Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, data breaches, malware campaigns, and significant incidents reported in recent days (primarily August 6–7, 2026) to keep you informed and secure in the ever-evolving digital landscape. Black Hat USA 2026 discussions and ongoing AI-related research also feature prominently in current coverage.
1. New WordPress Pre-Auth XSS (XSS2Shell / CVE-2026-64638) Could Lead to PHP Code Execution – Patch ASAP
Published: 2026-08-07
WordPress fixed a high-severity pre-authentication reflected cross-site scripting (XSS) flaw on the login screen (CVE-2026-64638, CVSS 8.9) that affects essentially every version. Researchers (pwn.ai) showed it can be chained under certain conditions into remote code execution (nicknamed XSS2Shell) when a logged-in administrator interacts with a malicious page. An emergency update shipped in WordPress 7.0.3 (backported to 4.7).
2. Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
Published: 2026-08-07
A large cluster of nearly 800 malicious packages appeared on the npm registry as part of a campaign delivering a cross-platform downloader (WEL1DROPPER) that fetches RAT and infostealer payloads tailored to Windows, macOS, or Linux. Related supply-chain activity (including ChainDrop-style worms infecting hundreds of packages) continues to target developers for credential and secret theft.
Read more (homepage coverage) or related reporting on ChainDrop campaigns.
3. ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
Published: 2026-08-07
ClickFix-style social-engineering attacks (victims paste a command into Terminal) are delivering a Go-based macOS stealer. It profiles the host, fetches an architecture-matched payload, steals browser passwords, Apple iCloud Keychain data, cached credentials, and—most notably—slowly drains cryptocurrency wallets by siphoning funds to attacker-controlled accounts.
4. UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Published: 2026-08-07
The data-extortion group UNC6671 (previously linked to BlackFile and now operating under brands including Redact, Pink, Helix, and Falcon) is running widespread voice-phishing (vishing) campaigns. Attackers call employees on personal mobile numbers, pose as IT help-desk staff, and direct them to adversary-in-the-middle (AitM) portals to capture credentials and MFA tokens for Microsoft 365, Okta, and other SaaS platforms, primarily targeting financial services, private equity, and professional services.
5. Unlimited Technology Systems Breach Impacts 3.8 Million People
Published: 2026-08-07
Healthcare software and revenue-cycle provider Unlimited Technology Systems disclosed that a data-center intrusion (discovered in October 2025, with data accessed October 5–10, 2025) affected approximately 3.8 million individuals. Stolen information includes names, Social Security numbers, diagnoses, insurance details, medical record numbers, dates of service, and scanned IDs. It ranks among the largest healthcare-related breaches reported to HHS so far in 2026; free credit monitoring is being offered.
6. Google Chrome 151 Fixes 41 Security Flaws, Including 6 Critical Memory Bugs
Published: 2026-08-07
Google released Chrome 151 (versions 151.0.7922.108/.109 for Windows/macOS and 151.0.7922.108 for Linux), patching 41 vulnerabilities. Six are critical, mostly use-after-free issues in WebGL, Aura, Skia, Views, and an out-of-bounds write in ANGLE, which could enable crashes, memory corruption, or code execution. The update is rolling out gradually; users should update promptly.
7. Swiss Government SharePoint Servers Breached, ~200 Accounts Compromised
Published: 2026-08-06/07
Swiss federal authorities confirmed a cyberattack on SharePoint servers operated by the Federal Office for Information Technology and Telecommunication (BIT). The intrusion compromised credentials for approximately 200 accounts and is believed to have leveraged previously patched Microsoft SharePoint vulnerabilities.
8. North Carolina Ports Confirms Cyberattack Disrupting Operations + Levi Strauss Corporate Data Theft
Published: 2026-08-07
The North Carolina Ports Authority confirmed a cyberattack that disrupted IT systems and slowed operations at the Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. Separately, Levi Strauss & Co. reported that attackers used social engineering against three employees to access and steal corporate data from their machines. Additional notable activity includes a Metabase SQL-injection zero-day exploited in data-theft attacks against customer instances.
Read more – Ports Read more – Levi’s
Additional Context & Emerging Themes
- Linux kernel issues: An 18-year-old SCTP vulnerability (SCTPhantom / CVE-2026-64564) allows local privilege escalation to root and container escape; patches are available in recent stable kernels.
- Identity & access: Research demonstrated malware abusing Windows Hello for Business keys to authenticate to Microsoft Entra ID without additional PIN/biometric prompts.
- Broader trends: AI-assisted vulnerability discovery (e.g., HTTP desync techniques and Apache zero-days), ongoing ransomware/extortion activity, critical-infrastructure concerns (water utilities, ports), and supply-chain risks remain elevated. Microsoft and Apple also issued fresh security updates addressing Azure/Entra/SharePoint and authentication-bypass issues.
Stay Vigilant
Cyber threats continue to evolve rapidly, with supply-chain attacks, sophisticated social engineering (vishing + ClickFix), high-impact CMS and browser flaws, and large-scale data breaches remaining persistent risks. Prioritize timely patching (especially WordPress, Chrome, and any exposed SharePoint or TeamCity instances), enforce strong MFA and phishing-resistant authentication, monitor for anomalous SaaS/login activity, and review third-party/vendor risk. Subscribe to reliable threat feeds and consider continuous monitoring tools for critical systems. Stay safe online!