Security incidents in August 2026

BlueMoon used phishing links and three Chrome/Windows flaws to install spying malware on targeted Windows PCs. Fixes are available for Chrome, Edge and affected supported Windows versions. Update browsers and Windows; suspected infections need investigation.

Attackers are using an old ownCloud Server flaw to steal files without a password. Versions 10.6.0–10.13.0 are affected. Ask the server administrator to update; ownCloud's later guidance recommends 10.13.3 or a support patch.

Two PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, let attackers run code without a password and are being used in attacks, including data theft. Update to 24.1.10, 25.0.13 or 26.0.5. Version 23 and older get no fix. Home users: nothing to do.

A Linux kernel IPv6 flaw (CVE-2026-53362) lets someone already on a machine or inside a container become root. CISA says it is exploited. Mostly a server issue: update your Linux distribution's kernel and restart. Home users on desktop Linux should apply updates.

Attackers are exploiting CVE-2026-8452 in customer-managed Citrix NetScaler gateways and authentication servers. Citrix describes crashes; NHS England also reports demonstrated code execution. Ask your IT provider to install the fixed firmware.

Attackers are exploiting CVE-2019-1068 in unpatched Microsoft SQL Server databases. Fixes for affected SQL Server 2014, 2016 and 2017 branches date to July 2019. Ask your IT provider to verify every instance is patched and check for compromise.

Attackers are exploiting an old Ajax.NET Professional flaw on website servers. The official AjaxNetProfessional package has a fix; several other packages do not. Ask your website developer to migrate to official version 24.10.10.1 and check for intruders.

CISA confirms attacks using Linux kernel flaw CVE-2022-0995. Someone already able to run code locally could gain higher privileges or crash the machine. Install your Linux vendor's kernel update and restart; some older Ubuntu kernels remain vulnerable.

CISA says attackers are using CVE-2015-5287, an old flaw in Red Hat's crash reporter ABRT that lets a local user become root. It matters on RHEL/CentOS 6 and 7 servers. Install the abrt and libreport updates, or remove ABRT, and retire unsupported systems.

A 2015 flaw in Red Hat's libuser (CVE-2015-3246) is now on CISA's exploited list. A local user can corrupt /etc/passwd and gain root. Fixed in RHEL 6 and 7 updates; RHEL 5 has no fix. Server admins should confirm libuser is updated.

Attackers have exploited Gitea's CVE-2026-60004 to run code on self-hosted development servers and steal repositories and credentials. Administrators should update to 1.27.1 or later and investigate earlier compromise.

Attackers are exploiting CVE-2026-21962 in Oracle HTTP Server and WebLogic Server Proxy Plug-in to access or alter data without signing in. Business IT teams should apply Oracle's January 2026 security fix and check exposed systems for compromise.

Attackers are exploiting Zimbra email servers before 10.1.20 with optional SNMP monitoring enabled. Ask your email provider or IT team to update to 10.1.20 or later and investigate possible compromise, including stolen authentication secrets.

Two critical TrueConf Server flaws let attackers run code without a password. Compromised servers also delivered malware to meeting participants. Update servers to the fixed builds and ask IT to check servers and attendees' computers for compromise.

Attackers used a flaw in the shared Cosmos EVM code to steal tokens from six blockchains between 20 and 25 August. Fixes are out (v0.6.2, v0.7.2). Chain operators must apply them. Holders of MANTRA, TAC or KII tokens should follow their chain's official channels.

Attackers used MLflow servers to reach private network services and steal cloud credentials. The original flaw is fixed in 3.15.0; use 3.16.0 or later to include follow-up protections. Ask your organisation's AI team to update and investigate exposure.

Attackers are using CVE-2026-33824 to target Windows systems with IKEv2 enabled. Windows 10, Windows 11 and Windows Server are affected. Install current Windows security updates; Microsoft's April 2026 fixes already protect against this flaw.

