Morning Brief

Patch today vendors with the most new CVEs today

• Splunk 4 critical 110
• IBM 21 critical 107
• Wireshark Foundation 25
• Dell 23
• Unknown 19
• Microsoft 1 critical 17
• WordPress 1 critical 16
• getgrav 16
• Cisco 8 critical 15
• thorsten 13

Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.

Top developments ranked by cross-source trending

1. 

   Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

   Threat Intel Palo Alto Unit 4218 Aug9 sources

   In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks.

   Read more

   Also in SANS Internet Storm Center Bleeping Computer Bleeping Computer +3

2. NSA, FBI warns of hackers using AI-generated tools in attacks on critical infrastructure technology

   News The Record18h ago7 sources

   The National Security Agency (NSA), FBI and other federal agencies said the campaign is targeting Siemens S7 Series PLCs and was being fueled by “AI-assisted development” alongside exploitation of known vulnerabilities.

   Read more

   Also in Infosecurity Magazine SecurityWeek CyberScoop +3

   

3. ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

   News The Hacker News1h ago5 sources

   Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features a PIN harvesting workflow targeting more than 140 banking and cryptocurrency applications.

   Read more

   Also in Bleeping Computer Infosecurity Magazine Malwarebytes Labs +1

   

4. CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

   Research Rapid7 Blog19h ago4 sources

   Overview On August 19, 2026, a security advisory was published for CVE-2026-19490 , a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The vulnerability carries a CVSS v4.0 base score of 9.3 and can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges. NetScaler ADC and NetScaler Gateway are widely deployed enterprise networking products commonly positioned at or near the network perimeter. NetScaler ADC provides application delivery, traffic management, load balancing, SSL/TLS…

   Read more

   Also in Bleeping Computer SecurityWeek CCCS Alerts & Advisories +1

   CVE-2026-19490 ↗

   

5. Hackers Hide Malware Code Inside English Words to Infect Windows Users

   News Cyber Security News47m ago4 sources

   A new Windows malware campaign is hiding malicious code inside ordinary English words, making the payload look less suspicious during analysis. The technique is being used to deliver Amatera Stealer, an information-stealing threat that targets sensitive data stored on infected systems. The campaign relies on ClearFake, a long-running operation that compromises legitimate websites and places fake CAPTCHA checks over real pages. Visitors are told to complete a verification step, but the prompt actually guides them into running a malicious command through the Windows Run dialog. Analysts at…

   Read more

   Also in Malwarebytes Labs Microsoft Security Microsoft Security +2

   CVE-2026-42912 ↗CVE-2026-49798 ↗CVE-2026-50383 ↗

   

6. UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

   Threat Intel Cisco Talos2h ago3 sources

   UAT-10147 is a highly capable Chinese-speaking intrusion actor operating a multi-platform post-exploitation ecosystem targeting IIS and Linux servers, combining search engine optimization (SEO) fraud monetization with advanced persistence and defense evasion techniques. The newly identified SPECTRE implant represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credential theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality. The actor…

   Read more

   Also in Cisco Talos Infosecurity Magazine Dark Reading

   

7. Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

   News The Hacker News6h ago3 sources

   Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type. "The flaw lives in the Forms module's File

   Read more

   Also in The Hacker News Check Point Research The Hacker News +1

   

8. Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

   News The Hacker News17 Aug3 sources

   Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the

   Read more

   Also in Graham Cluley Malwarebytes Labs

   

9. Meta Ran Ads for an App That Promised to Nudify Female Politicians

   Media Wired Security18 Aug4 sources

   One advertisement featured a pornographic video with a deepfake closely resembling a prominent US politician. Apple removed the app from the App Store after an inquiry from WIRED.

   Read more

   Also in CCCS Alerts & Advisories Malwarebytes Labs SANS Internet Storm Center +1

   

10. Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

    News The Hacker News18 Aug3 sources

    A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous," GuidePoint Research

    Read more

    Also in Bleeping Computer CISA Alerts & Advisories

    CVE-2026-33824 ↗

    

Vulnerability watch what to look at, most urgent first

Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed

Worth reading quieter, still worth your time

1. Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs

   Research Tenable Blog19 Aug2 sources

   Oracle addresses 925 CVEs in its August 2026 Critical Security Patch Update with 943 patches, including 154 critical updates. Key Takeaways The August 2026 Critical Security Patch Update (CSPU) contains fixes for 925 unique CVEs in 943 security updates 154 issues (16.3% of all patches) were assigned a critical severity rating Oracle Fusion Middleware received the highest number of patches at 262, accounting for 27.8% of all patches Background On August 18, Oracle released its Critical Security Patch Update (CSPU) for August 2026 . Beginning in May 2026, Oracle introduced CSPUs as a monthly…

   Read more

   Also in CCCS Alerts & Advisories