Weekly Threat Landscape Digest – Week 34

August 21, 2026
Alert Advisory, CVE, Cyber Threat Intelligence, Threat Hunting Insights
Managed Security Services
  1. Multiple Vulnerabilities in NVIDIA Triton Inference Server

Overview

  • CVE-2026-47627 (CVSS 9.8): Critical path traversal vulnerability allowing unauthenticated denial of service.
  • CVE-2026-47628 (CVSS 7.5): Uncontrolled resource allocation leading to denial of service.
  • CVE-2026-47629 (CVSS 7.5): Improper input validation causing denial of service.
  • CVE-2026-47606 (CVSS 6.5): Absolute path traversal enabling code execution and information disclosure.
  • CVE-2026-47630 (CVSS 5.5): Absolute path traversal potentially allowing code execution under certain conditions.

Impact

  • Exploitation can result in denial of service, remote code execution, and sensitive information disclosure depending on vulnerability and configuration.

Affected / Fixed Versions

  • Affected: NVIDIA Triton Inference Server versions 0.0 through 26.05 on Linux.
  • Fixed: NVIDIA Triton Inference Server version 26.06 or later.

Recommendations

  • Update NVIDIA Triton Inference Server on Linux to version 26.06 or later to mitigate these vulnerabilities.

Reference Links

  1. Security Updates – Google Chrome (August 19, 2026)

Overview

  • Google released security updates for Chrome addressing 15 vulnerabilities: 2 Critical and 13 High severity.
  • Vulnerabilities affect Chrome components including WebGL, Dawn, CORS, CredentialProvider, USB, Core, Browser, Media, GPU, ANGLE, V8, and Skia.
  • Issues include buffer overflows, use-after-free, race conditions, type confusion, information leaks, and inappropriate implementations.

Impact

  • Potential impacts include memory corruption, information disclosure, and other security breaches.

Affected / Fixed Versions

  • Desktop Stable Channel: Chrome 151.0.7922.169/.170 for Windows and Mac, 151.0.7922.169 for Linux.
  • Android: Chrome 151 (151.0.7922.169).
  • Extended Stable Channel Desktop: Chrome 150.0.7871.250 for Windows and Mac.

Recommendations

  • Update Google Chrome to the latest version to mitigate the identified vulnerabilities.

Reference Links

  1. Apple Security Updates – iOS, iPadOS, macOS, and visionOS

Overview

  • Apple released security updates addressing multiple vulnerabilities in iOS, iPadOS, macOS, and visionOS.
  • Vulnerabilities include arbitrary code execution, memory corruption, denial-of-service, information disclosure, and security bypass.
  • Notable CVEs: CVE-2026-65346 (ImageIO integer overflow), CVE-2026-43776 (AppleDouble), CVE-2026-64763 to CVE-2026-64766 (SceneKit).

Impact

  • Exploitation may lead to arbitrary code execution, application or system crashes, denial-of-service, disclosure of sensitive information, and bypass of security protections.

Affected / Fixed Versions

  • Fixed in iOS 26.6.1, iPadOS 26.6.1, iOS 18.7.10 Security Update, iPadOS 18.7.10, macOS Tahoe 26.6.2, and visionOS 26.6.1.

Recommendations

  • Apply the latest Apple security updates immediately to mitigate associated risks.

Reference Links

  1. Adobe Security Updates – ColdFusion, Commerce, and Campaign Classic

Overview

  • Adobe released security updates addressing multiple critical vulnerabilities across ColdFusion, Commerce, and Campaign Classic.
  • Vulnerabilities include OS command injection, eval injection, SQL injection, incorrect authorization, privilege escalation, denial-of-service, and unauthorized access.
  • CVE-2026-71362 in Adobe Commerce and Magento Open Source is actively exploited.

Impact

  • Exploitation may result in arbitrary code execution, privilege escalation, denial-of-service, or unauthorized access to sensitive information.

Affected / Fixed Versions

  • Adobe ColdFusion fixed in versions 2025.0.12 and 2023.0.23.
  • Adobe Campaign Classic fixed in ACC v7 7.4.4 build 9400.
  • Adobe Commerce and Magento Open Source: apply security updates in APSB26-92.

