Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities under active exploitation, emerging botnets and malware, significant data breaches, domain-based threats, authentication improvements, and related incidents to keep you informed and secure in the ever-evolving digital landscape.
1. Max-Severity SAP Commerce Cloud Flaw (CVE-2026-58231) Targeted in Exploitation Attempts Days After Patch
Published: 2026-08-14 / 2026-08-15
A critical unauthenticated remote code execution vulnerability (CVSS 10.0) in SAP Commerce Cloud’s Data Hub Adapter is seeing active exploitation attempts just days after SAP’s August Patch Day fix. Threat intelligence sensors detected probing of exposed endpoints despite no public proof-of-concept being available. Organizations using the platform should apply the security note immediately.
2. Apple macOS Screen Sharing Flaw (CVE-2026-65400) Actively Exploited to Install Monero Miners
Published: 2026-08-14 / 2026-08-15
The Netherlands National Cyber Security Centre warned that a critical authentication bypass in macOS Screen Sharing (patched by Apple on August 6 for Tahoe, Sequoia, and Sonoma) is being exploited on internet-exposed Macs (port 5900). Attackers gain root access and deploy Monero cryptocurrency miners. Disable Screen Sharing or apply the updates urgently if not already done.
3. New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Edge Devices into Persistent Proxies
Published: 2026-08-15
Fortinet researchers detailed Evooo1Bot, a modular Mirai-derived botnet active since at least July 2026. It targets routers and gateways from multiple vendors via known vulnerabilities, then deploys SOCKS5 relays, credential sniffers, SSH brute-forcing, and DDoS capabilities with encrypted C2. Compromised devices become persistent proxies for further attacks. Keep IoT firmware updated and restrict remote access.
4. RingCentral Data Breach Exposes Information of 1.6 Million Accounts
Published: 2026-08-14
ShinyHunters claimed and later dumped data from a July 2026 social-engineering attack on RingCentral. Have I Been Pwned confirmed roughly 1.6 million unique email addresses plus names, physical addresses, and phone numbers. RingCentral described a sophisticated campaign affecting a limited portion of customers and stated its core platform remained operational.
5. Shell Investigating Potential Incident After Cl0p Ransomware Group Claims Data Theft
Published: 2026-08-14 / 2026-08-15
Energy giant Shell confirmed it is investigating a potential security incident after the Cl0p (Clop) ransomware group claimed responsibility for stealing approximately 89 GB of internal data. Details on scope and impact remain limited as the company continues its review.
6. Threat Actors Spend Nearly $7 Million on Expired “Dropcatch” Domains for Scams and Malware
Published: 2026-08-14
Infoblox research revealed threat actors (notably one tracked as Sable Squirrel) investing an estimated $7 million+ to acquire over 10,000 expired domains. These inherit residual traffic, backlinks, and reputation, then get redirected to illegal streaming, gambling, scams, and malware C2 (including RATs). Around 65,000 such domains are re-registered daily.
7. Microsoft to Make Passkeys the Default in Entra ID and Retire SMS/Voice MFA
Published: 2026-08-15
Microsoft announced that passkeys will become the default authentication experience in Entra ID starting September 1, 2026, with full retirement of native SMS and voice multifactor authentication services planned for February 1, 2027. This accelerates the shift away from phishing-prone methods toward stronger, phishing-resistant authentication.
8. Beacon CRM Data Breach Affects 1,000+ UK Charities via Compromised AWS Access Key
Published: 2026-08-13 / ongoing updates
CRM provider Beacon (used by more than 1,000–1,500 charities and nonprofits) confirmed a July 2026 incident linked to a compromised AWS access key exposed in public JavaScript build artifacts. Attackers copied and likely downloaded database backups containing supporter data (names, addresses, donation records, etc.). Multiple charities have issued notifications; no widespread evidence of data misuse has been reported so far, but organizations should monitor for phishing.
Stay Vigilant
Cyber threats continue to evolve rapidly—zero-days are being exploited within days of disclosure, botnets are turning everyday devices into proxies, and social engineering plus supply-chain weaknesses remain highly effective. Prioritize timely patching (especially for internet-facing services), enable phishing-resistant authentication where possible, monitor for anomalous domain activity, and keep IoT/edge devices hardened. Subscribe for ongoing daily or weekly updates, and consider continuous vulnerability monitoring and automated patching tools suited to your environment. Stay safe online!