abuses webhook[.]site for C2 and data exfiltration, while high-value targets receive a faster second stage.

How the two-stage chain works: https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html

‼️ PaperCut zero-day is under active exploitation.

The flaw affects all PaperCut NG and MF versions, with confirmed customer incidents. Emergency patches are available for v25 and v26. The exploit method and attackers remain unknown.

What PaperCut has disclosed so far: https://thehackernews.com/2026/08/papercut-zero-day-exploited-in-attacks.html

‼️A new critical cPanel flaw could let one hosting customer take root control of an entire server.


CVE-2026-65643 affects all supported cPanel & WHM versions. The account must be able to add parked or addon domains, which can be abused to create arbitrary server files and ultimately execute code as root.
Details → https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html

🚨 China-made ZBT routers ship with two factory implants.

One accepts unauthenticated commands over an internet-exposed UDP service to run commands as root. The other can exfiltrate PPPoE credentials, alter DNS hijack lists, and open reverse SSH tunnels.

How the implants work → https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html

‼️ Three new critical ServiceNow flaws score a maximum CVSS 10.0 and require no authentication.

They can enable arbitrary code execution, privilege escalation, or arbitrary SQL against an instance. ServiceNow says it is not aware of exploitation.

Details here: https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html

Identity Fabric shows what identities actually do, not just what access policy allows.

It connects activity across apps, APIs, cloud infrastructure, and identity systems to expose runtime gaps across human, machine, and AI identities.

How it closes the visibility gap: https://thehackernews.com/2026/08/key-reasons-why-identity-fabric-matters.html

🚨 Two vulnerabilities in the Unitree G1 EDU humanoid robot enable root RCE.

One chain abuses path traversal. The other starts over Bluetooth and reaches a Wi-Fi provisioning buffer overflow for root execution on the Locomotion PC.

How both chains reach root → https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html

Attackers are exploiting two PaperCut flaws to gain unauthenticated RCE.

Huntress has confirmed limited exploitation in two customer environments, where attackers executed commands and deployed a Java class file on compromised servers.

How the two flaws are chained: https://thehackernews.com/2026/08/attackers-chain-two-papercut-flaws-to.html

Android 17 can hide the sites you visit from network providers.

Google is bringing ECH across the OS, obscuring destination domain names for supported sites and apps. Android 17 also adds local-network permission prompts and carrier-controlled 2G blocking.

How the new privacy protections work: https://thehackernews.com/2026/08/android-17-adds-os-wide-ech-to-hide.html

An ownCloud flaw was exploited to steal 176 files from a Philippine nuclear research body.

The 372 MB haul included nuclear-material records, strategic plans, employee data, BitLocker keys, and a KeePass database. CISA has added CVE-2023-49105 to its KEV catalog.

Read: https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets.html

19 Chrome and Edge extensions were turned into crypto-stealing tools.

The actor buys legitimate extensions or builds clean ones, waits for them to gain users, then pushes malicious updates capable of stealing wallet secrets, credentials, and draining crypto.

How the trusted-extension strategy works: https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html

‼️ A patch for a fund-draining flaw in Cosmos EVM, software used by multiple blockchains, was public in May but didn’t reach a release until Aug. 19.

Cosmos Labs says six blockchains were exploited after it had already confirmed all Cosmos EVM chains were affected.

Attackers sold ~$2.87M on DEXs and an estimated $2.85M on CEXs.

Read: https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html

🚨 Berlin refuses to pay hackers after data was stolen from the city’s state network.

Rhysida ransomware crew claims 5.79 TB of data and personal information on 12,076 people on its leak site, while Berlin officials say personal or other non-public data may be among what was taken.

Read: https://thehackernews.com/2026/08/berlin-refuses-to-pay-hackers-who-stole.html

🚨 Five critical flaws in WordPress plugins and themes can lead to site takeover or RCE.

The bugs span auth bypass, admin password-reset exposure, privilege escalation, and server-side code execution across GiveWP, Avada, WPMU DEV, TranslatePress, and Pods.

Read: https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html