CFToday Curated security signals.

Daily edition · 2026-08-23

Sunday, 23 August 2026

39 items across 8 sections, selected from 5488 candidates over 6 runs. 105 carried the panel unanimously.

Show
Section

  1. CVE-2026-77649 (CVSS 9.8): The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue depen (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC Must read CVE-2026-77649 CVSS 9.8 EPSS 0.4% agreed2/2

    Why readinternment 0.8.7 shipped a dependency that registers with a command and control server and executes during cargo build, so any project that compiled it is an incident to investigate rather than a version to bump.

    The crate pulled in a rogue dependency tied to the wider arrayref proc-macro compromise, giving the attacker arbitrary code execution at build time on whatever machine ran the compile. That means CI runners and developer workstations, with whatever secrets those build environments hold, not just the produced binary. Check build logs and lockfiles for the affected version, treat any hit as a credential exposure, and read the rust-lang advisory for the full list of compromised packages in the campaign.

  2. CVE-2026-77650 (CVSS 9.8): The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC CVE-2026-77650 CVSS 9.8 EPSS 0.4% agreed2/2

    Why readThe second crate name to add to your audit list from the same crates.io build-time malware campaign, which matters only because you cannot search for a package you did not know was touched.

    append-only-vec 0.1.9 carried the same rogue dependency as the other affected crates in the arrayref incident, executing attacker code during compilation and calling out to a command and control server. The technical detail is identical to the companion advisory, so the useful content is purely the affected name and version. Both crates share the same maintainer namespace, which is the shape worth noting: a single compromised publisher account can taint several unrelated dependencies at once.

  3. A $25 template helped scammers build hundreds of phantom bank domains (opens in a new tab)

    Help Net Security ·Sinisa Markovic ·fetched 23 Aug 2026, 03:38 UTC agreed2/2

    Why readA single $25 website template is the shared fingerprint linking hundreds of fake bank domains built to give scams a legitimate-looking institution behind them.

    Allure Security traced a suspicious lookalike domain that carried none of the impersonated brand's assets and instead presented an unrelated bank; the phrase "one of the largest digital banking providers" turned out to be template boilerplate reused across hundreds of phantom bank sites. The pivot is the useful part: a stock marketing string becomes a hunting selector for the whole cluster. Help Net Security is summarising the vendor research rather than carrying the indicators, so the domains and infrastructure detail are not here.

    Indicators2
    Domains
    remedycodes[.]site classtandscrest[.]com
  4. Weekly summary of malicious campaigns: August 15-21 (opens in a new tab)

    translated Sintesi riepilogativa delle campagne malevole nella settimana del 15 – 21 agosto

    CERT-AGID (Italy) ·Francesco Tozzi ·fetched 23 Aug 2026, 11:36 UTC agreed2/2

    Why read1,431 fresh IOCs from 132 malicious campaigns against Italian targets in one week, with the brands and lures named.

    CERT-AGID tracked 132 malicious campaigns in the week of 15-21 August, 103 aimed specifically at Italy, and released 1,431 indicators of compromise to accredited bodies. Nineteen lure themes appeared, led by fines (37 phishing campaigns, mostly abusing SEND and PagoPA, with some using Polizia di Stato and ATAC branding) and banking (18 campaigns targeting BNL, BPM, ING, InteractiveBrokers, Intesa Sanpaolo, Klarna, Mediobanca, Mooney and Nexi customers). Useful as a recurring feed of Italy-specific phishing infrastructure.

  5. Phishing campaign targeting the Italian Ministry of Health uses fake healthcare refund lures (opens in a new tab)

    translated Phishing ai danni del Ministero della Salute sfrutta un falso “rimborso ticket sanitario”

    CERT-AGID (Italy) ·Francesco Tozzi ·fetched 23 Aug 2026, 15:38 UTC agreed2/2

    Why readDetails a live phishing campaign spoofing Italy's Ministero della Salute with a 278,26 euro health ticket refund lure, including the spoofed sender and the four-stage credential and card harvesting flow.

    Emails subject-lined "Hai diritto a un rimborso" claim a duplicate health ticket payment entitles the recipient to 278,26 euro, using spoofed sender [email protected] and Ministry branding to push a "Conferma i tuoi dati" button. The landing site runs a four-step funnel that collects personal identifiers and then payment card data. Concrete enough for mail filtering and user awareness in Italian public sector environments, though it is a standard government-refund lure rather than new tradecraft.

