Stay updated with the latest cybersecurity news! This daily roundup covers critical infrastructure attacks, evolving malware campaigns, high-severity vulnerabilities under active exploitation, supply-chain threats, and AI-assisted offensive operations to help you stay informed and secure in the rapidly evolving digital landscape.
1. Iran-Linked Hackers Force UK Power Plant Offline for Four Days
Published: 2026-08-23
Hackers affiliated with Iran forced a small-scale UK power plant (a gas generator) offline for four consecutive days in July 2026. UK officials confirmed the incident but stressed there was never any risk to the wider energy system; the National Cyber Security Centre and Department for Energy Security and Net Zero have since briefed energy sector leaders.
2. ToxicPanda 2.0 Android Banking Trojan Expands to 349 Apps and Blocks Google Play
Published: 2026-08-23
The ToxicPanda Android malware has evolved significantly. Version 2.0 now targets 349 banking, financial, crypto, and e-wallet applications across 16 countries, supports 167 remote commands, uses VPN permissions to block Google Play Protect and updates, and abuses Accessibility Services plus wireless ADB for shell-level access and invisible PIN-harvesting overlays.
3. Supply-Chain Attack Infects Android Car Head Units for Proxy Botnet and Ad Fraud
Published: 2026-08-22
A supply-chain attack targeting Android-based automotive head units (primarily DoFun/TWCore systems) delivers multi-stage malware that turns compromised devices into residential proxy nodes or uses them for ad fraud. Kaspersky attributes the campaign (the first documented malware infection chain purpose-built for car head units) to the MoYu Group linked to the BADBOX botnet.
4. Over 9,300 Leaked AWS Access Keys Still Active and Grant Full Account Control
Published: 2026-08-21
Truffle Security research found more than 9,300 publicly exposed AWS access keys (from 2022–2026) remain valid. Hundreds are linked to companies, including root keys and IAM users with AdministratorAccess, giving attackers the ability to access, exfiltrate, or destroy data, control servers, or deploy cryptominers. Hugging Face was among the largest sources of leaked keys.
5. Microsoft Patches Maximum-Severity Entra ID, Azure Arc, and Exchange Online Flaws
Published: 2026-08-21
Microsoft released fixes for multiple maximum-severity vulnerabilities, including CVE-2026-69836 (deserialization leading to remote code execution in Entra ID) and critical unauthenticated privilege-escalation flaws in Azure Arc and Exchange Online. An earlier “exploited” flag on the Entra ID issue was later corrected to indicate it had not been exploited in the wild.
6. 14 Trojanized npm Packages Deliver RedC2 4.0 AI-Powered Linux Backdoor
Published: 2026-08-21
Researchers discovered 14 trojanized npm packages (masquerading as calendar and streak utilities) that stealthily drop RedC2 4.0, an AI-assisted Linux implant with natural-language command-and-control capabilities. The packages execute a background binary on load to deploy the RedShell beacon for surveillance and credential theft.
7. Microsoft Defender’s Own Boot-Time Driver Can Be Weaponized to Delete Security Software
Published: 2026-08-21
Check Point Research demonstrated a technique that abuses Microsoft Defender’s legitimately signed BTR.sys (Boot Time Removal Tool) driver to perform arbitrary kernel-level file and registry operations. An administrator with SeLoadDriverPrivilege can use it to delete security tools (including Defender itself) at boot without importing any external driver or exploiting a software bug.
8. Critical GitLab GraphQL Flaw (CVE-2026-19478) Exploited Within Days of Disclosure
Published: 2026-08-21 (exploitation observed shortly after Aug 17 disclosure)
GitLab patched CVE-2026-19478 (CVSS 9.4), an unauthenticated GraphQL code-injection vulnerability that allows remote attackers to modify or delete public projects and user data. WatchTowr observed in-the-wild exploitation attempts within roughly two days of public disclosure; self-managed instances should be upgraded immediately.
Bonus Highlight: AI-Generated Scripts Targeting Siemens S7 PLCs in U.S. Critical Infrastructure
Published: 2026-08-20
U.S. agencies (NSA, CISA, FBI, DOE, EPA) warned of an active threat in which attackers use AI-generated Python scripts (built with open-source libraries such as python-snap7) disguised as legitimate OT monitoring tools to target internet-exposed Siemens S7-200/300/400/1200/1500 PLCs across energy, water, manufacturing, and other critical sectors.
Stay Vigilant
Cyber threats continue to evolve rapidly, with nation-state actors hitting physical infrastructure, AI accelerating both offense and defense, and supply-chain and cloud credential exposures remaining high-impact risks. Subscribe for ongoing daily or weekly updates, prioritize patching of internet-facing systems (especially GitLab, industrial controllers, and identity platforms), rotate exposed cloud keys, and maintain strong monitoring of Android devices and automotive systems. Stay safe online!