Daily Cybersecurity Briefing — August 27, 2026

Paul Baity
1 day ago
2 min read

ACTIVELY EXPLOITED VULNERABILITIES

CVE-2026-21962 (CVSS 10.0) — Oracle HTTP Server / WebLogic Server Proxy Plug-in Authentication Bypass. Unauthenticated attackers with network access can read or modify critical data. Exploited by a China-linked threat actor in attacks against 100+ governments to deliver the SNOWLIGHT downloader. Oracle patched in January 2026 CPU. CISA added to KEV August 24; FCEB patch deadline: August 27, 2026.
CISA Added 6 New KEVs (August 26, 2026): CVE-2015-3246 (Red Hat Libuser Race Condition Vulnerability), CVE-2015-5287 (Red Hat Automatic Bug Reporting Tool Privilege Escalation), CVE-2019-1068 (Microsoft SQL Server Remote Code Execution), CVE-2021-23758 (Ajax.NET Professional Deserialization of Untrusted Data), CVE-2022-0995 (Linux Kernel Out-of-Bounds Write), CVE-2026-8452 (Citrix NetScaler ADC and NetScaler Gateway Memory Buffer Vulnerability). FCEB agencies must remediate per BOD 26-04.

BREACHES

NutraBio (August 24, 2026) — U.S. sports nutrition and dietary supplement manufacturer hit by ransomware with 93GB of sensitive data exposed. Qilin ransomware group claimed responsibility. Qilin has now claimed 2,203 total victims, including 142 in the past 30 days.
88 Identity-Verification Breaches in 2026 — Organizations collecting biometric and identity verification data have reported 88 breaches this year, exposing billions of records and underscoring systemic risks tied to centralized storage of sensitive identity data.

THREATS & POLICY

DOJ & FBI Seize QScan and QTRouter (August 26-27, 2026) — The Justice Department and FBI seized domains of two Chinese state-sponsored hacking platforms operated by QTFY, a Nanjing-based company serving China's Ministry of State Security and PLA. QScan recruited compromised IoT devices worldwide; QTRouter combined them with proxies to mask intrusions. Targets included NASA, the Federal Reserve, DOJ, DOE, HHS, NIH, and the U.S. Senate. Hardcoded domain seizures rendered both tools inoperable.
Iran-Attributed Cyberattacks on Water Systems Expand to 12+ States — FBI reports attacks on municipal water systems since July 27, now affecting utilities in at least 12 states including Minnesota and Michigan. Attackers targeted Rockwell Automation/Allen-Bradley MicroLogix ICS devices, changing IPs and passwords, locking out operators, and causing pressure drops and flooding in some cases. No confirmed water quality impact. Technical indicators align with Iranian-affiliated groups.
White House AI Executive Order (June 2026) — Establishes a voluntary framework for developers of advanced AI models to submit systems for federal cybersecurity and national security assessments before public release. The Attorney General is directed to prioritize enforcement against criminal actors who exploit AI to access systems or facilitate cybercrime. Note: information-sharing confidence between industry and law enforcement is reportedly showing strain due to increasing politicization within federal agencies.

MOBILE SECURITY

AnonyMousKIT PhaaS — A phishing-as-a-service platform uses rented AI voice agents posing as "Alice from Apple Support" in English, Spanish, and Portuguese to steal iPhone passcodes and 2FA codes, enabling bypass of Activation Lock on stolen devices. The platform links to 506 domains and operates 168 reseller storefronts. Active since at least February 2024 with operations continuing through August 2026. (Source: SOCRadar Threat Research / Help Net Security)

RESEARCH & TOOLS

CISA Red Team Exercise Findings — CISA red teams fully compromised two critical infrastructure organizations. One organization's SOC detected the intrusion and isolated hosts within minutes; the second organization never detected the breach. The exercise highlights significant variance in detection and response capabilities across the critical infrastructure sector.

Sources

https://thehackernews.com/2026/08/actively-exploited-oracle-weblogic-flaw.html

https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog

https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-platforms-operated-and-used-china-state-sponsored-hackers

https://www.nbcnews.com/tech/security/hackers-targeted-municipal-water-systems-7-states-week-fbi-says-rcna590210

https://www.helpnetsecurity.com/2026/08/26/anonymouskit-phishing-stolen-iphone/

https://www.helpnetsecurity.com/2026/08/27/fbi-disrupts-china-linked-hacking-network/

https://www.axios.com/2026/08/04/water-cyberattacks-us-iran

https://www.scworld.com/brief/fbi-seizes-china-linked-qscan-and-qtrouter-platforms-used-to-target-u-s-critical-infrastructure