Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities under active exploitation, major data breaches and credential theft campaigns, emerging malware, and significant patches to keep you informed and secure in the rapidly evolving digital landscape.
1. McDonald’s, Vodafone and Others Hit by Massive Azure Credential Theft Campaign
Published: 2026-08-16
A threat actor known as “TheHatman” is selling internal employee directories allegedly stolen from Azure/Entra tenants of major enterprises using compromised credentials (often linked to infostealer malware). McDonald’s tops the list with over 1.7 million records, followed by Tata Consultancy Services (~800,000), Vodafone (~425,000), HCL Technologies (~250,000), and others including Kyndryl, IHG, and Gap. The data includes names, emails, job titles, departments, and more, raising risks of further phishing, BEC, and ransomware attacks.
2. Critical SAP Commerce Cloud Flaw (CVE-2026-58231, CVSS 10.0) Actively Exploited Days After Patch
Published: 2026-08-14 / 2026-08-15
Threat actors began targeting a maximum-severity unauthenticated remote code execution vulnerability in SAP Commerce Cloud’s Data Hub Adapter just days after SAP released fixes on its August Patch Day. The flaw allows attackers to abuse a default authentication client and execute arbitrary code without credentials. No public PoC is known, but honeypot telemetry confirmed exploitation attempts. Organizations running affected versions should patch immediately.
Read more or The Hacker News coverage
3. Apple macOS Screen Sharing Flaw Exploited to Deploy Monero Miners
Published: 2026-08-14 / 2026-08-15
The Netherlands NCSC and others warned that CVE-2026-65400 (CVSS 9.8), a critical authentication bypass in macOS Screen Sharing, is being actively exploited on internet-exposed Macs to install cryptocurrency miners. Apple patched the issue in recent updates with improved state management. Exposed systems remain at high risk until updated.
4. Microsoft August 2026 Patch Tuesday Fixes ~400–421 Vulnerabilities, Including Actively Exploited Zero-Day
Published: 2026-08-11
Microsoft’s August Patch Tuesday addressed a large volume of flaws (reports cite approximately 400–421 CVEs), including the actively exploited CVE-2026-68820 — a use-after-free elevation-of-privilege bug in the Windows Ancillary Function Driver for WinSock (afd.sys). Check Point Research linked exploitation of this zero-day to North Korea’s Lazarus Group. Two additional publicly disclosed zero-days were also fixed. Prioritize installation, especially on systems handling network sockets.
5. RingCentral Data Breach Impacts 1.6 Million Accounts
Published: 2026-08-14
The ShinyHunters extortion group claimed (and Have I Been Pwned corroborated) theft of personal information from approximately 1.6 million RingCentral accounts following a July intrusion. Exposed data includes names, addresses, email addresses, and phone numbers. The incident highlights ongoing risks to communications platforms.
6. New AmnesiaStealer macOS Malware Hijacks Browser Sessions via Remote Control
Published: 2026-08-16
A novel Rust-based macOS information stealer, AmnesiaStealer, is spreading via ClickFix social engineering (fake GitHub downloads and Base64 command lures). It steals Keychain data, browser credentials/cookies, and uniquely includes a streaming module that lets attackers interactively control the victim’s browser sessions in real time.
7. SafePal Crypto Wallet Provider Suffers Data Breach Affecting Nearly 40,000 Customers
Published: 2026-08-16
Hardware wallet provider SafePal disclosed a breach impacting about 39,798 customers after a flaw was exploited to steal order information. A threat actor is now allegedly selling the stolen data online. Users of the platform should monitor for related phishing or social engineering.
8. Shell Investigating Potential Incident After Cl0p Ransomware Group Claims Data Theft
Published: 2026-08-14 / 2026-08-15
Energy giant Shell confirmed it is investigating a potential security incident after the Cl0p ransomware group claimed responsibility for exfiltrating sensitive internal data (reports mention tens of gigabytes). Forensic assessment is ongoing to determine the scope and legitimacy of the claims.
Stay Vigilant
Cyber threats continue to evolve at a rapid pace — from zero-day exploitation and large-scale cloud credential theft to sophisticated macOS malware and ransomware claims against major enterprises. Prioritize timely patching (especially Microsoft’s August updates, SAP Commerce Cloud, and macOS Screen Sharing), enforce strong MFA/passkeys, monitor for credential exposure from infostealers, and maintain robust incident response plans. Subscribe for daily or weekly updates, and consider layered monitoring tools to detect vulnerabilities and anomalous activity early. Stay safe online!