  1. CVE-2026-77806 (CVSS 9.8): SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC Must read CVE-2026-77806 CVSS 9.8 EPSS 0.8% agreed2/2

    Why readUnauthenticated RCE in SPIP exploited in the wild in August 2026, with the injection vector named (the X-Spip-Filtre header) and a Metasploit module in review.

    SPIP before 4.4.21 allows unauthenticated remote code execution via code injection in the X-Spip-Filtre HTTP request header, mishandled by analyse_resultat_skel, and NVD records it as exploited in the wild in August 2026. CVSS 9.8 with no privileges or user interaction, and SSVC marks it automatable. References include SPIP's own critical update post for 4.4.21 and Metasploit PR 21790 with commit b16eca8, so weaponised tooling is essentially public: patch internet-facing SPIP now and grep access logs for the header.

    Indicators1
    Hashes
    b16eca819abb8f1401f21d115e71e3dfc67b847c
  2. Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution (opens in a new tab)

    The Hacker News ·The Hacker News ·fetched 23 Aug 2026, 15:38 UTC Must read CVE-2026-73570 EPSS 1.0% agreed2/2

    Why readCERT Polska reports active exploitation of CVE-2026-73570, unauthenticated RCE in Zimbra Collaboration before 10.1.20 when the optional zimbra-snmp package is installed, and names the log file to check.

    Improper sanitisation during SNMP notification processing lets an unauthenticated attacker send crafted SMTP requests that execute OS commands as the zimbra user; CVSS 8.9, fixed in ZCS 10.1.20 last month. Exposure requires the optional zimbra-snmp package installed with SNMP notifications enabled, which narrows the estate but does not help anyone who has it. CERT Polska is seeing exploitation attempts now and points defenders at /var/log/zimbra.log for evidence, so patch state and that log are the two things to check today, EPSS of 0.010 notwithstanding.

  3. CVE-2026-77647 (CVSS 9.8): SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to inco (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 19:36 UTC CVE-2026-77647 CVSS 9.8 EPSS 0.8% agreed2/2

    Why readUnauthenticated RCE in SPIP before 4.4.20, already exploited in the wild in August 2026, so any public SPIP install needs patching today.

    SPIP versions below 4.4.20 allow unauthenticated remote code execution, and NVD records exploitation in the wild during August 2026. The root cause is incorrect identification of <?php blocks combined with var_export mishandling input containing a '<' character, which lets attacker-controlled content be written back as executable PHP. CVSS 9.8, patched in 4.4.20; Debian has issued a matching security announcement, so distro packages are the fastest route to remediation.

  4. GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure (opens in a new tab)

    The Hacker News ·The Hacker News ·fetched 23 Aug 2026, 11:36 UTC Must read CVE-2026-19478 EPSS 1.5% agreed2/2

    Why readCVE-2026-19478 in GitLab (CVSS 9.4, unauthenticated project takeover via a GraphQL directive) is being exploited in the wild; patch to 19.2.4, 19.1.6, 19.0.8 or 18.11.11.

    A code injection flaw in GitLab CE and EE lets an unauthenticated attacker modify or delete publicly accessible projects and rewrite their data, with no user interaction or unusual configuration required, triggered through a GraphQL directive. watchTowr reproduced it within minutes of disclosure and observed in-the-wild exploitation against its honeypot network days after the advisory. Fixed releases are 19.2.4, 19.1.6, 19.0.8 and 18.11.11; EPSS is still low at 0.015 but confirmed exploitation outranks that.

  5. U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog (opens in a new tab)

    Security Affairs ·Pierluigi Paganini ·fetched 23 Aug 2026, 11:36 UTC Must read CVE-2026-73570 EPSS 1.0% agreed2/2

    Why readCVE-2026-73570 in Zimbra Collaboration Suite is now in KEV: unauthenticated OS command injection running as the zimbra user, exploited in the wild per CERT Polska.

    CISA added Zimbra Collaboration Suite flaw CVE-2026-73570 to the Known Exploited Vulnerabilities catalog after CERT Polska confirmed active exploitation. The bug is an OS command injection giving unauthenticated remote code execution with zimbra user privileges, and it affects instances with the SNMP trap service enabled via the snmp_notify parameter alongside a running swatchdog service, which is on by default. Patched under a month ago, so exposure windows are short; KEV listing also means a federal remediation deadline.

  6. Homeland security cybercops say patch TrueConf (Russia's Zoom) if you're using it (opens in a new tab)

    The Register Security ·fetched 23 Aug 2026, 15:38 UTC CVE-2026-72529 EPSS 1.0% agreed2/2

    Why readCVE-2026-72529 and CVE-2026-72530 in TrueConf are now in CISA KEV with a federal patch deadline, after compromised servers were seen serving malware to meeting participants.

