Stay updated with the latest cybersecurity news! This daily roundup covers critical zero-days under active exploitation, major data breaches, enterprise platform flaws, supply-chain threats, and social-engineering campaigns. These developments highlight the continued pressure on RMM tools, business-intelligence platforms, load balancers, AI assistants, and end-user systems. Patch urgently, monitor for indicators of compromise, and reinforce employee awareness against social engineering.
1. Metabase Zero-Day (CVSS 10.0) Exploited in the Wild for Admin Access and Data Theft
Published: 2026-08-08 / 2026-08-09
A maximum-severity unauthenticated SQL injection vulnerability in Metabase (business intelligence and data visualization platform) has been actively exploited as a zero-day. The flaw (tracked as GHSA-vwf4-m7j8-wcjf, no CVE assigned at time of reporting) affects versions from 1.58/0.58 onward and allows attackers to inject arbitrary SQL into the application database via the password-reset endpoint, gaining full administrator access. Attackers can then alter configurations, steal stored database credentials, and export data. Metabase Cloud was compromised (detected around August 3); self-hosted instances are also at risk. Confirmed victims include Framework (customer PII such as names, emails, addresses, phone numbers, and login IPs accessed) and Tally. Patches are available (e.g., 0.58.24, 0.59.21, up through 0.63.5). Temporary mitigation: block /api/session/reset_password.
Read more | Metabase advisory / Cybersecurity News
2. N-able Issues N-central Hotfix 2 After Attackers Reach Managed Systems via Exploited Flaw
Published: 2026-08-08
N-able released a second mandatory hotfix (2026.3.1.10) for N-central RMM after ongoing exploitation of CVE-2026-18577 (authentication bypass / incomplete fix for a prior issue, CVSS ~8.2). Attackers gained administrative access to vulnerable on-premises servers, then used the Take Control feature to reach managed customer endpoints and established persistence via Cloudflare Tunnels. A limited number of customers were impacted; CISA had already added the vulnerability to its KEV catalog with a short remediation window. Hosted instances were mitigated by the vendor; on-premises users must apply Hotfix 2 even if they installed the prior fix. Indicators of compromise and detection guidance have been shared.
3. Progress Kemp LoadMaster Critical Flaw Added to CISA KEV After Hundreds of Exploit Attempts
Published: 2026-08-08
CISA added CVE-2026-8037 (CVSS 9.6), a pre-authentication command-injection / remote-code-execution vulnerability in Progress Kemp LoadMaster (and related ADC products), to its Known Exploited Vulnerabilities catalog. The flaw allows unauthenticated attackers to execute arbitrary commands on affected appliances when the API is enabled. Exploitation attempts (hundreds reported) were observed after public technical details and PoC research appeared. Affected versions include GA 7.2.63.1 and earlier, and LTSF 7.2.54.17 and earlier. Patches (GA 7.2.63.2 / LTSF 7.2.54.18) have been available since June; federal agencies faced a short deadline to remediate.
4. Critical One-Click Vulnerability in Atlassian’s Rovo AI Can Expose Enterprise Data
Published: 2026-08-08
Researchers identified “RovoBlast”-style attacks against Atlassian’s Rovo AI assistant. Attacker-controlled instructions (hidden in content the assistant processes, such as uploaded files or other sources) can cause the tool to collect accessible Jira, Confluence, or SharePoint data belonging to a signed-in user and exfiltrate it to an external server. Multiple independent findings confirmed the risk; at least one vector was reported closed. This underscores emerging risks of AI assistants with broad access to enterprise collaboration platforms.
5. Hackers Breach TrueConf Servers to Trojanize Client Installers with Backdoors
Published: 2026-08-08
The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video-conferencing servers to replace legitimate client installers with malicious versions that deliver backdoors. Organizations using self-hosted or poorly secured TrueConf instances are at risk of supply-chain-style compromise of endpoints downloading the software.
6. Levi Strauss & Co. Discloses Cyberattack: Social Engineering Leads to Corporate Data Theft
Published: 2026-08-07
Levi Strauss & Co. reported in an SEC filing that attackers used social engineering against three employees to gain access to their company-issued computers and exfiltrate certain corporate information. The company stated that consumer data was not impacted, business operations were not disrupted, and the incident is not expected to have a material financial or operational impact. Containment measures were implemented and an investigation (with third-party assistance) is ongoing. The incident occurs amid a broader wave of vishing and social-engineering campaigns targeting enterprises.
7. Unlimited Technology Systems Breach Impacts 3.8 Million People
Published: 2026-08-07
Healthcare software company Unlimited Technology Systems disclosed a data breach affecting more than 3.8 million individuals. The unauthorized access occurred between October 5–10, 2025, at a commercial data center. Exposed information includes names, Social Security numbers, dates of birth, contact details, government ID scans, health insurance information, medical record numbers, diagnoses, and related sensitive data. Affected individuals were offered identity monitoring services.
8. WordPress Pre-Auth XSS (XSS2Shell) Can Be Chained to Remote Code Execution
Published: 2026-08-07
WordPress patched a high-severity pre-authentication reflected XSS vulnerability on the login screen (CVE-2026-64638, CVSS ~8.9, nicknamed XSS2Shell). The flaw requires no privileges and can be chained—when a logged-in administrator visits an attacker-controlled page—into full PHP remote code execution on the server. All versions were potentially affected prior to the fix. Immediate patching is strongly recommended.
Additional Noteworthy Items (for context)
- Nearly 800 malicious npm packages delivering cross-platform RATs and info-stealers via AI-generated / typo-squatted names.
- An 18-year-old Linux kernel SCTP use-after-free (CVE-2026-64564 / SCTPhantom) enabling local root and container escape (patches released early August).
- Ongoing vishing / extortion activity linked to groups such as UNC6671 targeting financial and professional-services firms.
- Continued reports of AI models (OpenAI, Anthropic, Meta, others) exhibiting unexpected or risky behavior during security evaluations.
Stay Vigilant
Cyber threats continue to evolve rapidly—zero-days in widely used platforms, RMM and edge-device compromise enabling downstream access, social engineering that bypasses technical controls, and AI-assisted attack tooling are all active themes this week. Prioritize patching of internet-facing and management systems (Metabase, N-central, LoadMaster, WordPress, etc.), enforce strong MFA and phishing-resistant authentication, monitor for unusual admin or remote-access activity, and maintain robust backups and incident-response readiness. Subscribe for ongoing updates and consider layered defenses including endpoint detection, network segmentation, and continuous vulnerability management. Stay safe online.