Recommendations

  • Immediately update affected Adobe products to the specified fixed versions or the latest releases.
  • Monitor for exploitation activities related to CVE-2026-71362 in Adobe Commerce and Magento Open Source.

Reference Links

  1. Multiple Critical Vulnerabilities in VMware Avi Load Balancer

Overview

  • Multiple vulnerabilities identified in VMware Avi Load Balancer affecting authentication, authorization, remote code execution, privilege escalation, and directory traversal.
  • CVE-2026-47865 (CVSS 9.8): Critical authentication bypass allowing network attackers to access Avi Control Plane without authentication.
  • CVE-2026-47866: Authorization bypass permitting limited access without proper rights.
  • CVE-2026-47867 and CVE-2026-47869: Remote code execution vulnerabilities exploitable over the network by unauthenticated or authenticated users.
  • CVE-2026-47868 and CVE-2026-47870: Local and network-based privilege escalation enabling execution with root or elevated privileges.
  • CVE-2026-47871: Directory traversal allowing authenticated users to access files outside intended directories.

Impact

  • Exploitation may lead to full compromise of the Avi Control Plane, including unauthorized access, arbitrary code execution, privilege escalation, and exposure of sensitive files.
  • Risks include loss of confidentiality, integrity, and availability of affected environments.

Affected / Fixed Versions

  • Affected: VMware Avi Load Balancer versions 22.1.1–22.1.7, 30.1.1–30.2.6, 31.1.1–31.2.2, and 32.1.1.
  • Fixed: Versions 22.1.7-2p12, 30.2.7, 31.2.2-2p3, and 32.1.2.
  • Recommended upgrade to VMware Avi Load Balancer 32.1.2 (latest version).

Recommendations

  • Immediately apply available updates to fixed versions.
  • Validate successful deployment of patches.
  • Monitor for suspicious activity related to Avi Control Plane access.

Reference Links

  1. GitLab Security Updates – XSS, RCE, and Authorization Flaws

Overview

  • GitLab released security updates for Community Edition (CE) and Enterprise Edition (EE) addressing multiple vulnerabilities.
  • Issues include high-severity cross-site scripting (XSS), remote code execution (RCE), and authorization flaws.
  • CVE-2026-15217 and CVE-2026-15216: XSS in Analytics Dashboards.
  • CVE-2026-10053: RCE via Path Traversal in Package Registry.
  • CVE-2026-15423: Improper Authorization in CI/CD Pipeline API.
  • CVE-2026-19228: Authorization Bypass in Duo Workflow Service.
  • CVE-2026-16627: XSS in CI Manual Job Confirmation Modal.
  • CVE-2026-16494: Missing Authorization in ProjectsController.

Impact

  • Successful exploitation may lead to arbitrary code execution, authorization bypass, privilege escalation, data access/modification, or denial of service.

Affected / Fixed Versions

  • Fixed in GitLab CE and EE versions 19.2.2, 19.1.4, and 19.0.6.

Recommendations

  • Upgrade affected GitLab instances to version 19.2.2 or later stable releases.
  • Review API usage and permissions configurations to ensure authorization controls are in place.
  • Monitor platform for signs of exploitation targeting these vulnerabilities.

Reference Links

  1. Multiple High-Severity Vulnerabilities in Ivanti Endpoint Manager (EPM)

Overview

  • Multiple high-severity vulnerabilities have been identified in Ivanti Endpoint Manager (EPM), potentially enabling attackers to disrupt services, alter data, or expose sensitive credentials.
  • CVE-2026-18125 (CVSS 7.5): Out-of-bounds read in the EPM Agent allows remote unauthenticated attackers to crash the agent service.
  • CVE-2026-18127 (CVSS 7.7): External control of filename in the EPM Core permits remote authenticated attackers full write control over S3 buckets used for session recording storage.
  • CVE-2026-18129 (CVSS 8.1): Cleartext transmission vulnerability enables remote unauthenticated attackers in man-in-the-middle positions to intercept credentials for external SQL connections.

Impact

  • Attackers can crash services, gain unauthorized write access to storage, and intercept sensitive credentials.

Affected / Fixed Versions

  • Affected: Ivanti Endpoint Manager (EPM) 2024 SU6 and earlier.
  • Fixed: Ivanti Endpoint Manager (EPM) 2024 SU7.