    CISA added two exploited TrueConf flaws, CVE-2026-72529 and CVE-2026-72530, to the KEV catalog, obliging federal agencies to patch. The only publicly documented exploitation comes from Kaspersky, which attributed it to Head Mare, a pro-Ukrainian hacktivist group whose latest campaign hit Russian transport, energy, electronics, IT and software firms; compromised TrueConf servers delivered malware to meeting participants. CISA has not said whether the KEV addition rests on those attacks or on separate evidence of exploitation against US organisations, which is the open question for anyone running the Moscow-built conferencing platform. EPSS is still low at 0.0097, but KEV membership settles the question of whether it is being used.

  7. Vulnerability in SPIP (opens in a new tab)

    translated Vulnérabilité dans SPIP (21 août 2026)

    CERT-FR (ANSSI) ·fetched 23 Aug 2026, 07:38 UTC agreed2/2

    Why readA remote code execution flaw in SPIP that the vendor states is being actively exploited.

    SPIP has a vulnerability permitting remote arbitrary code execution, and the publisher says it is under active exploitation. SPIP is an internet-facing CMS widely used across French public sector and association sites, which makes an exploited RCE an immediate patch item rather than a scheduled one. The advisory is short on version detail, so pull the upstream SPIP release notes to scope it.

  8. CVE-2026-50112 (CVSS 8.8): SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC CVE-2026-50112 CVSS 8.8 EPSS 0.3% agreed2/2

    Why readA default-role CloudStack tenant can reach root on the KVM host running other tenants' VMs by registering a template whose .metalink inner URLs are never revalidated against the scheme allowlist.

    Two issues in Apache CloudStack: a tenant can register a template pointing at an attacker-controlled metalink referencing internal targets, which the Secondary Storage VM fetches and persists as a downloadable template file (SSRF with exfiltration), and with directDownload=true the management server hands metalink XML to the KVM agent without revalidating inner URLs, yielding arbitrary shell commands as root on the hypervisor. That is cross-tenant compromise of the underlying compute, reachable through the public CloudStack API with the default User role. Affects 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0; upgrade to 4.20.3.1 or 4.22.1.1.

  9. CVE-2026-77651 (CVSS 9.8): The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue depend (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 19:36 UTC CVE-2026-77651 CVSS 9.8 EPSS 0.4% agreed2/2

    Why readarrayref is a small utility crate that sits deep in a very large share of Rust dependency trees, so version 0.3.10 carrying a build-time backdoor is a broad blast radius rather than a niche one.

    arrayref 0.3.10 shipped with a rogue dependency that calls out to a command-and-control server during compilation and offers the operator arbitrary code execution on the build host. Most projects that are exposed never chose arrayref directly; it arrives transitively, which is why the affected population is much wider than the download counts of the crate's direct dependents suggest. The practical response is to audit Cargo.lock across all repositories and CI images for the affected version, rebuild from clean state, and rotate any credentials that were reachable from a build agent since the crate was published.

  10. CVE-2026-19586 (CVSS 9.3): A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insuff (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 15:38 UTC CVE-2026-19586 CVSS 9.3 EPSS 5.0% agreed2/2

    Why readPre-authentication OS command injection in TP-Link Omada gateways running the built-in OpenVPN Server, reachable by anyone who can open a VPN connection.

    CVE-2026-19586 (CVSS 4.0 9.3, AV:N/PR:N/UI:N) stems from insufficient validation of client-supplied data during OpenVPN connection establishment, letting crafted input reach backend command execution before authentication completes. Exploitation needs only the OpenVPN Server feature enabled and the VPN service reachable, and yields arbitrary command execution and likely full device compromise. EPSS is still low at 0.05 but sits in the 92nd percentile; treat internet-exposed Omada gateway VPN endpoints as the priority.

  11. CVE-2026-55769 (CVSS 9.4): CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened s (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 19:36 UTC CVE-2026-55769 CVSS 9.4 EPSS 0.5% agreed2/2

    Why readCloudNativePG opened superuser connections without pinning search_path, letting a database owner reach postgres superuser, COPY FROM PROGRAM and the pod ServiceAccount token.

    Before 1.28.4 and 1.29.2, fillDefaultParameters in pkg/management/postgres/pool/profiles.go opened superuser connections without pinning search_path, so a role holding DATABASE OWNER could create overloaded built-in operators in the public schema and have instance-manager introspection queries such as SELECT COUNT(*) > 0 FROM pg_catalog.pg_extension execute attacker-controlled functions as postgres. The same trust assumption affected direct sql.Open("pgx", ...) callsites and the public.user_search SECURITY DEFINER function, chaining to OS command execution via COPY ... FROM PROGRAM and theft of the pod ServiceAccount token. Fixed in 1.28.4, 1.29.2 and 1.30.0; anyone running multi-tenant Postgres on Kubernetes should assume database owners were a container-escape path.

