Stay updated with the latest cybersecurity news. This roundup covers critical vulnerabilities, emerging threats, data breaches, nation-state activity, and defensive developments from roughly the past week to keep you informed in the fast-moving digital landscape.
1. Microsoft August 2026 Patch Tuesday Fixes 421 CVEs Including Exploited Zero-Day
Published: 2026-08-11 / coverage through mid-August
Microsoft’s August Patch Tuesday addressed 421 vulnerabilities (some reports cite ~398–400 newly addressed issues depending on counting). The standout is the actively exploited zero-day CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys). Local attackers can trigger a race condition to gain SYSTEM privileges. Additional notable items include publicly known elevation-of-privilege issues and numerous critical remote-code-execution and privilege-escalation fixes across Windows, Office, SharePoint, Exchange, Azure, and other products.
2. RingCentral Data Breach Exposes Information of 1.6 Million Accounts
Published: 2026-08-14
ShinyHunters claimed a July 2026 intrusion into RingCentral (via sophisticated social engineering) and later leaked data after the company declined ransom demands. Have I Been Pwned confirmed records for approximately 1.6 million accounts containing names, email addresses, phone numbers, and physical addresses. RingCentral stated the core platform was unaffected, only a limited portion of customers were impacted, and affected parties were notified.
3. Beacon CRM Breach Hits Over 1,000 UK Charities via Exposed AWS Access Key
Published: Ongoing updates through mid-August 2026
CRM provider Beacon (used by more than 1,000–1,500 charities and nonprofits) suffered a breach in late July. Investigators pointed to a compromised AWS access key exposed in publicly available JavaScript build artifacts. Attackers made and downloaded readable copies of the customer database (including attachments). Multiple UK charities have notified supporters; sensitive supporter, donation, and in some cases health-related data may be involved. No widespread public dumping of the full dataset had been confirmed at the time of reporting.
Read more (see Beacon CRM / charities coverage)
4. Critical VMware vCenter Flaw Exploited Within Days of Disclosure Across 47 Countries
Published: 2026-08-12 / 2026-08-13
Broadcom disclosed critical VMware vCenter issues (including the directory-traversal/RCE CVE-2026-59310, CVSS 9.8, in the Syslog server) at the end of July. Researchers observed active exploitation beginning around August 3—only about five days later—by a suspected APT actor. Activity reached 361 unique victim IPs across 47 countries, with reverse-shell persistence noted. Organizations running exposed or unpatched vCenter instances face high risk of full environment compromise.
5. Apple Issues Mercenary Spyware Threat Notifications to Users in 110 Countries
Published: 2026-08-13 / 2026-08-14
Apple sent a fresh wave of high-confidence “Threat Notifications” to selected users across 110 countries (bringing the historical total of notified countries above 150). The alerts warn of possible targeting by sophisticated mercenary spyware (typically associated with state or state-linked actors and often aimed at journalists, activists, politicians, or diplomats). Recipients are advised to enable Lockdown Mode and seek expert help (e.g., Access Now Digital Security Helpline). These notifications are rare and expensive to trigger for attackers.
6. Akira Ransomware Affiliate Uses Safe Mode Reboot to Blind EDR (Encryption Fails)
Published: 2026-08-12 / 2026-08-13
An Akira affiliate gained access via an MFA-less SonicWall VPN, moved laterally, exfiltrated data (WinRAR + s5cmd to S3), installed AnyDesk for persistence, then forced a reboot into Safe Mode with Networking. This temporarily disabled third-party EDR and Defender real-time protection. However, the constrained virtual-memory environment of Safe Mode caused the Akira encryptor itself to fail with out-of-memory errors. Data theft still succeeded, enabling double-extortion pressure even without encryption.
7. Nearly 14,000 Trezor Customers Impacted by ShipMonk Shipping-Provider Breach
Published: 2026-08-13 / 2026-08-14
Hardware wallet maker Trezor disclosed that its logistics partner ShipMonk suffered unauthorized access (reportedly tied to a Metabase vulnerability). Approximately 11,742 customers had full details (names, emails, phone numbers, shipping addresses) exposed and another ~1,947 had partial exposure, primarily affecting recent orders in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal. Trezor’s own systems, devices, and private keys were not compromised, but the exposure raises phishing and physical-safety risks for hardware-wallet owners.
8. Shell Investigating Potential Incident After Clop Claims 89 GB Data Theft
Published: 2026-08-14
The Clop (Cl0p) ransomware/extortion group listed Shell among nearly 50 claimed victims and alleged theft of roughly 89 GB of data (engineering drawings, facility reports/photos, project plans). Shell confirmed it is investigating a “potential incident.” The activity appears linked to broader Clop campaigns targeting exposed enterprise software (including reports of PTC Windchill/FlexPLM or related flaws). Other major firms have also been named in the same wave of claims.
Read more (Shell / Clop coverage)
Additional notes from the same period
- Active exploitation of other high-severity issues (Adobe Commerce, GeoServer zero-day SQL injection leading to RCE, SAP Commerce Cloud maximum-severity flaws) was also reported shortly after disclosure or patching.
- China-linked activity (e.g., Mustang Panda rootkit updates, Jewelbug APT links) and North Korean groups (Lazarus Windows zero-day use, offline AI tooling) continued to surface.
- Policy developments included U.S. authorization for greater private-sector participation in offensive cyber operations against certain transnational groups.
Stay Vigilant Cyber threats continue to evolve rapidly through supply-chain compromises, zero-day exploitation windows measured in days, social engineering, and novel EDR-evasion techniques. Prioritize timely patching of internet-facing systems (especially virtualization, CRM, collaboration, and logistics platforms), enforce MFA everywhere feasible, monitor third-party risk, and maintain robust detection for unusual boot modes or data-exfiltration tools.