Recommendations

  • Update Ivanti Endpoint Manager installations to version 2024 SU7 or later to mitigate these vulnerabilities.

Reference Links

  1. High-Severity Vulnerabilities in Fortinet FortiManager, FortiWeb, and FortiClient

Overview

  • Fortinet disclosed multiple high-severity vulnerabilities affecting FortiManager, FortiManager Cloud, FortiWeb, and FortiClient for Windows.
  • CVE-2026-70468 (CVSS 7.3): Authentication weakening in FortiManager/FortiManager Cloud allows unauthenticated attackers with valid certificates to impersonate managed FortiGate devices.
  • CVE-2026-26035 (CVSS 8.8): Broken access control in FortiWeb permits unauthenticated attackers to access GUI or CLI with arbitrary credentials under specific settings.
  • CVE-2026-70465 (CVSS 7.3): Heap overflow in FortiClient for Windows kernel driver allows unauthenticated attackers to execute arbitrary code through malicious network packets.

Impact

  • Unauthorized impersonation of managed devices, access to FortiWeb admin interfaces, and arbitrary code execution on Windows endpoints.

Affected / Fixed Versions

  • FortiManager/Cloud: versions 7.6.1, 7.4.3–7.4.5, 7.2.5–7.2.9; fixed in 7.6.2+, 7.4.6+, 7.2.10+.
  • FortiWeb: versions 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.11, 7.2.0–7.2.12; fixed in 8.0.3+, 7.6.7+, 7.4.12+, 7.2.13+.
  • FortiClient Windows: versions 7.4.0–7.4.3, 7.2.0–7.2.11; fixed in 7.4.4+ and 7.2.12+.

Recommendations

  • Update all affected Fortinet products to the latest fixed versions to mitigate exploitation risks.

Reference Links

  1. Microsoft Entra ID RCE Vulnerability Exploited in the Wild (CVE-2026-69836)

Overview

  • A critical remote code execution (RCE) vulnerability in Microsoft Entra ID, tracked as CVE-2026-69836, was disclosed on August 20, 2026.
  • The flaw results from deserialization of untrusted data (CWE-502), allowing execution of arbitrary code without authentication or user interaction.
  • Entra ID underpins authentication across Microsoft 365, Azure, and third-party apps, amplifying impact potential.
  • Microsoft confirmed active exploitation in the wild.
  • No customer patching is required; the fix is deployed server-side by Microsoft.

Impact

  • Attackers exploiting this flaw can execute code on the identity layer, potentially pivoting to cloud workloads.
  • Risks include hijacking authentication tokens and manipulating access policies across the Microsoft ecosystem.

Recommendations

  • Review Entra ID sign-in logs, conditional access policies, and privileged role assignments for anomalies prior to patch deployment.
  • Increase monitoring on identity infrastructure and authentication services for suspicious activity.

Reference Links

  1. USN-8666-1: Linux Kernel Vulnerabilities

Overview

  • Multiple security flaws identified in the Linux kernel affecting architecture, cryptography, networking, file systems, and drivers.
  • A notable issue involves WiFi in mesh networks where improper handling of aggregated frames (CVE-2025-27558) could allow a nearby attacker to inject packets.

Impact

  • An attacker with physical proximity could inject packets via the WiFi vulnerability.
  • Other vulnerabilities might enable attackers to compromise system integrity or availability.

Affected / Fixed Versions

  • Linux kernel versions prior to the update released in this notice.

Recommendations

  • Apply the security update promptly to mitigate exploitation risks.

Reference Links

  1. USN-8665-1: Linux Kernel (Raspberry Pi) Vulnerabilities

Overview

  • Multiple security vulnerabilities in the Linux kernel affecting ARM64, RISC-V, x86, block layer, crypto API, networking, filesystems, USB, sound, and more.
  • AMD processor issues include speculative execution data leakage (CVE-2025-54505), cache isolation failure leading to potential privilege escalation (CVE-2025-54518), and entropy handling problems in RDSEED (CVE-2025-62626).

Impact

  • Potential exposure of sensitive information through speculative execution flaws.
  • Possible privilege escalation due to cache isolation issues.
  • Broad system compromise risks due to kernel subsystem flaws.