    Indicators3
    Hashes
    02b5c6289b7609dc87fcb1ae9c113160e3d43308 db38f4d80315c8f1b21bf511ef0f28871820c14d e0e2d53adbd907a61f583b1431904b5969f3fd22
  12. CVE-2026-55765 (CVSS 8.5): CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 19:36 UTC CVE-2026-55765 CVSS 8.5 EPSS 0.3% agreed2/2

    Why readCloudNativePG wrote managed role passwords in cleartext into ALTER ROLE statements, so any tenant with pg_monitor could read them out of pg_stat_statements and reach OS command execution in the database pod.

    Versions before 1.28.4 and 1.29.2 embedded cleartext role passwords in CREATE ROLE and ALTER ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. With pg_stat_statements preloaded and track_utility on, a tenant holding pg_monitor or pg_read_all_stats could recover the superuser or application-owner password, reconnect over superuser TCP access, and run COPY ... FROM PROGRAM inside the pod. Clusters whose managed-role Secrets use SCRAM-SHA-256 verifiers are unaffected; fixes are in 1.28.4, 1.29.2 and 1.30.0.

    Indicators3
    Hashes
    2f0342747e1f160425b9d51753c0069b0d6117d5 3cd5af5d388c26758acf13c19ea806b4bcebb3fe 9a13573dbe3d78721b7ea92141e6d2324a2c0ef0
  1. How an Emerging Industrial Protocol Family Could Put OT at Risk (opens in a new tab)

    Dark Reading ·Ericka Chickowski ·fetched 23 Aug 2026, 11:36 UTC agreed2/2

    Why readFlags research on attacking unprotected Time-Sensitive Networking protocols to disrupt or manipulate physical processes in OT environments.

    Reports new research into the TSN protocol family, an emerging set of deterministic Ethernet standards being adopted in industrial networks, and how the unauthenticated variants let an attacker interfere with timing and control traffic. The feed text is a single line, so the technique detail sits in the underlying research rather than here. Worth chasing to the source if you run or defend a TSN-capable plant network.

  1. openai/fence: A fence keeps things out, but also in. This project is still in early, and active development. (opens in a new tab)

    GitHub: new security tools ·openai ·fetched 23 Aug 2026, 03:38 UTC Must read Research ★ 143 agreed2/2

    Why readOpenAI's Rust-based GitHub Actions egress firewall: allowlist outbound network, disable Docker and sudo on hosted runners, with an audit mode to build the allowlist first.

    Fence is a GitHub Action that locks down hosted ubuntu-24.04 and ubuntu-latest x64 runners: outbound connections are blocked unless allowlisted (bare hostnames default to TCP 443, with IPv6, custom ports, UDP, CIDR ranges and one- or two-level wildcards, up to 64 entries), and Docker is disabled by default behind an explicit unsafe_preserve opt-in. Audit mode reports what would have been blocked while leaving network, sudo and Docker intact, and emits a job summary you turn into your allowlist. Directly addresses the credential-exfiltration step in recent npm and Actions worms; early and actively developed, pinned by full commit SHA.

  2. Welcoming the Sri Lankan Government to Have I Been Pwned (opens in a new tab)

    Troy Hunt ·Troy Hunt ·fetched 23 Aug 2026, 19:36 UTC agreed2/2

    Why readSri Lanka CERT is the 48th national government onboarded to Have I Been Pwned's free domain monitoring service.

    Troy Hunt reports that Sri Lanka CERT now has access to HIBP's free government service, letting it monitor Sri Lankan government domains against breach data and respond when accounts surface in new corpora. It is a short administrative announcement rather than research, useful mainly as a pointer that the free national-CERT tier exists and is still expanding. No technical detail or change for existing users.

  3. Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain (opens in a new tab)

    Unit 42 ·Yaron Avital ·fetched 23 Aug 2026, 07:38 UTC agreed2/2

    Why readUnit 42 maps supply-chain attack surface across the whole build pipeline rather than the shipped artefact, anchored on XZ Utils (CVE-2024-3094), the Axios account hijack and the Shai-Hulud npm worm.

    The argument is that attackers have shifted from finding bugs in finished software to poisoning CI/CD pipelines and developer environments, using long-run contributor infiltration, maintainer account takeover and install-time setup scripts that harvest credentials. The named cases give it concrete anchors, but the piece synthesises incidents already documented elsewhere rather than presenting new findings. Useful as a framing document for a pipeline-hardening review; less useful if you already track these incidents.