Attackers are exploiting a SharePoint Server authentication bypass that lets them impersonate users, including administrators. July updates fixed all three affected editions. Ask your organisation’s IT team to update its servers and investigate possible intrusion.

A critical VMware vCenter flaw (CVE-2026-59310) lets an attacker with network access run code. CISA lists it as exploited, including by ransomware gangs. Fixed in 9.1.0.0300, 9.0.2.0100 and 8.0 U3k, with no workaround. Patch now; keep vCenter off the internet.

A malicious page or advert viewed in Firefox or Safari can trigger code execution through vulnerable Ray development systems. CISA confirms exploitation. Developers and IT teams should update Ray to 2.52.0 or later.

JFrog Artifactory flaw CVE-2026-66384 lets a signed-in user write files outside the Docker cache folder. CISA lists it as used in attacks. Self-hosted servers should upgrade to 7.146.35 or 7.161.16; JFrog says its cloud service needs no action.

Attackers are exploiting CVE-2026-20349 to restart Cisco ASA and FTD business firewalls without logging in. Organisations using affected remote-access services should install Cisco's September hardening release for their branch.

Lazarus used a Windows flaw to turn an existing foothold into SYSTEM-level control and hide malware. Microsoft released fixes on 11 August. Install current Windows updates; defence-sector staff should also report suspicious recruitment downloads to IT.

Attackers are exploiting a command injection flaw in Progress LoadMaster and related business appliances without logging in. Ask IT to install firmware 7.2.63.2, or 7.2.54.18 for LoadMaster LTSF, and check for compromise.

A flaw in macOS Screen Sharing (CVE-2026-65400) let attackers sign in without a password. It is being used against Macs exposed to the internet. Update to macOS 26.6.1 or later, 15.7.9 or 14.8.9, and switch Screen Sharing off if you don't need it.

Attackers, including ransomware gangs, exploit TeamCity servers without signing in. Update self-hosted servers to 2026.1.3 or 2025.11.7 or later, and investigate possible compromise. Former Cadence users must rotate exposed credentials.

Attackers are exploiting an encryption bypass in Apache Tomcat clustered servers. Affected releases are 11.0.20, 10.1.53 and 9.0.116. Ask your IT provider to update to a current supported release and check for data exposure.

Attackers are exploiting IBM Langflow OSS 1.0.0–1.10.0 to run code without signing in. Version 1.10.1 fixes this flaw. Ask whoever runs your AI systems to update, investigate exposed servers and replace exposed credentials.

Attackers used N-central's login bypass to take administrative control and reach customers' computers. IT providers must install Hotfix 2 (2026.3.1.10) or later and check for intruders; Hotfix 1 alone is insufficient.

An attacker borrowed US$120.4 million against manipulated Tectonic collateral. Cronos halted and rolled back transactions, reversing US$111.2 million. Affected users should check balances and follow Tectonic's official reopening instructions.

An attacker used inflated MAMO collateral to borrow US$11.03 million from Moonwell on Base, leaving about US$9.13 million in debt after liquidations. Supplier recovery remains unresolved. Check affected positions with Moonwell before adding funds.

Attackers stole customer data from Manchester, Stansted and East Midlands airport services and later published it. MAG says everyone affected has been told. Watch for convincing booking-related scams; existing bookings remain valid.

McKesson confirmed data theft involving some oncology and specialty-care customers. Attackers claimed 284 million records, not people; the patient total remains unconfirmed. Check any breach notice and verify unexpected medical or billing calls.

Nutex Health, which runs 28 US healthcare facilities, says an attacker stole patient, employee, provider and financial data, then posted it online (10 Sep). Number affected not disclosed. If you've been treated there, watch for notification letters and scam contact.

Nesa's blockchain was exploited on 24 Aug 2026 through a Cosmos EVM flaw. About US$50m of NES was moved off-chain, but thin liquidity left the attacker an estimated US$60k. Nesa says it has patched. NES holders should use only the new official contracts.

