Daily Cybersecurity Briefing — August 20, 2026

Paul Baity

Aug 20

4 min read

ACTIVELY EXPLOITED VULNERABILITIES

CVE-2026-33824 | Microsoft IKE Service Extensions | Double Free | CVSS 9.8 — CISA KEV added Aug 18. Allows remote code execution over the network. FCEB patch deadline: August 21, 2026.
CVE-2026-55040 | Microsoft SharePoint | Weak Authentication | CVSS 9.1 — CISA KEV added Aug 18. Chains four weak authentication checks to forge valid tokens. FCEB patch deadline: August 21, 2026.
CVE-2026-59310 | Broadcom VMware vCenter | Path Traversal | CVSS 9.8 — CISA KEV added Aug 18. Exploits path traversal flaw in the vCenter Syslog server. FCEB patch deadline: August 21, 2026.
CVE-2026-65400 | Apple macOS | Improper Authentication | CVSS 9.8 — CISA KEV added Aug 18. FCEB patch deadline: August 21, 2026.
Microsoft August 2026 Patch Tuesday — 400 flaws addressed including 3 zero-days (1 actively exploited). The exploited zero-day (EoP) was weaponized by North Korean state-sponsored actors to install kernel rootkits on Windows systems.
CVE-2026-18577 | N-able N-central | Authentication Bypass / Account Takeover | CVSS 8.2 — CISA KEV. Allows unauthenticated remote attackers to gain administrative access and pivot into managed endpoints via the built-in Take Control feature.

BREACHES

Questal — ShinyHunters ransomware group claimed theft of 21 million Salesforce records and 147 GB of internal corporate data including PII.
Pokémon Center (UK & Germany) — Third-party breach via logistics provider CEVA Logistics exposed customer data. Pokémon Center notified affected customers.
ProHealth Medical Group (Singapore) — Krybit ransomware group claimed theft of 114 GB of sensitive healthcare data.
CameraSwarm Campaign — Threat actors compromised 14,500+ Dahua IP cameras, primarily in Ukraine and Russia, establishing a covert surveillance and botnet infrastructure.

THREATS & POLICY

White House issued National Security Presidential Memorandum (Aug 12, 2026) authorizing a federally supervised program allowing vetted private-sector cybersecurity firms to conduct offensive cyber operations against Cyber-Enabled Transnational Criminal Organizations (CE-TCOs) under DOJ/DHS oversight — a significant shift from 'defend and recover' to 'deter and disrupt.'
#StopRansomware Advisory — CISA, FBI, NSA, DOD Cyber Crime Center, USSS, and South Korea's National Police Agency issued joint advisory on Gunra Ransomware, a Conti-derived RaaS actively targeting critical infrastructure. Initial access via FortiOS/FortiProxy VPN vulnerabilities; uses double-extortion model.
AI-Assisted PLC Attacks — U.S. cybersecurity agencies warned that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure sectors.
Iranian Hackers Charged — U.S. DOJ charged 17 Iranian nationals for orchestrating a 31-terabyte academic data theft targeting universities.
North Korean APT — State-sponsored actors exploited the August 2026 Patch Tuesday zero-day to deploy kernel rootkits on Windows systems before the patch was released.

CLOUD & SAAS SECURITY

SAML Authentication Flaws — Researchers disclosed SAML security vulnerabilities enabling full account takeover in affected identity providers, bypassing SSO protections. Administrators should review SAML configurations and enforce strict assertion validation.
WordPress Botnet (StopAndProtect) — Threat actors converted 2,000 compromised WordPress sites into coordinated criminal infrastructure for malware distribution and phishing campaigns.
Google Cloud reported identity-related issues were involved in 83% of cloud and SaaS compromises — persistent misconfiguration and over-permissioning remain top risk factors.

IDENTITY & AUTHENTICATION

SAML Bypass — Newly disclosed SAML authentication bypass vulnerabilities allow attackers to forge valid sessions without valid credentials in affected configurations. Organizations using SAML-based SSO should audit their implementations immediately.
SNI5GECT Attack — A newly documented technique forces mobile devices to downgrade from 5G to 4G, enabling interception, device tracking, and man-in-the-middle attacks — implications for enterprise mobile device management.
Identity threat data confirms that the majority of modern cyberattacks originate with stolen or forged identity. MFA fatigue and session token theft remain top attack vectors.

MOBILE SECURITY

Apple Spyware Alerts — Apple expanded its Threat Notification program, now actively alerting iPhone users when they are targeted by mercenary spyware campaigns.
Android Security Bulletin (August 2026) — Released with patches for multiple high- and critical-severity vulnerabilities across Android devices.
SNI5GECT — Newly disclosed technique enables attackers to force 5G-to-4G downgrade on victim devices, enabling interception, location tracking, and MitM attacks.

RESEARCH & TOOLS

AI Malware Near-Miss — An AI coding agent recommended an engineer install a package containing embedded malware; the engineer nearly complied. The incident highlights critical risks of AI-assisted development without supply chain / package integrity verification.
RubyGems Typosquatting Campaign — Researchers discovered an active typosquatting campaign delivering a Windows-based information stealer to RubyGems users via misspelled package names (detected August 15, 2026).
Sysdig named a Leader in the Forrester Wave for Cloud-Native Application Protection Platforms (CNAPP), Q1 2026. Its Sysdig Sage agentic AI analyst is delivering a 76% reduction in mean time to respond (MTTR) for customers.

Sources

CISA KEV Update – Four Vulnerabilities Added August 18, 2026: https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog

CISA KEV – SharePoint and vCenter Additions: https://securityonline.info/cisa-kev-four-exploited-vulnerabilities-2/

N-able N-central KEV (The Hacker News): https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html

Microsoft August 2026 Patch Tuesday (BleepingComputer): https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/

Microsoft Patch Tuesday – SecurityWeek: https://www.securityweek.com/august-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day/

Gunra Ransomware #StopRansomware Advisory (CISA): https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a

Gunra Ransomware Coverage (GBHackers): https://gbhackers.com/gunra-ransomware-attack/

White House NSPM on Transnational Cyber-Enabled Crime: https://www.whitehouse.gov/presidential-actions/2026/08/expanding-capabilities-to-combat-transnational-cyber-enabled-crime/

August 2026 Data Breaches Tracker (SharkStriker): https://sharkstriker.com/blog/august-2026-data-breaches/

Apple Spyware Alerts (Malwarebytes): https://www.malwarebytes.com/blog/news/2026/08/apple-now-uses-iphone-alerts-for-targets-of-mercenary-spyware

Android Security Bulletin – August 2026: https://source.android.com/docs/security/bulletin/2026/2026-08-01

CVE-2026-68820 KEV & BOD 26-04 Analysis (Qualys): https://blog.qualys.com/product-tech/2026/08/18/cve-2026-68820-kev-bod-26-04-requirements

2026 Global Threat Intelligence Report – HSToday: https://www.hstoday.us/subject-matter-areas/cybersecurity/2026-global-threat-intelligence-report-highlights-rise-in-agentic-ai-cybercrime/