Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities under active exploitation, major data breaches, emerging malware families, significant patches, and notable policy shifts to keep you informed and secure in the rapidly evolving digital threat landscape.
1. Unpatched GeoServer Zero-Day Under Active Exploitation, Risks Remote Code Execution
Published: 2026-08-13
A newly disclosed unauthenticated SQL injection flaw in the open-source geospatial platform GeoServer (affecting the jsonArrayContains function) is already seeing active exploitation attempts. Under certain configurations (particularly with Microsoft SQL Server running elevated privileges), it can lead to remote code execution. No official patch is available yet, and researchers observed hundreds of probing attempts from a small set of IPs within hours of public disclosure.
2. Beacon CRM Confirms Full Database Theft After Exposed AWS Access Key Breach
Published: 2026-08-13
UK-based CRM provider Beacon (used by more than 1,500 charities and non-profits) confirmed that a threat actor stole a full copy of its customer database, including attachments, after a compromised AWS access key was likely exposed in public JavaScript build artifacts. Malicious activity occurred primarily on July 27–28, 2026, with significant data exfiltration; affected charities have been advised to notify the ICO and their contacts.
3. Critical VMware vCenter Flaw (CVE-2026-59310) Exploited Within Days of Disclosure
Published: 2026-08-13
A critical directory traversal vulnerability in the VMware vCenter Syslog server (CVSS 9.8) that allows unauthenticated remote code execution is being actively exploited by a suspected APT actor. Exploitation began roughly five days after Broadcom’s July 29 disclosure, with researchers identifying activity linked to 361 victim IP addresses across 47 countries; attackers are deploying reverse shells for persistence. Immediate patching to the fixed versions is strongly recommended.
4. Trump Authorizes Private-Sector Participation in Offensive Cyber Operations
Published: 2026-08-13
A National Security Presidential Memorandum signed by President Trump authorizes vetted U.S. private companies to conduct government-directed offensive cyber surveillance and effects operations against foreign transnational criminal organizations (including ransomware and fraud groups) under strict DOJ and DHS oversight. Participating firms face rigorous vetting, written approvals for operations, and a $1 million bond that can be forfeited for non-compliance; the move marks a significant policy shift.
5. AmnesiaStealer macOS Infostealer Spreads via Fake GitHub Lure
Published: 2026-08-13
A new Rust-based macOS information stealer called AmnesiaStealer is distributed through convincing fake GitHub download pages that trick users into pasting a malicious Terminal command (ClickFix-style). Once installed, it hijacks Chromium browser sessions for live control and steals data from Keychain, browsers, Apple Notes, Telegram, and other sources.
6. Attackers Exploit Microsoft SharePoint Authentication Bypass After PoC Release
Published: 2026-08-13
Threat actors began actively exploiting CVE-2026-55040 (a critical SharePoint authentication bypass previously patched in July) within hours of Rapid7 publishing a technical breakdown and proof-of-concept. The flaw enables impersonation of users and unauthorized file access/modification on internet-facing servers; this continues a pattern of rapid SharePoint exploitation.
7. Fortinet Patches Multiple Authentication Vulnerabilities Across FortiWeb, FortiManager, and FortiClient
Published: 2026-08-13
Fortinet released fixes for several authentication-related flaws that could allow attackers to log in with random credentials or impersonate FortiGate appliances. Administrators are urged to apply the updates promptly across the affected product lines to prevent unauthorized access.
8. WindRelay Android Malware Turns Phones into NFC Relays for Live Payment Fraud
Published: 2026-08-13
A previously unseen Android NFC relay malware family named WindRelay is being deployed alongside the SpyNote RAT in contactless payment fraud schemes. It captures live card data during NFC interactions (often mid-call after phishing/smishing installation) and relays it in real time, enabling attackers to clone and use cards without physical possession.
Stay Vigilant
Cyber threats continue to evolve quickly, with zero-days moving from disclosure to exploitation in days (or hours), supply-chain and credential exposures enabling large-scale breaches, and nation-state and criminal groups adopting new techniques including AI assistance and novel malware. Prioritize rapid patching of critical infrastructure (vCenter, SharePoint, Fortinet, WordPress/plugins where relevant), monitor for exposed credentials and supply-chain risks, and maintain strong endpoint detection. Subscribe for ongoing daily or weekly updates, and consider layered defenses including vulnerability scanning, least-privilege access, and continuous monitoring. Stay safe online!