Daily Cybersecurity Briefing — August 21, 2026

ACTIVELY EXPLOITED VULNERABILITIES

• CVE-2026-72529 (TrueConf Server Missing Authentication) & CVE-2026-72530 (TrueConf Server Code Injection): Critical-severity bugs present in all TrueConf Server versions since 2022, actively exploited by hacktivist group Head Mare to deploy PhantomCore malware, install web shells, and harvest infrastructure credentials. Exploited via port 4307/TCP. Fixed in versions 5.3.9, 5.4.9, and 5.5.5. Added to CISA KEV August 20, 2026. FCEB patch deadlines: 3 days (CVE-72529), 2 weeks (CVE-72530).

• CVE-2026-64849 (MLflow Server-Side Request Forgery): Affects MLflow versions prior to 3.15.0. Exploited in the wild within hours of CVE assignment to reach AWS cloud metadata services and exfiltrate IAM credentials and secrets. Added to CISA KEV August 19, 2026. FCEB patch deadline: 14 days. Attackers indiscriminately scanning internet-exposed MLflow instances.

• CVE-2026-33824 (Microsoft IKE), CVE-2026-55040 (Microsoft SharePoint), CVE-2026-59310 (Broadcom VMware vCenter), CVE-2026-65400 (Apple macOS): Four vulnerabilities added to CISA KEV August 18, 2026 based on evidence of active exploitation. Patch immediately.

• CVE-2026-18577 (N-able N-central Authentication Bypass, CVSS 8.2): Allows remote unauthenticated attackers to bypass authentication and gain full administrative control of N-central RMM servers. Exploited since August 1; attackers used Take Control functionality to pivot to managed endpoints and deployed Cloudflare Tunnel for persistent access. Added to CISA KEV August 3. CISA imposed a 3-day patch deadline for FCEB agencies. Hosted environments auto-updated; on-prem requires manual action.

BREACHES

• ProHealth Medical Group (Singapore): Krybit ransomware group claimed responsibility for a ransomware attack against the healthcare provider, claiming theft of over 114 GB of sensitive patient and organizational data.

• Hyundai Motor Türkiye: The CRPx0 ransomware group claimed a cyberattack against the Turkish subsidiary of Hyundai Motor. The full scope of data exfiltrated remains under investigation.

• Salesforce Records Claimed Stolen: Threat actors claim theft of over 21 million Salesforce records containing PII, along with 147 GB of internal corporate data. Salesforce has not yet confirmed the breach.

THREATS & POLICY

• AI-Generated Exploits Targeting Siemens S7 PLCs in U.S. Critical Infrastructure: NSA, CISA, FBI, DOE, and EPA issued joint advisory AA26-231A warning of ongoing attacks using AI-written Python exploit scripts targeting Siemens S7 Series PLCs via the S7comm protocol. Scripts use snap7 libraries and are disguised as legitimate OT monitoring tools, providing read/write access to PLC memory and ladder logic. Targeted sectors include Water & Wastewater, Energy, Critical Manufacturing, Chemical, Food & Agriculture, and Commercial Facilities. Agencies described this as "not a theoretical risk."

• Head Mare Hacktivist Group – PhantomCore Malware Campaign: The Head Mare hacktivist group is actively exploiting TrueConf Server vulnerabilities (CVE-2026-72529/72530) to compromise organizations, deploy PhantomCore malware, replace client installers with trojaned versions, and gain persistent database access. Organizations using TrueConf Server should treat the patch as emergency priority.

• Operation CameraSwarm: Hunt.io researchers disclosed a campaign that compromised more than 14,530 Dahua IP cameras between June 17 and July 22, 2026, using credential attacks, two authentication-bypass vulnerabilities, and a peer-to-peer relay technique. Researchers reconstructed the campaign from a 407 MB exposed working directory containing 2,616 attacker files.

