Friday, August 21, 2026 · generated · about 4 min read
Morning Brief
Patch today vendors with the most new CVEs today
- IBM 13 critical 75
- Microsoft 12 critical 27
- Red Hat 5 critical 16
- n8n-io 16
- Unknown 15
- ATutor 13
- Apple 11
- GIMP 10
- libevent 10
- Apache 9
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Ars Technica Security Grok exfiltrates user data when malicious instructions are encrypted
Earlier this week, researchers outlined an attack that used a secret input provided by Microsoft 365 Copilot for enterprise to cause the AI assistant to exfiltrate a password present in the user’s inbox. Now, a separate team has devised a similar attack against Grok. The new data theft hack employs a deceptively simple trick to force the Elon Musk-owned large language model to steal user chats and other personal information. At the time this post went live, the assistant continued to cough up the data, despite xAI being informed of it in June. The lesson from both this week’s episodes—and the…
Also in Bleeping Computer SecurityWeek SANS Internet Storm Center +3
-
Apple’s Private Find My People Reversed to Decrypt Live Shared Locations on Linux
A security researcher has successfully reverse-engineered Apple’s private Find My People protocol, demonstrating that a Linux machine can register with Apple’s internal services, receive an existing location-sharing key, and decrypt a friend’s live location without ever touching a Mac or iPhone. The project began innocently: the researcher wanted to build Discord geofence alerts using location data a friend was already sharing via Apple’s Find My app. What looked like a simple authenticated API call turned into roughly a week of reverse-engineering Apple’s private device-identity and…
Also in Hak5 The Register Security CCCS Alerts & Advisories +3
-
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
The U.S. government on Wednesday warned of an "active threat" targeting critical infrastructure organizations in the country using artificial intelligence (AI)-generated exploit scripts. The activity is targeting Siemens S7 SeriesProgrammable Logic Controllers (PLCs) to conduct reconnaissance and capability development using AI-generated scripts disguised as legitimate monitoring tools. That
Also in Tenable Blog Infosecurity Magazine The Register Security +3
-
The invisible passenger in your car
While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app might be reaching users’ devices without their knowledge. Further investigation confirmed that hypothesis and allowed us to reconstruct the entire infection chain. Key findings: We identified new Android malware: a multi-stage downloader whose ultimate purpose is ad fraud and creation of a proxy botnet…
Also in The Hacker News The Hacker News Bleeping Computer +2
-
Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials
Cybercriminals are abusing interest in generative AI to trick users into downloading malware. In a newly documented incident, a file posing as a Google Gemini installer delivered the Vidar information stealer, putting saved browser passwords and other sensitive data at risk. The attack did not begin with a phishing email. Instead, it relied on a normal-looking software search and download path, showing how criminals can turn routine searches for AI tools into a route for credential theft. The tactic mirrors recent campaigns that used fake AI installers and search manipulation to distribute…
Also in The Register Security The Hacker News Graham Cluley
-
41 deceptive download sites show a real link, then send you somewhere else
We identified a network of 41 websites impersonating popular games and Windows software, all designed to push visitors towards the same Download Studio installer. The sites advertise everything from Counter-Strike, Half-Life, Fallout, Roblox, PUBG, and The Witcher to VLC, 7-Zip, Paint.NET, VMware, Total Commander, and Foxit PDF. They go to surprising lengths to look convincing, using accurate product information, genuine developer resources, and even real download links. But the link you see isn’t the link you follow. One site promises Counter-Strike. Hover over its download button and the…
Also in Bleeping Computer Microsoft Security Microsoft Security +1
-
Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal security review. Four of the security vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, regardless of the device configuration. A brief description of each of the flaws is below -
Also in The Register Security CCCS Alerts & Advisories
-
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability. According to the cloud computing and virtualization technology company, the issues affect customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds, as well as SecurAccess
Also in Bleeping Computer CCCS Alerts & Advisories Rapid7 Blog
-
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type. "The flaw lives in the Forms module's File
Also in Bleeping Computer The Hacker News Check Point Research
-
Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution
Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action is required. The vulnerability, tracked as CVE-2026-69836 (CVSS score: 10.0), is a case of remote code execution impacting the tech giant's cloud-based identity and access management service. It was previously called Azure Active Directory
Also in Microsoft Security
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-65770 | Azure Managed Instance for Apache CassandraMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isImproper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-65801 | Microsoft Exchange OnlineMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isServer-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-65816 | Azure Web AppsMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isUse of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-69555 | Azure ARCMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isIncorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-69836 | Microsoft EntraMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isDeserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-73992 | Query WranglerJonathan Daggerhart | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isSubscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-74014 | IT Residenceindithemes | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
Attack
Exploitation
|
|||||||||
| CVE-2026-74016 | Smart Cleaningthemagnifico52 | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isSubscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-74018 | Warehouse Cargothemagnifico52 | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isSubscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-77022 | CF-N1-SComfast | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the component SSID Configuration. The manipulation of the ar… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.