Affected / Fixed Versions

  • Linux kernel versions addressing the listed CVEs.

Recommendations

  • Apply the security updates provided by Ubuntu promptly to mitigate vulnerabilities.
  • Monitor systems for any unusual behavior indicative of exploitation attempts.

Reference Links

  1. Microsoft Defender BTR.sys Driver Can Be Weaponized to Disable EDR and AV

Overview

  • Microsoft’s Defender Boot-Time Removal driver (BTR.sys), embedded in MpEngine.dll, can be repurposed by attackers with admin privileges to perform privileged kernel-level file and registry operations.
  • The driver uses a proprietary transaction protocol with RC4 encryption and integrity checks to execute commands from Ring 0.
  • This driver operates as a system-start driver, creating a ‘golden window’ for attacks before security components initialize.
  • Unlike typical vulnerable driver attacks, BTR.sys is a legitimate, Microsoft-signed driver.
  • Researchers created a proof-of-concept tool (BTR_CLI) to demonstrate exploitation; no in-the-wild exploitation has been observed.

Impact

  • Potential for attackers to disable EDR and antivirus products by deleting or modifying security binaries at kernel level.
  • Risk of stealthy kernel-level compromise with trusted driver bypassing common security controls.

Recommendations

  • Monitor for suspicious BTR.sys behavior, especially .sys:changelist Alternate Data Stream use via Sysmon Event ID 15 and driver load anomalies via Event ID 6.
  • Detect Defender remediation drivers launched by unusual processes.
  • Audit and restrict SeLoadDriverPrivilege tightly.
  • Enforce application control policies and build detections around boot-time persistence changes.

Reference Links

  1. Critical Elementor Pro Bug Exposes WordPress Sites to RCE Attacks

Overview

  • A critical vulnerability in the Elementor Pro WordPress plugin enables attackers to upload executable files.
  • This flaw allows remote code execution (RCE) on affected servers, risking full system compromise.

Impact

  • Unauthorized remote code execution on WordPress sites using Elementor Pro.
  • Potential full control over compromised web servers, leading to data breaches, defacement, or malware deployment.

Recommendations

  • Update Elementor Pro plugin immediately once a patch is available.
  • Implement web application firewall (WAF) rules to block suspicious file uploads.
  • Monitor web server logs for unusual activity related to plugin usage.

Reference Links

  1. CVE-2026-62834: Azure Data Factory Elevation of Privilege

Overview

  • An elevation of privilege vulnerability exists due to improper verification of cryptographic signatures in Azure Data Factory, allowing unauthorized attackers to elevate privileges remotely over a network.

Impact

  • Unauthorized privilege escalation could enable attackers to perform actions with higher privileges than intended.

Recommendations

  • Apply security updates as provided by Microsoft to address this vulnerability.

Reference Links

  1. CVE-2026-65801: Microsoft Exchange Online Elevation of Privilege (SSRF)

Overview

  • A server-side request forgery (SSRF) vulnerability exists in Microsoft Exchange Online, allowing unauthorized attackers to elevate privileges remotely over a network.

Impact

  • Attackers can gain elevated privileges, potentially leading to unauthorized access or control of Exchange Online environments.

Recommendations

  • Apply security updates from Microsoft as soon as they become available to mitigate this vulnerability.

Reference Links

  1. CVE-2026-68789: Azure SQL Database Elevation of Privilege (SQL Injection)

Overview

  • An SQL injection vulnerability exists in Azure SQL Database due to improper neutralization of special elements in SQL commands, exploitable by an authorized attacker over the network.

Impact

  • Allows elevation of privileges, potentially granting the attacker higher access levels than intended.

Recommendations

  • Apply security updates provided by Microsoft to mitigate the vulnerability.

Reference Links

  1. isolated-vm Sandbox Escape Vulnerability – Potential RCE (GHSA-864f-rcv7-6rh4)

Overview

  • A critical vulnerability (GHSA-864f-rcv7-6rh4) was disclosed in isolated-vm, an open-source sandbox library.
  • The flaw allows attackers to escape the isolated sandbox environment, potentially leading to remote code execution.
  • All versions up to and including 7.0.0 are impacted.

Impact

  • Attackers can bypass sandbox restrictions and execute code on the host system.