DFIR

2
  1. CVE-2026-41451 (CVSS 8.5): UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_arti (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC Must read CVE-2026-41451 CVSS 8.5 EPSS 0.7% agreed2/2

    Why readRunning UAC before 3.3.0 lets a hostile /etc/passwd entry on the box you are triaging execute commands in your own collection context, usually as root.

    parse_artifact.sh substituted usernames and home directory paths read from /etc/passwd straight into command strings and passed them to eval with no escaping, so semicolons or command substitution syntax in those fields run as shell code. An intruder who can edit /etc/passwd on a system they already own can therefore plant a trap for whoever collects it, and the same exposure applies if the collector is pointed at a mounted image on an analyst workstation. Move to 3.3.0, and treat this as a reminder that response tooling parsing attacker-controlled files is itself an attack surface.

    Indicators1
    Hashes
    2cc367d8ead388f05abd3cfb8af537788a124e72
  2. CVE-2026-41450 (CVSS 8.5): UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC CVE-2026-41450 CVSS 8.5 EPSS 0.7% agreed2/2

    Why readThe second injection path fixed in the same UAC release, this one reachable through any filename the intruder controls rather than through /etc/passwd.

    In _command_collector, output lines from foreach commands were spliced into command strings with sed and then evaluated, so a crafted filename or artifact definition containing shell metacharacters executes on the host running the collection. It is the same root cause as the companion issue, eval over unescaped attacker-influenced strings, but with a far easier trigger since creating a file is cheaper than editing /etc/passwd. Both are resolved in 3.3.0, so one upgrade closes them together.

    Indicators1
    Hashes
    2cc367d8ead388f05abd3cfb8af537788a124e72
  1. KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation (opens in a new tab)

    arXiv cs.CR (AI) ·Bowen Sun, Yixi Cai, Xiaogeng Liu, Zhengyue Zhao ·fetched 23 Aug 2026, 15:38 UTC Must read Research agreed2/2

    Why readMeasures prompt cache isolation failures in LLM API relays: all five open-source gateways tested leaked cross-customer cache reads under a shared upstream credential, against both OpenAI and Anthropic.

    KeyPooling traces which component actually determines cache identity through a relay path, testing credential, pool, adapter and nested-hop transformations one at a time against cache lookup and write behaviour. None of five open-source gateways bound customers to upstream credentials by default, so any relay customer sharing a provider key could observe another's cache state on either provider. A weekly OpenRouter measurement frame covered 80.5% of eligible token volume and found cross-account effects, which turns a theoretical side channel into a deployed one for anyone fronting an LLM API with a gateway.

  2. Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services (opens in a new tab)

    arXiv cs.CR (AI) ·Bowen Sun, Zhengyue Zhao, Xiaogeng Liu, Yinzhi Cao ·fetched 23 Aug 2026, 19:36 UTC Must read Research agreed2/2

    Why readProves that stateful request monitoring cannot stop decomposition attacks once attackers use unlinkable identities and can retry against Allow/Block feedback.

    The paper formalises decomposition attacks, where a harmful task is split into individually permissible requests, and shows the security/utility tradeoff of any stateful monitor depends entirely on whether benign requests for the same capability form persistent, recognisable groups. With fresh indistinguishable identities there is no grouping signal, and once the attacker can retry and learn from Allow/Block responses the useful operating point disappears entirely, because the feedback reveals what passes but not whether a block was correct. Experiments back the result, and the practical consequence is that conversation-level or account-level accumulation defences are not a fix for anyone who can rotate identities.

  3. Incident-Data Robustness Analysis of the OWASP Top 10 for LLM Applications (2026): How a Community-Expert Ranking Holds Up Against a Large-Scale LLM Incident Corpus (opens in a new tab)

    arXiv cs.CR (AI) ·Kyriakos "Rock" Lambros, Steve Wilson ·fetched 23 Aug 2026, 11:36 UTC Must read Research agreed2/2

    Why readTests the OWASP Top 10 for LLM Applications against 6,639 labeled real incidents and finds the expert ranking barely agrees with the data (Cohen's kappa around 0.20).

