Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities under active exploitation, emerging ransomware strains, AI-related risks, supply-chain compromises, and threats to critical infrastructure to help you stay informed and secure in the rapidly evolving digital landscape.
1. CISA Confirms SonicWall SMA1000 Flaws Exploited by Ransomware Gangs
Published: 2026-08-10
CISA confirmed that ransomware groups are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 appliances, including a maximum-severity server-side request forgery (SSRF) flaw. Organizations using these devices should prioritize patching immediately to prevent unauthorized access and ransomware deployment.
2. Critical Progress LoadMaster Flaw (CVE-2026-8037) Actively Exploited – Added to CISA KEV
Published: 2026-08-10
CISA added the critical command injection vulnerability (CVE-2026-8037, CVSS 9.6) in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities catalog after observing active attacks. The unauthenticated flaw allows remote code execution via unsanitized API inputs. Patches have been available since June; federal agencies faced a tight remediation deadline, and all users are urged to update exposed appliances (over 100,000 deployments reported).
3. Metabase Zero-Day SQL Injection Exploited for Unauthenticated Admin Access
Published: 2026-08-10
Metabase patched a maximum-severity (CVSS 10.0) SQL injection vulnerability (no CVE assigned at disclosure) that was exploited as a zero-day. Unauthenticated attackers could inject arbitrary SQL into the application database, gain administrative control, steal connected database credentials, and exfiltrate data. The flaw affected versions 1.58 and later; self-hosted instances must upgrade urgently (e.g., to 0.58.24+), revoke sessions, and rotate credentials. Impacted customers include Framework, which reported customer data exposure.
4. China-Linked Hackers Deploy New StormEncryptor Ransomware via Likely N-central Flaw
Published: 2026-08-10
Microsoft disclosed that China-linked threat actor Storm-1175 (previously associated with Medusa ransomware) is deploying a new C++-based ransomware strain called StormEncryptor. It appends .encrypted extensions and drops a distinctive ransom note. Initial access is believed to leverage a patch-bypass authentication flaw in N-able N-central (related to CVE-2026-18577). The group moves rapidly from access to encryption, often using RMM tools and Mimikatz.
5. BdThemes WordPress Plugins Compromised via Poisoned JSON Feed (No File Changes)
Published: 2026-08-10
A supply-chain attack targeted multiple BdThemes WordPress plugins (including Element Pack, Prime Slider, and others) by poisoning a remote promotional JSON feed used by the “Biggopti” banner component. Attackers injected XSS that created rogue administrator accounts and deployed webshells/MU-plugin backdoors without modifying any plugin files on disk. Affected plugins were temporarily pulled from the WordPress repository; sites running them should audit for unauthorized admins and remove malicious components.
6. Atlassian Rovo AI “RovoBlast” Vulnerability Enables One-Click Data Exfiltration
Published: 2026-08-10 (research/disclosure coverage)
Researchers (including Varonis Threat Labs) disclosed RovoBlast, a one-click prompt-injection issue in Atlassian’s Rovo enterprise AI assistant. A crafted link or poisoned content could seed attacker instructions into an authenticated user’s session, allowing the AI’s autonomous tools to collect and exfiltrate Jira, Confluence, SharePoint, or other connected data without additional approval. Atlassian issued a server-side fix for the primary vector.
7. New Passkey Attacks Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Published: 2026-08-10
Multiple research teams demonstrated practical attacks against passkey implementations that do not break the underlying cryptography. Techniques include recovering private keys from Google-synced passkeys in Chrome on Windows (Pass-ta-key family by Unit 42), replaying signed material against Microsoft Entra ID, and misusing Windows Hello for Business keys from an already-compromised session. These highlight residual risks when devices or sync mechanisms are compromised.
8. Iran-Linked Hackers Expand Targeting of U.S. Water Facilities Across a Dozen States
Published: Ongoing (updates through 2026-08-10)
Hackers linked to Iran have targeted industrial control systems (ICS/PLCs) at water and wastewater facilities in at least a dozen U.S. states, including recent confirmations involving New Jersey and Alabama. Attacks exploit internet-exposed devices, causing operational disruptions in some cases. CISA and partners continue to urge isolation of critical OT systems and hardening of programmable logic controllers.
Stay Vigilant
Cyber threats continue to evolve rapidly, with particular emphasis on unpatched edge appliances, AI agent risks, supply-chain vectors that evade traditional file integrity monitoring, and critical infrastructure. Prioritize patching of high-severity and KEV-listed flaws, monitor for unusual admin activity on WordPress and analytics platforms, review AI assistant configurations and prompt-injection defenses, and strengthen device trust for passwordless authentication. Subscribe for ongoing updates, and consider layered monitoring and automated patching tools where appropriate. Stay safe online!