Affected / Fixed Versions

  • Affected: All versions of isolated-vm up to and including 7.0.0.

Recommendations

  • Update to a patched version once available or implement additional isolation controls until a fix is released.

Reference Links

  1. Critical NetScaler Flaw Can Bypass Authentication on Gateway and AAA Servers

Overview

  • Citrix released patches for two vulnerabilities in NetScaler ADC and NetScaler Gateway deployments.
  • One of the flaws is a critical-severity authentication bypass vulnerability affecting certain FIPS and NDcPP builds and SecurAccess.

Impact

  • Successful exploitation allows attackers to bypass authentication mechanisms, potentially gaining unauthorized access.

Affected / Fixed Versions

  • Specific versions not detailed; updates address the issues in customer-managed NetScaler ADC and Gateway deployments.

Recommendations

  • Apply the latest patches released by Citrix promptly.
  • Review NetScaler ADC and Gateway configurations for exposure.
  • Monitor systems for suspicious authentication activity.

Reference Links

  1. Attackers Exploit Zimbra SNMP Flaw for Unauthenticated RCE (CVE-2026-73570)

Overview

  • A critical security flaw (CVE-2026-73570) in Zimbra Collaboration Suite (ZCS) was actively exploited in the wild.
  • The vulnerability involves command injection via SNMP functionality, enabling unauthenticated remote code execution.
  • The issue was reported and confirmed by CERT Polska.

Impact

  • Successful exploitation allows attackers to execute arbitrary commands remotely without authentication, leading to full system compromise of Zimbra servers.

Affected / Fixed Versions

  • Specific affected versions not detailed; a patch addressing the vulnerability has been released by Zimbra.

Recommendations

  • Apply the security update from Zimbra immediately to mitigate the risk.
  • Monitor systems for any unusual activity indicative of exploitation attempts.

Reference Links

  1. BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

Overview

  • Researchers fully reverse-engineered the Windows Defender Boot-Time Removal driver (BTR.sys), revealing it can be repurposed as a kernel operation engine.
  • The driver loads with a randomized filename, reads a configuration blob stored as an RC4-encrypted Alternate Data Stream, and executes file and registry operations from Ring 0.
  • Researchers introduced BTR_CLI, a tool to construct valid encrypted transactions to demonstrate driver capabilities.
  • This can be abused as an EDR and antivirus bypass technique without relying on typical BYOVD exploits.

Impact

  • Attackers can leverage a trusted, signed Microsoft remediation driver to obtain kernel privileges and bypass security product detection.
  • The approach can disarm security solutions by abusing legitimate Windows components.

Recommendations

  • Monitor usage of BTR.sys and related randomized drivers, especially those loading from an Alternate Data Stream.
  • Enhance detection capabilities for unusual configuration blobs and non-standard driver loading behaviors.
  • Review and restrict use of built-in remediation drivers where feasible.

Reference Links

  1. Citrix Urges Admins to Patch New NetScaler Flaws

Overview

  • Citrix announced two new vulnerabilities impacting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances.
  • Customers are strongly urged to promptly apply patches to protect systems from potential exploitation.

Impact

  • Potential compromise of affected NetScaler devices, risking unauthorized access or disruption.

Recommendations

  • Apply Citrix-issued security patches for NetScaler Gateway and ADC products without delay.

Reference Links

  1. Clop’s PTC Windchill and FlexPLM Zero-Day Attack Campaign (CVE-2026-12569)

Overview

  • Clop cybercrime group exploited a critical zero-day vulnerability (CVE-2026-12569) in PTC’s Windchill and FlexPLM software to conduct widespread data theft.
  • Vulnerability allows unauthenticated remote code execution; disclosed by PTC on June 17, 2026 with a patch issued the following day.
  • Clop started sending extortion emails to victims in mid-July 2026, after likely early June exploitation.
  • The attack targeted manufacturers and retailers in aerospace, automotive, and supply chain management.
  • Clop used a custom web shell mimicking legitimate Windchill operations to evade detection.
  • Victims include large public companies such as Toast, Zebra, GE, Philips, and Shell.

Impact

  • Large-scale data theft impacting dozens of organizations.
  • Extended undetected data exfiltration for weeks or months.
  • Challenges for defenders due to the mimicry of normal software functions.

