Security & Risk
140 analyses
A threat actor identified as "TheHatman" claims to have extracted corporate directories from Azure and Entra ID tenants of companies such as McDonald's (1.7 million records), TCS, and Vodafone. None of the organizations have publicly confirmed the breach.
The Ministry of Digitalization confirmed the theft of clinical data from 12,000 clinics via the MyDr platform, exposing prescriptions, schedules, and national identifiers of millions of citizens.
A paper by eight researchers decoded the internal reasoning of the APIs from OpenAI, Anthropic, and Google, extracting 182 valid credentials and 367 pieces of personally identifiable information from public developer sessions.
North Korean group used CVE-2026-68820 in AFD.sys to escalate privileges to SYSTEM in a global espionage campaign. Microsoft fixed it in August's Patch Tuesday just days after Check Point's disclosure.
CVSS 9.8 vulnerability allows remote code execution without authentication on JetBrains TeamCity servers. CISA added it to the KEV on August 5 with a three-day deadline.
Seven CVEs in IOS XE with a CVSS of 9.8 and five in Catalyst SD-WAN with a CVSS of 9.9, all discovered internally. Cisco states there is no workaround, only an update, with tight deadlines for network teams.
The U.S. agency added CVE-2026-18577 to the KEV catalog on August 3 after attackers exploited an authentication vulnerability in N-able's RMM to take over servers and pivot to managed endpoints.
Hotfix 2026.3.1.7 was released on August 2 to contain authentication bypass used in active attacks. The vulnerability provides root access to the console orchestrating client endpoints.
N-able released hotfix 2026.3.1.7 on Saturday for CVE-2026-18577, an authentication bypass already in active use by attackers. Compromised RMM provides access to every endpoint it manages.
Versions 22.23.2, 24.18.1, and 26.5.1 were released on July 29 to address memory issues in HTTP/2, use-after-free vulnerabilities, and a bypass of the permission model supporting isolated workloads.
CVE-2026-16812 allows remote command execution without authentication on the on-premises SD-WAN orchestrator. CISA mandated federal agencies to mitigate by July 30, and there is evidence of active exploitation.
CVE-2026-63077 in the agent polling protocol allows any attacker with HTTP access to execute code on the server. All On-Premises installations prior to 2025.11.7 and 2026.1.3 are vulnerable.