The patch was the starting gun
Five flaws entered the exploited catalog in two days, SAP fell three days after its fix, and SharePoint waited only for a public proof of concept.
Act now 6 Also this week 18 Cut on sourcing 3
Editor's note
Five entries in the exploited catalog in two days, and three of them are stories this issue would have carried anyway. The catalog used to lag the coverage by weeks. When it moves at the speed of the trade press it stops being a confirmation and becomes a deadline, which is a different thing to plan around.
The entry I would not have predicted is Ray. It schedules training and inference jobs, and it now sits on the same list as vCenter and SharePoint. The argument about model safety assumes the model is the interesting target. The scheduler underneath it is an ordinary internet-facing service with an ordinary code-injection flaw, and that is the part being exploited.
🔍 The find this week: StepSecurity's read of the CloudSEK disclosure. Team PCP took 78,330 secrets from 2,186 organizations through CI/CD pipelines, and the list of who was affected is now public. Two thousand names is a list you can look yourself up in, which is rarer than it should be.
James Webb
Share: To LinkedIn read by your browser's voice · skips the labels
Overview
Nothing this week was novel. What changed is the interval between a fix being published and the first attempt against it, and the first entry of the week was Ray, the framework that schedules AI training and inference jobs, now listed beside vCenter and SharePoint as ordinary exploited infrastructure.
- The catalog caught up in two days. CISA added Ray on Monday, then Microsoft IKE, SharePoint, VMware vCenter, and Apple macOS on Tuesday. Three of those four are separate items below, so the federal deadline and this issue are describing the same events.
- The gap is now measured in days. SAP Commerce Cloud, rated 10.0, drew exploitation attempts three days after its patch. SharePoint waited for Rapid7 to publish working code. The GeoServer flaw under attack has no patch at all.
- Patching is not eviction. vCenter intrusions leave a reverse SSH tool behind, and one campaign carries ransomware derived from Babuk. The update closes a door on a room somebody is already in.
Act now6 items
CISA adds Ray, vCenter, SharePoint, and macOS to KEV §
CISA listed a code-injection flaw in Ray, the distributed computing framework used to scale AI and machine learning workloads, on 17 August as CVE-2025-62593. Four more followed the next day: Microsoft IKE (CVE-2026-33824), SharePoint (CVE-2026-55040), VMware vCenter (CVE-2026-59310), and Apple macOS (CVE-2026-65400).
What it changes. Three of those five are separate items in this issue, which is the point: the catalog is confirming within a day what the coverage reported in the same week. Federal agencies inherit a deadline under BOD 26-04, and everyone else inherits the evidence that exploitation is real.
Sources: CISA Alerts, CISA Cybersecurity Advisories, The Hacker News (thehackernews.com)
Macs on the internet are being logged into without a password §
The Netherlands National Cyber Security Centre warns that attackers are exploiting CVE-2026-65400, an authentication flaw in the macOS Screen Sharing component rated 9.8, after exploit code became public. Reported intrusions take root and install a Monero miner.
What it changes. A cryptocurrency miner is the cheapest thing an attacker can do with root on a Mac, so read it as a census rather than as the damage. What is being counted is Macs reachable from the internet on the screen sharing port, a configuration most organizations believe they do not have.
Sources: BleepingComputer, Ars Technica, The Hacker News (thehackernews.com), SecurityWeek (+1 more)
vCenter attacks leave persistence a patch will not remove §
Attackers are exploiting CVE-2026-59310, a directory-traversal flaw in VMware vCenter rated 9.8, to install a reverse SSH tool for remote access. Exploitation began earlier this month, and one campaign is attributed to a suspected China-nexus group deploying ransomware derived from Babuk.
What it changes. The hypervisor control plane holds every virtual machine in the estate, so the tool left behind matters more than the flaw that delivered it. Anyone who patched vCenter this month and closed the ticket now has a hunt to run instead.
Sources: The Hacker News (thehackernews.com), BleepingComputer, Dark Reading
Lazarus used the August Windows zero-day on defense firms §
Check Point attributes zero-day exploitation of CVE-2026-68820 to Lazarus, the North Korean group behind Operation Dream Job. The flaw gives SYSTEM access, and the campaign delivered a previously unseen backdoor named ForestTiger to defense and aerospace companies in France, Germany, Brazil, and India.
What it changes. This is the same identifier Microsoft patched at August's Patch Tuesday and issue 02 carried as one flaw already in use. The attribution arrives a week later and names the targets, so the sectors listed should treat the August update as an incident trigger rather than as routine maintenance.
Sources: SecurityWeek, BleepingComputer, The Hacker News (thehackernews.com)
A 10.0-rated SAP flaw drew attacks three days after the fix §
SAP patched CVE-2026-58231, rated 10.0, in the Commerce Cloud Data Hub Adapter. It lets an unauthenticated attacker abuse a default authentication client and run arbitrary code. Threat intelligence firm Defused recorded exploitation attempts three days after disclosure.
What it changes. Three days is shorter than the change window most organizations run for a commerce platform, so the question is what to do during the gap rather than whether to patch. An allow list in front of the Data Hub Adapter answers it until the update lands.
Sources: The Hacker News (thehackernews.com), BleepingComputer, SecurityWeek
A Cisco firewall flaw is being used to drop VPN service §
Cisco says CVE-2026-20349, rated 8.6, has been exploited in the wild. It is insufficient error checking when Secure Firewall ASA and FTD software processes HTTP requests, and an unauthenticated remote attacker can use it to take the remote-access VPN down. WaterISAC circulated a notification to utility members.
