A joint advisory from the FBI, CISA, the NSA, the Secret Service, and South Korean police warns that the Gunra ransomware group is exploiting known Fortinet VPN vulnerabilities to bypass multi-factor authentication and break into networks, targeting government agencies and critical infrastructure. Gunra, believed to be built on leaked Conti source code, runs a double-extortion model: it steals data before encrypting, using a custom tool to pull files from Microsoft OneDrive and SharePoint and moving large archives to a file-sharing service with utilities like RClone and 7-Zip. The final payload appends a distinct extension and drops a ransom note. The group has grown into a ransomware-as-a-service operation recruiting access brokers.
Red Hat disclosed a critical flaw in its Advanced Cluster Management for Kubernetes that lets a user with only namespace-level edit rights escalate to full cluster administrator. Tracked as CVE-2026-10090 and scored 9.9, the bug is in the application subscription controller: a low-privileged user can create a channel pointing to a Helm repository they control, then a subscription referencing it, and the controller deploys the chart using its own elevated permissions without checking the requester's authorization. It is a confused-deputy problem that crosses the namespace-to-cluster boundary. Because namespace edit access is often granted broadly to developers, many multi-tenant clusters could be exposed, and no fix was available at disclosure.
Cisco warned that public proof-of-concept code exists for two vulnerabilities in ClamAV, the widely used open-source antivirus engine, that a remote unauthenticated attacker can use to crash the scanning process and disrupt protection. Tracked as CVE-2026-20337 and CVE-2026-20338, the flaws are rated high severity on Windows because ClamAV runs there in a privileged security context, and medium on macOS and Linux where it runs with lower privileges. There are no workarounds, and Cisco is rolling out fixes in August across its Secure Endpoint Connector products, which embed ClamAV. Because ClamAV is bundled into many mail and file-scanning products, exposure extends well beyond Cisco.
Researchers at Wordfence found that attackers compromised the upstream infrastructure of BdThemes, a popular WordPress plugin vendor, and poisoned a remote JSON feed that its plugins fetch to show promotional banners in the admin dashboard. Because the malicious code lives in that feed rather than in the plugin source, no plugin update was needed and nothing changed on disk. The injected script runs in every logged-in administrator's browser, creates hidden rogue admin accounts through the site's own interface, and installs a fake plugin containing a web shell for persistence. Seven plugins including Element Pack and Prime Slider were affected, and the flaw sat unnoticed for about five months.
Researchers at Yeeth Security flagged malicious Visual Studio Code extensions named Solidity Pro that pose as tools for blockchain developers while stealing wallets and credentials. Early versions quietly fetched an encrypted payload from cloud infrastructure after a delay of up to three days and ran it outside the editor to evade quick checks. Later versions became full information stealers, collecting browser profiles, cryptocurrency wallets and seed phrases, source-control tokens, cloud credentials, API keys, and SSH private keys, then sending them out through a Telegram bot. The extensions were pulled from the Open VSX marketplace, but the project's code repository remained available.
Valve is notifying European Steam hardware customers that their personal data was likely exposed in a cyberattack on CEVA Logistics, the partner that ships Steam devices in the region. Attackers had access to CEVA systems between July 29 and August 1, reaching the delivery details CEVA keeps for up to ninety days: name, street address, postal code, city, country, phone number, the email tied to the Steam account, and the hardware ordered and its price. No Steam passwords, Steam Guard codes, or payment data were exposed, since CEVA never held them. Valve warned customers to expect phishing and delivery-impersonation scams and to treat such messages as fake.
Metabase warned that a critical zero-day in its open-source business intelligence platform was exploited in the wild for data theft. Scored 10.0 and tracked only as GHSA-vwf4-m7j8-wcjf with no CVE assigned, so scanners relying on the national database will not flag it, the flaw is an unauthenticated SQL injection in the password-reset endpoint. A remote attacker with no credentials injects SQL into the application database, gains administrator access, and can steal the stored credentials for every database the instance connects to, then read and export their data. Metabase Cloud was attacked from around August 3 and is already patched; self-hosted versions 1.58 and later must upgrade.
CISA added a critical Progress Kemp LoadMaster flaw to its Known Exploited Vulnerabilities catalog after reports of active exploitation. Tracked as CVE-2026-8037 and scored 9.6, it is a command injection bug that lets an unauthenticated attacker run arbitrary commands on the load balancer appliance through unsanitized input in several command endpoints. watchTowr traced it to improper handling of user input in a quote-escaping function. Telemetry recorded 792 exploitation attempts over 41 days from 65 addresses across 18 countries, with activity as recent as early August. Federal agencies were directed to patch by August 10, a useful signal of urgency for everyone else.
Cisco released fixes for twelve flaws in Catalyst SD-WAN and IOS XE software, including three rated 9.9 and a command-injection issue rated 9.8. The three critical SD-WAN flaws, CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, stem from improper input validation, access control, and file-path handling in software that centrally controls a network. Cisco found them through internal testing that included frontier AI models and is not aware of exploitation, but there are no workarounds, so patching is the only remediation. Cisco also patched a management-controller flaw with public exploit code that lets a low-privileged user reach root.
Tencent researchers disclosed SCTPhantom, a use-after-free flaw in the Linux kernel's SCTP networking code that lets a local user gain root and, in some configurations, escape a container to the host. Tracked as CVE-2026-64564, the bug is in the protocol's dynamic address reconfiguration handling and traces to code introduced around 2008, making it roughly 18 years old. It is local rather than remote and needs SCTP reachable on the target, which limits exposure, but where those conditions hold the researchers gained root on several major distributions. It was found by an AI-assisted kernel research pipeline, the latest long-dormant kernel bug surfaced that way this year.
TrustStrike Labs