    The authors built a corpus of 7,714 snapshotted LLM security incidents from CVE, GHSA, OSV and AIAAIC, labeled 6,639 against the 20-entry taxonomy, and derived an incident-based ranking using a Bayesian measurement-error model correcting for classifier precision and recall. Agreement with the community-expert ranking is weak, kappa around 0.20 with a 90% interval crossing zero, yet the expert ordering holds up on a ground-truth check (Spearman rho 0.918). The 2026 candidate list weights expert vote 0.75 against data 0.25, and a pre-registered bake-off of four frontier classifiers produced no winner beating the incidence floor's balanced accuracy of 0.863.

  4. CVE-2026-71428 (CVSS 9.3): The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, an (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 11:36 UTC CVE-2026-71428 CVSS 9.3 EPSS 0.2% agreed2/2

    Why readDocument ingestion in most RAG stacks runs through unstructured, and until 0.24.0 a caller-supplied URL turned that pipeline into a server-side request forgery gateway with the response handed back as document text.

    In unstructured 0.4.7 through 0.23.x, the url argument to partition, partition_html and partition_md is fetched with no host validation across auto.py, html/partition.py and md.py. An attacker who controls that URL can reach loopback services, internal HTTP endpoints or cloud metadata, directly or via redirects and DNS rebinding, and the response body comes back as Element text, which makes it a disclosure primitive rather than just a blind fetch. Side-effecting GET endpoints can also be triggered; the fix is 0.24.0, and the affected range is wide enough that most pinned deployments predate it.

    Indicators1
    Hashes
    445c95735c4045057f51f399bc04c657751923bd
  5. CVE-2026-77776 (CVSS 9.3): Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/pr (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC Must read CVE-2026-77776 CVSS 9.3 EPSS 0.3% agreed2/2

    Why readHeadroom's LLM proxy takes the memory owner straight from the x-headroom-user-id header, so any client can read or write another user's stored LLM memory, and the shipped docker-compose exposes those routes on 0.0.0.0 with no token.

    The header is consumed directly in headroom/proxy/handlers/openai.py on both the chat completion and websocket paths with nothing binding it to the caller, making cross-tenant memory access a matter of setting a string. The fix adds resolve_memory_identity in headroom/proxy/identity.py, honouring the header only for loopback or allowlisted callers and otherwise binding identity to the proxy-token fingerprint or the OS user. The pip console script binds 127.0.0.1, but the reference docker-compose.yml uses --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, so anyone who deployed as documented is exposed on the network.

  6. Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets (opens in a new tab)

    arXiv cs.CR (AI) ·Zhida He, Xiaoyu Wen, Han Qi, Ziyuan Zhou ·fetched 23 Aug 2026, 23:38 UTC Research agreed2/2

    Why readRe-runs 11 black-box jailbreak attacks under equal target-call budgets and finds the published rankings do not hold.

    Fair-ASR proposes target calls, rather than FLOPs, as the comparison axis for black-box jailbreak evaluation, since FLOPs cannot be estimated for hosted models. Re-evaluating 11 representative attacks shows rankings shift substantially as the budget B changes, and that simple stochastic perturbations and hand-crafted templates stay competitive with LLM-driven attackers at equal target access; none of the LLM-driven methods is efficient in both target and attacker calls. Useful correction if you benchmark model safety or read vendor ASR claims.

  7. OWASP Flags Top AI Skill Risks in New Security Blueprint (opens in a new tab)

    Dark Reading ·Robert Lemos ·fetched 23 Aug 2026, 03:38 UTC agreed2/2

    Why readOWASP has published a new Top 10 for AI skills and a Universal Skill Format meant to standardise how model add-ons declare themselves.

    The list targets risks in AI "skills", the add-on packages agents load to extend capability, and ships alongside a Universal Skill Format intended to bring consistency and security controls to how those extensions are defined. OWASP lists tend to drive appsec tooling and vendor checklists, so the taxonomy matters for anyone building agent platforms. Dark Reading's write-up is short and the individual risk categories are not enumerated in the text here.

  8. CVE-2026-39909 (CVSS 9.2): llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows unauthenticated remote attacker (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC CVE-2026-39909 CVSS 9.2 EPSS 0.8% agreed2/2

    Why readUnauthenticated remote code execution in the llama.cpp RPC server, a surface upstream already documents as unsafe to expose and which people expose anyway.

    A use-after-free in the GRAPH_RECOMPUTE handler lets an attacker store a computation graph, free the buffers it references, then reclaim that memory with controlled content so re-execution follows dangling pointers into arbitrary read and write. No authentication or user interaction is needed, though the CVSS 4.0 vector rates attack complexity high, which suggests heap grooming is required rather than a one-shot request. Fixed in build b8585; if you run rpc-server for distributed inference, upgrade and confirm it is not reachable beyond a trusted network segment.