What it changes. Denial of service against the VPN concentrator is an availability problem for staff and a visibility problem for defenders, because the appliance that restarts is also the one holding the session records. Water utilities were told first, which says something about who runs these boxes at the edge.
Sources: The Hacker News (thehackernews.com), WaterISAC
Also this week
Attacking the agents themselves
- Replayed reasoning blocks gave up keys and passwords. Researchers found that the encrypted reasoning objects OpenAI, Anthropic, and Google carry between API calls could be replayed into a different session. Recovered material included internal reasoning and, during testing, API keys and passwords held in session logs.
Machines on defense
- Google puts agents on source code review after leaks. Google Threat Intelligence describes an agentic source-code review pipeline built for the case where proprietary code has been stolen, combining structured analysis, enforced skeptical validation steps, and human domain expertise.
Risk with a body
- A survey maps where attacks enter embodied agents. A new survey organises threats to foundation-model-powered embodied agents by where an adversary first enters the control loop rather than by technique, and covers attack surfaces, defenses, and evaluation.
Industrial and critical infrastructure
- Dirty Frag reaches Hitachi Energy asset monitoring. CISA published an advisory for Hitachi Energy APM Edge versions 6.10 and earlier, affected by the Dirty Frag vulnerabilities, with impact on confidentiality, integrity, and availability. The vendor lists recommended immediate actions.
Ordinary exploitation that still matters
- SharePoint attacks followed the public proof of concept. Attackers began exploiting CVE-2026-55040, an authentication bypass in Microsoft SharePoint rated 9.1, after Rapid7 published proof-of-concept code. Microsoft shipped the fix in its July Patch Tuesday, and CISA added the flaw to the exploited catalog this week.
- A shipping provider leaked 14,000 hardware wallet owners. Trezor says nearly 14,000 customers had names, addresses, email addresses, and phone numbers taken in a breach at ShipMonk, its logistics provider. Separately, more than 1,000 charities were exposed through Beacon CRM after an AWS access key was found in public JavaScript build artifacts.
- A WordPress form plugin accepts PHP uploads from anyone. Forminator Forms carries CVE-2026-15748, rated 9.8, an arbitrary file upload that lets an unauthenticated attacker place an executable file on the server. The plugin reports more than 600,000 active installations, and SecurityWeek puts the exposed count at about 300,000.
- A seller claims 3.6 million records from Azure tenants. A threat actor is advertising employee databases said to come from the Microsoft Azure environments of McDonald's, TCS, Vodafone, and other large companies, claiming 3.6 million records obtained with compromised credentials.
- One control panel ran both espionage and crypto theft. Researchers describe Jewelbug, a China-linked group running government and military espionage alongside cryptocurrency fraud, both administered from XG-Web, a browser-centered remote access and information-stealing framework.
- A published Defender zero-day gives SYSTEM from any account. A researcher released proof-of-concept code for ShieldBreak, an unpatched flaw in Microsoft Defender that grants SYSTEM privileges from an ordinary user account. It bypasses the fix for CVE-2026-50656, and Kevin Beaumont reports the code works on current Windows 11.
- A GitLab flaw lets strangers delete public projects. GitLab patched CVE-2026-19478, rated 9.4, which under certain conditions lets an unauthenticated attacker modify or delete public projects and user data. Dark Reading reports that the sparse technical detail makes exploitation hard to detect on self-managed instances.
- An unpatched GeoServer SQL injection is under attack. watchTowr reports exploitation attempts against a GeoServer zero-day disclosed on 12 August with no CVE identifier and no fix. The flaw is an SQL injection in the open-source mapping platform that can lead to remote code execution.
- Ransomware crews picked up an April Windows flaw. CISA says ransomware operators are now exploiting a high-severity Windows Task Host vulnerability that it flagged as actively exploited in April.
- watchTowr reports pre-auth RCE in Citrix NetScaler SAML. A single post from Kevin Beaumont points to watchTowr research claiming pre-authentication remote code execution through one of the Citrix NetScaler SAML vulnerabilities, tracked as CVE-2026-8452.
- GE and Philips are checking Clop's data theft claims. General Electric and Philips say they are investigating claims by the Clop ransomware group that it breached their systems and took data. Neither company has confirmed a breach, the claim comes from the group's own leak listing, and BleepingComputer is the only source carrying it.
Rules and enforcement
- The White House opens offensive operations to private firms. A presidential memorandum directs the National Cyber Council to establish a program under which private companies can apply for approval to carry out offensive cyber operations against transnational cybercrime groups.
- NIST asks how to rebuild the NVD for machine consumers. NIST published a request for information on modernising the National Vulnerability Database for machine-consumable security data and AI-assisted analysis. Socket reports an unreleased internal tool called V-etalon, disclosed after years of automation plans produced no public enrichment system.
From the research frontier
- Three papers on where agentic assistants break. This week's research batch: a survey of vulnerabilities in agentic large language models that hold real privileges, a benchmark for assistants that must gather personal information scattered across mobile apps, and a consistency measure for telling a stable answer from pattern matching.
Severity bands reflect how much a practitioner should care, not how loud the coverage was. Confidence follows standard intelligence language. How items are scored →