CLOUD & SAAS SECURITY

• MLflow SSRF (CVE-2026-64849) Exploited for Cloud Credential Theft: Attackers are exploiting the MLflow SSRF vulnerability to reach AWS cloud metadata services and exfiltrate IAM credentials and secrets. The default MLflow tracking server configuration using an unauthenticated SQLite backend makes many deployments vulnerable out of the box. Security researchers at watchTowr observed real-world exploitation within hours of the CVE assignment.

• Microsoft Entra ID RCE Vulnerability Exploited: Microsoft confirmed that a critical remote code execution flaw in Entra ID, its cloud-based identity and access management platform, has already been exploited in the wild. Organizations relying on Entra ID for SSO, MFA, and conditional access should apply the patch immediately.

IDENTITY & AUTHENTICATION

• Machine Identity Sprawl Reaches Critical Scale: Non-human identities (service accounts, API keys, automation bots, cloud workloads, AI agents) now outnumber human identities by 82:1 in enterprise environments. 97% of machine identities carry excessive privileges, while just 0.01% control 80% of cloud resources. Agentic AI systems are accelerating this problem, as AI agents operate with administrative-level access and represent the new insider threat vector.

• Identity Remains #1 Cloud Breach Vector: Over 70% of cloud breaches stem from compromised identities. Security teams are urged to implement zero-trust approaches requiring continuous verification and to transition from long-lived static API keys to ephemeral, identity-based credentials to limit attacker dwell time to minutes.

MOBILE SECURITY

• Manic Android Malware: A new Android malware named Manic is targeting users across multiple European countries. It features a novel fallback data exfiltration mechanism that uses nearby infected devices as P2P relay nodes, allowing data exfiltration even when direct C2 communication is blocked.

• ToxicPanda Malware Updated: Cybersecurity researchers documented a significantly enhanced version of ToxicPanda mobile malware with an expanded set of 167 remote commands and broadened targeting scope. Organizations in financial services should be particularly vigilant.

RESEARCH & TOOLS

• NETSCOUT Adaptive DDoS Protection (ADP) Extended: NETSCOUT announced an extension of its Adaptive DDoS Protection solution enabling service providers to automatically detect and mitigate outbound DDoS attack traffic — helping ISPs prevent their infrastructure from being weaponized in volumetric attacks.

• New Infosec Products This Week: Help Net Security's weekly roundup (Aug 21, 2026) highlights new security tooling releases across threat detection, response, and identity security categories. See helpnetsecurity.com for the full list.

Sources

The Hacker News – CISA Adds Exploited N-able N-central Flaw to KEV: https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html

CISA – Adds Two Known Exploited Vulnerabilities (TrueConf) August 20: https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog

SecurityWeek – CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities: https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-trueconf-vulnerabilities/

BleepingComputer – CISA Warns of Hackers Exploiting Critical MLflow Vulnerability: https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-mlflow-vulnerability/

SecurityWeek – MLflow Vulnerability Exploited for Cloud Credential Theft: https://www.securityweek.com/mlflow-vulnerability-exploited-for-cloud-credential-theft/

The Hacker News – AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure: https://thehackernews.com/2026/08/ai-generated-exploit-scripts-target.html

CISA Advisory AA26-231A – Defending Against an Active Threat to Siemens S7 Series PLCs: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a

BleepingComputer – US Warns of AI-Powered Attacks on Siemens PLCs in Critical Infrastructure: https://www.bleepingcomputer.com/news/security/us-warns-of-ai-powered-attacks-on-siemens-plcs-in-critical-infrastructure/

Rapid7 – CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild: https://www.rapid7.com/blog/post/etr-cve-2026-18577-n-able-n-central-authentication-bypass-exploited-in-the-wild/

SharkStriker – Top Data Breaches of August 2026: https://sharkstriker.com/blog/august-2026-data-breaches/

Security Solutions Media – Machine Identities and AI-Driven Attacks Reshaping Cloud Security Risks: https://www.securitysolutionsmedia.com/2026/03/19/machine-identities-and-ai-driven-attacks-reshaping-cloud-security-risks/

Help Net Security – New Infosec Products of the Week: August 21, 2026: https://www.helpnetsecurity.com/2026/08/21/new-infosec-products-of-the-week-august-21-2026/