    Indicators1
    Hashes
    389c7d4955ba55c7418afaebf7c23d9ed64ef707
  9. CVE-2026-54449 (CVSS 8.8): LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server con (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 11:36 UTC CVE-2026-54449 CVSS 8.8 EPSS 0.4% agreed2/2

    Why readAny registered LangBot user can point the Extensions MCP config at an arbitrary STDIO command and get RCE on the bot host, with no fixed version yet.

    In LangBot 4.10.7 and earlier, src/langbot/pkg/provider/tools/loaders/mcp.py passes user-supplied command and args straight into StdioServerParameters, spawning a subprocess as the LangBot service user. Anyone who can sign up reaches the Extensions MCP configuration, so this is a low-privilege path to full command execution on the server. No patched release exists as of the advisory, which makes network isolation and disabling self-registration the only mitigations.

  10. CVE-2026-62674 (CVSS 9.0): Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent check (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC CVE-2026-62674 CVSS 9.0 EPSS 0.3% agreed2/2

    Why readOmnigent before 0.3.0 lets a user with session edit rights swap a shared agent bundle and register a stdio MCP server, so later sessions launch attacker-controlled commands as the runner process.

    PUT /sessions/{session_id}/agent checks LEVEL_EDIT on the session but never rejects a bound shared or template agent whose agent.session_id is None, so the shared bundle can be replaced through omnigent/server/routes/sessions.py. Adding a stdio MCP server causes omnigent/tools/mcp.py to spawn the attacker's command in every subsequent session using that agent, with access to files, credentials, workspace data and internal services. Fixed in 0.3.0; it is a clean example of shared agent templates acting as a persistence and lateral-movement channel in agent harnesses.

    Indicators1
    Hashes
    25a22dc9e6da4648d23749f0a589e47e6aed991b
  11. Redakto - The Incognito Tab for LLMs (opens in a new tab)

    arXiv cs.CR (AI) ·Saurav Kumar Saha, Tom Röhr, Felix Bießmann ·fetched 23 Aug 2026, 07:38 UTC Research agreed2/2

    Why readAn open-source PII redaction and pseudonymisation service you can put in front of an LLM, exposed over REST and MCP.

    Redakto redacts or pseudonymises personally identifiable information in text before it reaches an LLM, with a web app for end users plus REST APIs and Model Context Protocol hooks for integration. The implementation is open source and the authors claim it runs on modest compute, which makes it deployable as a local sanitising proxy rather than another hosted dependency. Framed around EU privacy obligations; the paper gives no adversarial evaluation of how well redaction survives motivated re-identification.

  12. CVE-2026-62675 (CVSS 8.8): Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an (opens in a new tab)

    NVD ·fetched 23 Aug 2026, 23:38 UTC CVE-2026-62675 CVSS 8.8 EPSS 0.4% agreed2/2

    Why readAn agent bundle uploaded by any authenticated Omnigent user can name subprocess.check_output as a tool callable and get command execution as the runner process, fixed in 0.3.0.

    In Omnigent before 0.3.0, validate_agent_bundle in omnigent/server/bundles.py does not reject a dotted Python path in tools..callable submitted via multipart POST /v1/sessions. _resolve_spec_callable imports the named module and _execute_spec_callable_tool invokes it, so a bundle can select subprocess.check_output and run local commands with the runner's permissions, exposing runner files, environment variables, credentials, workspace data and internal services with no administrator access. A concrete example of why tool-dispatch layers in agent harnesses need an allowlist rather than a shape check.

    Indicators1
    Hashes
    1f3f398f41cbf97b905133c21e848621c21da6e0
  1. Nearly half of enterprises have no one leading PQC migration (opens in a new tab)

    Help Net Security ·Anamarija Pogorelec ·fetched 23 Aug 2026, 07:38 UTC agreed2/2

    Why readA vendor survey claiming roughly half of enterprises have no named owner for post-quantum migration; the one hard number is 75% claiming a live crypto inventory.

    Axiad survey research reports that ownership of post-quantum cryptography migration is unassigned in nearly half of enterprises, while about 75% of respondents claim a continuously updated inventory of certificates, keys and algorithms. Sample size and methodology are not given in the text, and the gap between claimed inventory and actual crypto discovery is asserted rather than measured. The self-reported ownership gap is a talking point for a programme lead, not a finding.

  1. UK power plant forced offline after Iran-backed cyberattack (opens in a new tab)

    Google News: incidents · Arab News ·fetched 23 Aug 2026, 19:36 UTC agreed2/2

    Why readA UK power generation site taken offline by an attack attributed to Iran, which is the question energy-sector boards and regulators will open with.