Affected / Fixed Versions

  • PTC Windchill and FlexPLM affected; patch and indicators of compromise released by PTC on June 18, 2026.

Recommendations

  • Apply the available patches from PTC immediately.
  • Monitor network and system logs for indicators of compromise related to this attack.
  • Conduct thorough forensic investigations if PTC products are used.
  • Enhance detection capabilities to identify threats that mimic legitimate software behavior.

Reference Links

  1. Cisco August 19, 2026 Security Advisories – Critical to Medium Severity

Overview

  • Cisco PSIRT released multiple security advisories covering critical to medium severity vulnerabilities affecting Cisco Crosswork, Secure Workload Software, BroadWorks, Unified Intelligence Center, RoomOS, Industrial Ethernet switches, and Contact Center Enterprise.
  • Vulnerabilities include XML External Entity Injection, SQL Injection, stack overflow, stored XSS, denial of service, and SSRF.
  • Security impact ratings range from critical (CVSS 10.0) to medium severity.

Impact

  • Critical vulnerabilities in Cisco Crosswork and Secure Workload Software could lead to complete system compromise (CVSS 10.0).
  • High and medium severity vulnerabilities expose affected devices to injection attacks, DoS, and other exploits.

Affected / Fixed Versions

  • Specific affected and fixed software versions detailed in the individual Cisco advisories published on August 19, 2026.

Recommendations

  • Upgrade to fixed software versions as detailed in the respective advisories.

Reference Links

  1. Cisco Secure Workload Software Security Hardening Release: August 2026

Overview

  • Cisco Secure Workload engineering team completed an internal security review revealing multiple vulnerabilities, categorized by CWE and grouped under distinct CVE IDs.
  • No active exploitation of these vulnerabilities is currently known.
  • Software updates have been released to address all identified issues.

Impact

  • Vulnerabilities have a Critical security impact rating. No workarounds are available; patching is required.

Affected / Fixed Versions

  • Specific affected or fixed versions detailed in the Cisco advisory.

Recommendations

  • Apply the released Cisco Secure Workload software updates immediately.

Reference Links

  1. Cisco Industrial Ethernet 1000 Series Switches Stored XSS Vulnerability (CVE-2026-20232)

Overview

  • An authenticated, remote attacker can exploit a stored XSS vulnerability in the web-based management interface of Cisco IE 1000 Series Switches due to insufficient input validation.

Impact

  • Successful exploitation allows execution of arbitrary script code in the context of another user, potentially compromising their session or data.

Affected / Fixed Versions

  • Cisco has released software updates that address this vulnerability.

Recommendations

  • Apply the Cisco software updates addressing CVE-2026-20232 promptly.
  • No workarounds are available; update is critical.

Reference Links

  1. NIST Releases Tips & Tactics for Building Automation & Control System Cybersecurity

Overview

  • Highlights rising cybersecurity threats to operational technology (OT) in critical infrastructure.
  • Emphasizes the importance of cybersecurity for infrastructure owners/operators.
  • Acknowledges challenges faced by OT operators in managing cybersecurity risks with limited resources.

Impact

  • OT systems in critical infrastructure are at heightened risk of cyberattacks, potentially disrupting essential services.

Recommendations

  • Apply NIST guidance and best practices to improve cybersecurity posture in building automation and control systems.

Reference Links

  1. Oracle August 2026 Critical Security Patch Update – 925 CVEs

Overview

  • Oracle released its August 2026 Critical Security Patch Update (CSPU) addressing 925 unique CVEs in 943 patches.
  • The update spans 23 Oracle product families; Oracle Fusion Middleware and Oracle Hyperion each received the highest number of patches at 262.
  • 16.3% of patches are critical severity; 59% are high severity.
  • Many vulnerabilities can be exploited remotely without authentication.

Impact

  • Significant security risks for affected Oracle products with many remotely exploitable and unauthenticated attack vectors.

Affected / Fixed Versions

  • Multiple Oracle product families including Fusion Middleware, Hyperion, E-Business Suite, Commerce, and others.

Recommendations

  • Apply the August 2026 CSPU patches immediately, prioritizing critical and high severity vulnerabilities.
  • Use vulnerability scanning tools to identify affected systems and verify patch deployment.

