Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, supply-chain attacks, nation-state activity, ransomware developments, and significant advisories from the past couple of days to keep you informed and secure in the ever-evolving digital landscape.
1. Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Published: 2026-08-20
The Rust Project deleted malicious versions of three widely used crates (arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9) after a compromised maintainer account published releases containing a typosquatted dependency. The dependency’s build script downloaded and executed a remote payload during compilation, potentially installing persistence and stealing credentials. Arrayref alone has over 245 million all-time downloads. The malicious versions were live for roughly 86–107 minutes.
2. Critical Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Published: 2026-08-20
A critical unrestricted file-upload vulnerability (CVE-2026-32475, CVSS 9.0) in the Elementor Pro WordPress plugin’s Forms module allows unauthenticated attackers to bypass extension checks and upload malicious PHP files for remote code execution. It affects versions up to and including 4.2.1; the issue was patched in version 4.2.2 (released August 19). Exploitation requires a published form with a File Upload field.
3. US Charges 17 Iranian Hackers Over Years-Long IP Theft Campaign
Published: 2026-08-19 / 2026-08-20
U.S. authorities unsealed a superseding indictment charging 17 members of the Iran-based Mabna Institute with a coordinated cyber-theft campaign that stole more than 31 terabytes of academic data and intellectual property (valued at roughly $3.4 billion) from 144 U.S. universities, dozens of companies, government agencies, and NGOs. The activity, linked to Iran’s Islamic Revolutionary Guard Corps, ran for years; the U.S. is offering rewards of up to $10 million for information leading to the arrest of five defendants.
4. AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
Published: 2026-08-20
U.S. agencies (including CISA, NSA, FBI, DOE, and EPA) issued a joint advisory warning of an active threat using AI-generated exploitation scripts against internet-exposed Siemens S7 Series programmable logic controllers. Attackers leverage scanning services to find outdated or poorly protected devices in critical manufacturing, energy, water/wastewater, and transportation sectors, disguising malicious scripts as legitimate monitoring tools.
5. Medusa Ransomware Has Affected Over 500 Critical Infrastructure Organizations
Published: 2026-08-19 / 2026-08-20
CISA, the FBI, and HHS updated their joint #StopRansomware advisory, stating that Medusa ransomware actors have impacted more than 500 victims (as of April 2026) across healthcare, defense, critical manufacturing, government, IT, financial services, and other sectors. The group rapidly exploits newly disclosed vulnerabilities (sometimes within 24 hours or even before public disclosure), uses access brokers, and employs double-extortion tactics.
6. Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Published: 2026-08-20
Google Threat Intelligence Group identified three suspected Russian cyber-espionage clusters (UNC6293, UNC7005, and UNC5976) abusing legitimate authentication flows, including Google OAuth and WhatsApp linking, in persistent phishing campaigns. Targets include individuals in academia, aerospace and defense, governments, and think tanks in Europe and the United States.
7. Critical Zimbra RCE Flaw Now Actively Exploited in Attacks
Published: 2026-08-20
CERT Polska reported active exploitation of CVE-2026-73570 (CVSS 8.9), a command-injection vulnerability in Zimbra Collaboration Suite (when the optional SNMP package is installed and notifications are enabled). Unauthenticated attackers can achieve remote code execution via crafted SMTP requests. The flaw was patched in version 10.1.20; organizations are urged to check logs and specific directories for signs of compromise.
8. Citrix Urges Admins to Patch New NetScaler Flaws Immediately
Published: 2026-08-20
Citrix released urgent updates for two vulnerabilities in NetScaler ADC and Gateway. The more severe (CVE-2026-19490) can allow unauthenticated authentication bypass under certain configurations (AAA virtual server or Gateway). A second high-severity memory-overflow issue (CVE-2026-19489) can lead to denial-of-service. Customers are strongly advised to upgrade to the recommended builds as soon as possible.
Stay Vigilant
Cyber threats continue to evolve rapidly, with supply-chain compromises, AI-assisted attacks on industrial systems, nation-state activity, and fast-moving ransomware groups remaining persistent risks. Keep systems patched, monitor for anomalous authentication and build processes, segment critical networks, and maintain strong identity controls. Subscribe for ongoing updates and review official advisories from CISA, vendor security bulletins, and trusted sources. Stay safe online!