    Arab News reports that a UK power plant was forced offline following a cyberattack attributed to Iran-backed actors. The item reached us as a headline with no accompanying detail, so the plant, the operator, the timeline and the basis for attribution are all unstated here. Treat it as a signal to watch for confirmation from the operator, NCSC or Ofgem rather than as a settled account, but note that disruptive OT impact at a UK generator would reset the conversation about state-actor risk to critical national infrastructure.

    Also covered byThe Jerusalem Post (opens in a new tab),Firstpost (opens in a new tab),Central Oregon Daily (opens in a new tab),ABC News - Breaking News, Latest News and Videos (opens in a new tab),Ynetnews (opens in a new tab).

  2. Apollo Gets Hacked: Private Equity Giant Confirms Major Data Breach (opens in a new tab)

    Google News: incidents · Sahm ·fetched 23 Aug 2026, 03:38 UTC Must read agreed2/2

    Why readApollo Global Management has confirmed a data breach, putting a major private equity firm and its portfolio and LP data in scope.

    The confirmation is the fact: Apollo, one of the largest private equity managers, acknowledges a significant data compromise. For financial services leaders the exposure question is not just Apollo's own records but the deal, portfolio company, and limited partner data such a firm aggregates. This is an aggregator stub with no scope, dates, or actor named, so treat the details as pending better reporting.

  3. Hook, hold, harvest and hide: Meta's alleged strategy laid out in first week (opens in a new tab)

    Hacker News ·sbulaev ·fetched 23 Aug 2026, 11:36 UTC 213 points agreed2/2

    Why readCalifornia and 28 other states have opened trial against Meta over addictive design and data harvesting, the kind of privacy-adjacent litigation a board will ask about.

    Opening arguments in Oakland framed Meta's model as "hook, hold, harvest, hide", with California lawyer Megan O'Neill arguing the company retains users, harvests their data and conceals internal knowledge of harm, particularly to children. Twenty-nine states have joined the suit against the company. There is nothing technical to action here, but the discovery record and any verdict will shape how consumer-facing firms defend data collection and retention practice.

Unverified claims posted by extortion groups on their own leak sites, not confirmed breaches. Listing is the group's assertion; many named organisations have not disclosed an incident, and some entries are false or recycled. Leak sites are never linked from here.

Claimed victimGroup SectorCountry Seen
Hospitality Health ER (Longview) genesis Healthcare US 23 Aug 2026
Westwing Group SE coinbasecartel Retail & E-Commerce DE 23 Aug 2026
CyrusOne, LLC. shinyhunters Technology US 23 Aug 2026
S.E.M.P. s.r.l. qilin Manufacturing IT 23 Aug 2026
adt.com lockbit5 Professional Services US 23 Aug 2026 press coverage (opens in a new tab)
Global Go killsec Transportation PE 23 Aug 2026
Euroflora srl qilin Agriculture and Food Production IT 23 Aug 2026
Tecnici Associati STP qilin - IT 23 Aug 2026
Studio BOLDRIN PAOLO qilin Professional Services IT 23 Aug 2026
Aurore Development S.p.A. qilin - IT 23 Aug 2026
compendiumusa.net L Group Professional Services US 23 Aug 2026
Clear Align qilin Professional Services US 23 Aug 2026
Difor qilin Technology CL 23 Aug 2026
Black Cat Engineering & Construction WLL qilin Manufacturing QA 23 Aug 2026
FRUCASTRO SL emperador Agriculture and Food Production ES 23 Aug 2026
PappyJoe: Healthcare Management System kazu Healthcare US 23 Aug 2026
Instituto Ferrero de Neurología y Sueño kazu Healthcare AR 23 Aug 2026
Brazil Mobilemed: Cloud PACS Platform kazu Healthcare BR 23 Aug 2026
Canada Yocale: Appointment Management System kazu Professional Services CA 23 Aug 2026
PawlyClinic: Digital Veterinary Care Platform kazu Healthcare US 23 Aug 2026
Dr Akbar Niazi Teaching Hospital kazu Healthcare PK 23 Aug 2026
Centro Médico Especializado OSI: Healthcare Solutions kazu Healthcare MX 23 Aug 2026
Meducar: Telemedicine and Patient Management System kazu Healthcare BR 23 Aug 2026
ConsultorioMovil: Telemedicine and Healthcare System kazu Healthcare MX 23 Aug 2026
Woodlore International Inc. metaencryptor - CA 23 Aug 2026
How this edition was made
Candidates fetched
5488
New after deduplication
720
Kept by the panel
175
Published
105
Generated
23 Aug 2026, 23:38 UTC