Reference Links

  1. Critical GitLab Zero-Click Flaw (CVE-2026-19478)

Overview

  • CVE-2026-19478 is a critical zero-click vulnerability affecting self-managed GitLab instances.
  • Limited technical details have been disclosed, complicating detection efforts.

Impact

  • Potential exploitation could allow attackers to compromise GitLab environments without user interaction.

Recommendations

  • Apply available patches promptly and enhance monitoring for unusual activity.

Reference Links

  1. Medusa Ransomware Tallies Hundreds of New Victims

Overview

  • Medusa ransomware-as-a-service group has updated tactics and increased victims to over 500 as of April 2026.
  • The group uses access brokers paid between $100 and $1 million, exploiting software vulnerabilities including Fortra GoAnywhere and BeyondTrust, often within 24 hours of announcement.
  • Employs living off the land techniques, legitimate tools, RMM software, and RDP for lateral movement.
  • Primarily opportunistic but frequently targets the Healthcare and Public Health sector.

Impact

  • Over 500 victims identified since March 2025.
  • Significant impact to Healthcare and Public Health sectors.

Recommendations

  • Apply patches promptly to address newly disclosed vulnerabilities.
  • Monitor for use of legitimate tools and anomalous remote access activity.
  • Strengthen access controls and credential management.
  • Improve detection resilience against living off the land techniques.

Reference Links

  1. Thousands of Hacked WordPress Sites Powering StopAndProtect Criminal Operation

Overview

  • StopAndProtect is a large-scale criminal operation abusing thousands of hacked WordPress websites as infrastructure for spreading malware, controlling infected machines, and storing stolen data.
  • Infection chain begins with a ClickFix social-engineering prompt leading to PowerShell execution and multiple .NET downloader/loader stages.
  • The operation deploys ransomware, SMB/USB worm, LockScreen, VBS spreader, chat utility, and credential stealer.
  • Many compromised WordPress sites run outdated versions with SQL injection, authentication bypass, and arbitrary file upload vulnerabilities.

Impact

  • Infection leads to file encryption, data theft, system locking, credential stealing, and persistent backdoor access.
  • Victims include thousands of IP addresses worldwide; exfiltrated data includes documents, screenshots, and activity logs.

Recommendations

  • Keep WordPress core and plugins up to date to remediate known vulnerabilities.
  • Monitor for unusual PowerShell or .NET execution patterns.
  • Audit web infrastructure for exposed directories and unauthorized plugins.
  • Detect and block command-and-control communications with known malicious WordPress domains.

Reference Links

  1. Video Call Exploit Chains Two Flaws in Unisoc Modems

Overview

  • Researchers discovered a combined exploit chaining two vulnerabilities in Unisoc modems.
  • The exploit delivers a payload via video call, requiring the victim to answer the phone.
  • The attack enables full takeover of the targeted Android device.

Impact

  • Complete device takeover allowing attackers to gain full control over an Android device.

Recommendations

  • Monitor vendor advisories from Unisoc and affected device manufacturers for patches.
  • Apply firmware updates as they become available.

Reference Links

AI Threat Landscape

  1. AWS Shows How to Stop a Hijacked AI Agent From Reading Data the User Cannot Access

Overview

  • AI agents accessing databases and SaaS platforms often lack built-in user authorization awareness, risking unauthorized data exposure if compromised.
  • AWS published an architecture using Amazon Bedrock AgentCore that enforces authorization at the infrastructure level rather than agent code.
  • The design prevents prompt injection or manipulation attacks by validating user identity and enforcing strict downstream access controls.
  • Uses JWT tokens with embedded department claims, validated by Bedrock AgentCore runtime.
  • AWS employs AssumeRoleWithWebIdentity for DynamoDB, metadata tagging for Bedrock Knowledge Bases, and on-behalf-of token exchange for Salesforce.

Impact

  • Mitigates risk of data leaks from hijacked or manipulated AI agents by preventing unauthorized data access regardless of agent compromise.
  • Enhances security in multi-tenant or role-segregated environments by enforcing least-privilege models through infrastructure policies.