Term Finance's strategy vaults (built on Yearn V3) lost about US$8.5M on 23 Aug after an attacker bought majority voting power and passed proposals to take them over. Vaults are closed; withdrawals stay open. No recovery or reimbursement plan has been announced.

An attacker chained six bugs in MAYAChain to forge CACAO and drain about US$1.7M in bitcoin and other assets; trading was halted. Pool value fell US$10.9M. As of early September no restart or full recovery was reported. Users: avoid MAYAChain pools until Maya confirms a fix.

Published Oz Hair and Beauty data contained about two million email addresses and customer details. The retailer says passwords and payment information were excluded. Watch for convincing fake retailer messages and contact the company directly.

Cedar County Memorial Hospital restored electronic records on 28 August after a two-week outage. Unauthorised access is confirmed; patient-data exposure remains under review. Patients concerned they were affected can request free credit monitoring.

Apple sent spyware warnings to targeted users in 110 countries on 13 August. A warning establishes targeting, not successful infection. Verify it at account.apple.com, update your devices, enable Lockdown Mode and seek specialist help.

ShinyHunters published data attributed to Carhartt containing 12.9 million unique email addresses, plus names, phone numbers and postal addresses. Carhartt confirmation remains unlocated. Check HIBP and verify unexpected messages independently.

France's tax authority confirmed stolen records concerning 678,000 individuals and businesses. Taxpayers' passwords were not stolen. Watch for convincing tax or bank impersonation and open impots.gouv.fr directly to check messages.

A Heights Finance cloud-platform breach affected 4,132,834 people, potentially exposing identity and banking details. Borrowers, applicants and some former Curo borrowers may be affected. Ask Heights about its free identity protection and check bank activity.

Coinsbuy, a crypto payment processor, lost about US$7.9–8.07M from platform wallets on Ethereum and TRON on 9 Aug 2026. It says clients were made whole from reserves. Cause unpublished; only a small part frozen. Nothing for families to do.

Rhysida stole data from Berlin's state administration in August 2026 and published it on 4 September after Berlin refused to pay. The government confirms theft but not scope. Affected people are to be told by authorities; if you hear from Berlin, check it is genuine.

The KITE Foundation said it contained an attack on its Ethereum token on 5-6 August and lost no tokens. A US$13 million theft is not confirmed. Transfers were paused, then a new contract went live on 28 August. Check the contract address before moving KITE.

Attackers accessed approximately 5,000 Dropbox accounts without Dropbox two-factor authentication through a Lenovo ID sign-in flaw. Dropbox closed the access route and notified users. Turn on two-factor authentication and contact support if notified.

Attackers stole names, emails and account details for 1,079,819 Mathspace users in Australia and New Zealand. Passwords and academic records were not exposed. Verify unexpected school or Mathspace messages independently.

Liechtenstein's beneficial owner register was hacked on 30 July 2026 and data on about 31,000 companies, foundations and trusts was copied. It holds owners' names, birth dates, nationalities and residence. Register reopened in limited form 5 Oct; no sign of publication.

Nineteen Chrome and Edge extensions carried Superior malware targeting passwords, browsing data and cryptocurrency. Remove the listed extensions, scan the computer and change exposed passwords. No verified safe replacement releases were identified.

Socket found 77 linked Firefox add-ons; 40 were confirmed wallet stealers. Some began harmless and turned malicious via updates. 16 more followed in October. If you entered a recovery phrase in one, move funds to a new wallet. Remove unfamiliar wallet extensions.

An unidentified crypto holder lost about US$25.6M on 12 Aug 2026 to a reported phishing attack. No funds returned in the reports we found. The same wallet lost US$24M in 2023. Never sign approvals from links or pop-ups; check them with a hardware wallet.

A fake CCleaner download site installs GhostDesk, a Chrome add-on that steals passwords and cookies, logs keystrokes and takes screenshots. Windows users only.

Scammers targeted COLDCARD owners with fake audit emails and live-chat help that pushed a Windows download installing ScreenConnect. Ignore the audit request. If you ran it, disconnect the computer and get trusted help using a separate clean device.