Wednesday, August 26, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Google 327
- Adobe 3 critical 38
- NVIDIA 2 critical 28
- Microsoft 1 critical 24
- TYPO3 23
- WordPress 2 critical 19
- Unknown 1 critical 19
- Drupal 17
- lin-snow 15
- AcademySoftwareFoundation 15
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Mirage2FA Phishing Kit Bypasses MFA to Hijack Microsoft 365 Sessions, Targeting 3,500+ Organizations
Researchers tie the LinX Coders phishing-as-a-service toolkit to 9,332 compromise events across 94 countries, with 63.7% of victims in the United States and stolen session cookies accounting for more than half of all outcomes. A phishing-as-a-service (PhaaS) toolkit tracked as Mirage2FA has been linked to the potential compromise of 4,532 Microsoft 365 accounts in a campaign that targeted 3,518 organizations, according to new research published by threat intelligence analysts ShiFu and raptur3 at ANY.RUN. The kit does not drop malware. Instead, it uses browser-executed HTML, XHTML, and SVG…
Also in Bleeping Computer Bleeping Computer The Hacker News +3
-
SonicWall NetExtender Vulnerabilities Allow an Attacker to Write Arbitrary Files as Root
SonicWall has disclosed two security vulnerabilities in its NetExtender Linux client, including a critical path traversal flaw that could allow an attacker to write arbitrary files with root privileges. The issues affect NetExtender Linux Client versions 10.3.5 and earlier; the fixed release is version 10.3.6 and later. Tracked as CVE-2026-66152, the more severe vulnerability received a CVSS score of 8.8. SonicWall said the issue lies in how the Linux client handles an OPSWAT tarball. A remote attacker could exploit path traversal sequences to place files outside the intended extraction…
Also in Infosecurity Magazine SecurityWeek The Hacker News +2
-
Hackers Use Fake Claude Desktop App to Disable Defender and Install Remote Access Malware
Cybercriminals are using a counterfeit Claude desktop application to compromise Windows systems, disable key security checks, and install remote-access malware. The campaign turns a familiar AI software search into a route for credential theft and long-term access. It also shows how trusted-looking download pages can make a dangerous file appear routine. For organizations, the campaign creates risk beyond one endpoint because stolen credentials may open the door to email, cloud services, and internal systems. The attack begins with malicious search advertisements that steer victims toward…
Also in Cyber Security News The Hacker News Microsoft Security +3
-
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android
Meta on Tuesday announced a set of WhatsApp account security features, including support for multiple passkeys to a single account to help users with both iOS and Android devices sign into their accounts using the phishing-resistant method. The tech giant said more than 1 billion people use a passkey to log into WhatsApp. Support for passkeys was first introduced in Android in October 2023,
Also in Malwarebytes Labs SecurityWeek Dark Reading +1
-
WordPress Plugin Vulnerability Exposes 400,000 Sites to Account Takeover Attacks
A critical vulnerability in the TranslatePress WordPress plugin could allow unauthenticated attackers to hijack administrator accounts and fully compromise affected websites. The flaw, tracked as CVE-2026-19632, affects TranslatePress versions up to 3.3.1 and has been fixed in version 3.3.2. TranslatePress is a multilingual WordPress plugin with more than 400,000 active installations. Wordfence assigned the vulnerability a CVSS score of 9.8, classifying it as critical. Security researcher momopon1415 responsibly reported the issue through the Wordfence Bug Bounty Program and received a $975…
-
You could've applied all 1,449 Oracle patches and still been hit by this attack
In late July, Oracle released a mammoth security patch dump with 1,449 patches, in a perhaps unprecedented bad day for database admins. None of them, it turns out, would have prevented the credential theft on an Oracle database server described by security platform Huntress. “Even if it had been fully patched, everything working, it still would have happened,” said Craig Savage, cybersecurity lead at Oracle third-party support vendor Spinnaker Support, referring to the attack. In July, Huntress was alerted to credential theft activity, according to a post from the security company. The attack…
Also in The Register Security The Hacker News CCCS Alerts & Advisories +1
-
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes
Cybersecurity researchers have disclosed details of a phishing-as-a-service (PhaaS) platform built to strip Apple's Activation Lock from stolen devices, using rented AI voice agents that call theft victims posing as Apple Support and ask for their device passcode. SOCRadar Threat Research Unit (STRU) said the platform, which it tracks as AnonyMousKIT, is credit-metered and drives lures across
Also in Bleeping Computer Zero Day Initiative
-
Risky Business #850 -- Widespread AI-enabled attacks target Siemens PLCs
On this week’s show Patrick Gray and James Wilson are joined by guest co-host Ollie Whitehouse, the CTO of the UK’s NCSC, to talk through the week’s news, including: Iranian hackers take down a small-scale power generator in the UK Siemens PLCs in critical US sectors are also being targeted… We’re stumped on who could be behind that one, too. Microsoft fixed a CVSS 10 deserialisation bug in Entra before someone else found it and owned the planet Prompt injection isn’t going away LLMs are deceiving us meat sacks and it’s a worry Much, much more… This week’s show is brought to you by Okta. VP…
Also in CISA Alerts & Advisories CISA ICS Advisories
-
CISA Warns of Exploited Gitea Vulnerability
CVE-2026-60004 is a remote code execution vulnerability patched by Gitea developers in late July with the release of version 1.27.1.
Also in CISA Alerts & Advisories
-
Crooks push Mac malware through fake OpenAI Codex ads
Cybercrims are using fake OpenAI Codex download pages to trick Mac developers into running malware disguised as installation commands. Researchers at Cato Networks uncovered the campaign after spotting sponsored Google search results targeting people looking to download Codex for macOS. The ads direct would-be users to a convincing-looking download page hosted on Google Sites, complete with the familiar OpenAI branding. There is, however, no Codex waiting at the other end. Instead of serving up an installer, the fake site tells Mac users to open Terminal, paste in a supplied command, and run…
Also in CCCS Alerts & Advisories Infosecurity Magazine
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-76193 | Adobe Campaign ClassicAdobe | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAdobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitra… Attack
Exploitation
|
|||||||||
| CVE-2026-76195 | Adobe Campaign ClassicAdobe | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAdobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An att… Attack
Exploitation
|
|||||||||
| CVE-2026-76197 | Adobe Campaign ClassicAdobe | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAdobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An att… Attack
Exploitation
|
|||||||||
| CVE-2026-79911 | N600RTOTOLINK | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostn… Attack
Exploitation
|
|||||||||
| CVE-2026-65083 | OpenShellNVIDIA | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isNVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation … Attack
Exploitation
|
|||||||||
| CVE-2026-65093 | OpenShellNVIDIA | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isNVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosur… Attack
Exploitation
|
|||||||||
| CVE-2026-63586 | IE-SR-2TX-WLWeidmueller Interface | Critical | 9.8 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.8 | |
What it isThe web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string exec… Attack
Exploitation
|
|||||||||
| CVE-2026-78568 | Total DonationsWordPress | Critical | 9.8 | 0.3% | — | — | — | EPSS 0.3%CVSS 9.8 | |
What it isThe Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. T… Attack
Exploitation
|
|||||||||
| CVE-2026-78570 | Total DonationsWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator. Attack
Exploitation
|
|||||||||
| CVE-2026-49845 | Apache HiveApache | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isSQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (includ… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.