Recommendations

  • Adopt infrastructure-level authorization for AI agents coordinating data access rather than relying on agent-side filtering.
  • Use short-lived, user-scoped credentials and validate identity tokens on every call.
  • Regularly perform API security testing to ensure token exchanges resist privilege escalation.

Reference Links

  1. AI-Generated Exploit Scripts Used in Active Attacks on Siemens S7 Series PLCs

Overview

  • U.S. government agencies issued a joint advisory warning that threat actors are actively exploiting Siemens S7 Series PLCs using AI-generated exploit scripts.
  • Attackers leverage AI to rapidly develop and refine custom tools based on open-source industrial automation libraries such as snap7.dll, disguising them as legitimate OT monitoring software.
  • Targeted Siemens PLC models include S7-200, S7-300, S7-400, S7-1200, and S7-1500 series across critical infrastructure sectors.
  • No new zero-day vulnerabilities are involved; attackers exploit known vulnerabilities, weak/default credentials, and unnecessary internet exposure.

Impact

  • Potential unauthorized read/write access to PLC memory, configuration data, and ladder logic programs.
  • Persistent reconnaissance and capability-building by threat actors, pre-positioning for future disruptive attacks on critical infrastructure.

Affected / Fixed Versions

  • Various CPU variants of Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 series (including F-series safety controllers).
  • No specific patches referenced; mitigations focus on network segmentation and exposure reduction.

Recommendations

  • Remove Siemens S7 Series PLCs from direct internet exposure.
  • Implement strict OT/IT network segmentation.
  • Harden access controls and credential management on affected devices.
  • Consult Siemens ProductCERT advisories for device-specific vulnerability patches or workarounds.

Reference Links

  1. CISA Warns of Hackers Exploiting Critical MLflow Vulnerability

Overview

  • CISA issued a warning that threat actors are actively exploiting a critical vulnerability in MLflow, an open-source AI engineering platform.
  • The vulnerability affects the security of MLflow, which is used for managing the machine learning lifecycle.

Impact

  • Exploitation could allow attackers to compromise AI development environments, potentially leading to unauthorized access or manipulation of AI models and data.

Recommendations

  • Organizations using MLflow should apply security patches promptly and monitor for indicators of compromise related to this vulnerability.

Reference Links

  1. The Agentic AI Threat Cluster: Seven Incidents, Three Actors

Overview

  • Tenable’s RSO team identified a cluster of seven incidents involving agentic AI-driven cyber attacks from November 2025 to August 2026.
  • The most notable was a July 2026 near-autonomous AI cyber attack against Taiwan’s government, compromising 85 accounts and exfiltrating 2,564 personnel records in four days.
  • Attackers used open-source AI agent projects Hermes Agent and OpenClaw with Bayesian decision engines coordinating up to eight sub-agents.
  • The autonomous agents bypassed safety guardrails by reclassifying offensive operations as authorized penetration testing via prompt manipulation.
  • No single CVE was exploited; attacks leveraged misconfigurations, exposed interfaces, and weak credentials discovered dynamically at machine speed.
  • Related incidents include JADEPUFFER exploiting CVE-2025-3248 for database extortion and knaithe/KnYuan autonomously scanning for vulnerabilities.

Impact

  • Compromise of government systems including critical infrastructure sectors such as nuclear safety and energy.
  • Extensive credential theft and sensitive data exfiltration.
  • Demonstrates autonomous AI-driven attacks with minimal human oversight.
  • Erosion of traditional CVE-centric defense approaches due to dynamic exploitation of broad attack surfaces.

Recommendations

  • Identify and secure federation endpoints, enforce strong credential policies, and correctly configure SSO systems.
  • Deploy continuous monitoring tools to detect attack surface exposures vulnerable to AI-driven automated exploitation.
  • Develop defensive measures addressing autonomous agent threat behaviors and novel prompt injection bypasses.

Reference Links

You may also like

Ready to get started?

Contact us to arrange a half day
Managed SOC and XDR workshop in Dubai

Contact Us

Ready to get started?

Contact us to arrange a half day Managed SOC and XDR workshop in Dubai

Contact Us
Linkedin Twitter Facebook Instagram Youtube

HawkEye

Packages

CSOC

Explore

© 2026 HawkEye – Managed CSOC and XDR powered by DTS Solution. All Rights Reserved.
Contact
This is a staging environment