Flock Safety mandates its Audit Assistance feature and case codes for searches after officers nationwide misused license plate readers to track people.
Flock Safety announced that all customers must adopt its Audit Assistance feature by year-end, with automatic account suspension pending review, and officers must enter case codes when searching, following a Washington Post investigation finding at least 50 law enforcement officers charged with misusing its tools. The company is also cutting license plate data retention from 30 to seven days and letting clients restrict cross-agency sharing, such as allowing missing-person searches but excluding immigration enforcement. The ACLU's Chad Marlow dismissed several measures as retreads of previously circumvented safeguards.
FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.
FortiGuard Labs has identified Evooo1Bot, a previously undocumented Linux malware based on the Mirai botnet code, which has been actively exploiting unpatched vulnerabilities in internet-facing hardware for at least a month. Targeted devices include routers and edge hardware from Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda and Telesquare, with telemetry showing activity in North and South America, Europe, India, China and Japan. Beyond Mirai's usual DDoS functions, the variant adds encrypted C2 communications, a honeypot-aware SSH scanner, a sniffer for unchanged default credentials, and abuse of the SOCKS protocol to turn compromised devices into persistent proxies for concealing origin and pivoting into internal networks.
Presidential memorandum allows vetted private companies to conduct offensive cyber operations against transnational cybercrime with advance DOJ and DHS approval.
A presidential memorandum released Wednesday lets vetted US companies partner with the Justice and Homeland Security departments on offensive operations and surveillance targeting transnational cybercrime, fraud and predatory schemes, with written pre-approval required for every operation. Operations may not cause loss of life or rise to the level of use of force or armed attack under international law. Participating firms face penalties of at least $1 million for contract violations, must disclose all contractual relationships, and face annual evaluation, while agencies have two months to develop participation standards. The move builds on a March executive order; the White House says Americans reported $20.8 billion in cyber-related losses last year.
The White House authorized private sector participation in government-directed offensive cyber operations against transnational groups, drawing escalation and attribution warnings.
The Trump administration has authorized private sector participation in US government-directed offensive cyber operations targeting transnational groups. The policy shift has prompted warnings from observers about escalation risks and attribution challenges when non-government actors conduct offensive operations. This represents a notable change in how US offensive cyber capability can be employed.
Trump signed a national security memorandum authorizing vetted private companies to conduct offensive cyber operations against transnational criminal organizations under federal oversight.
The memorandum creates a federal coordination center program authorizing 'Participating Companies' to conduct Cyber Surveillance Operations and Cyber Effects Operations against foreign cyber-enabled transnational criminal organizations. Participating firms must contract with the Justice Department or Department of Homeland Security, undergo vetting, and comply with existing laws including the Computer Fraud and Abuse Act. The White House cited sustained fraud and cyber-enabled campaigns from TCOs as justification, building on a March fraud-focused executive order. Experts including Veracode co-founder Chris Wysopal called it a major shift in U.S. cyber policy, though it stops short of broader 'hack back' proposals.
Attackers are actively exploiting critical SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) days after Rapid7 released a public PoC.
CVE-2026-55040 is a critical authentication bypass (CVSS 9.1) in SharePoint Server Subscription Edition that lets unauthenticated attackers forge JWT tokens and impersonate any user, including administrators. Microsoft patched it in July 2026 Patch Tuesday, but Rapid7 published a technical write-up and Python PoC on GitHub on August 12, and Defused quickly observed attackers running the PoC against SharePoint honeypots. KEVIntel recorded 12 exploitation attempts since July 19, with eight occurring on August 12-13 from IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the U.S. Admin-level SharePoint access exposes documents and data modification and can serve as a foothold into broader Microsoft 365 infrastructure; unpatched instances should apply the July update immediately.
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
Microsoft Threat Intelligence reports that the financially motivated, China-linked group Storm-1175 began deploying a new ransomware strain called StormEncryptor on August 2, 2026, replacing its previous Medusa ransomware. StormEncryptor is written in C++, appends the .encrypted extension to files, and drops a !!!README_FIRST!!!.txt ransom note in each scanned directory. Microsoft assesses the group is likely exploiting CVE-2026-18577, an authentication bypass in N-able disclosed on August 2, 2026 and added to CISA's Known Exploited Vulnerabilities catalog the next day. Since 2023, Storm-1175 has exploited more than 16 vulnerabilities in products including Microsoft Exchange, Ivanti, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, and GoAnywhere MFT, often moving from initial access to data theft and ransomware deployment within days.
A U.S. citizen is being prosecuted for using GrapheneOS's duress passcode to wipe his phone before border officials could search it.
Tunick entered a dedicated wipe passcode in GrapheneOS, a hardened Android alternative running on his Google Pixel, erasing the device's contents when demanded by border officials. His attorneys confirmed the software was in use, and the prosecution is proceeding even though he was not under arrest. The case raises unresolved constitutional questions about what rights apply at the U.S. border, which the government has long treated as outside U.S. soil until entry is authorized. GrapheneOS publicly asserted the feature is legal and that laws weakening its protections would be unconstitutional.
Cisco patches CVE-2026-20349, a high-severity unauthenticated DoS in ASA and FTD VPN services now added to CISA's KEV.
CVE-2026-20349 affects the Remote Access SSL VPN service in Cisco Secure Firewall ASA and FTD software, where specially crafted unauthenticated HTTP requests can cause appliances to reload, creating a denial of service. Cisco confirmed active exploitation observed in August 2026 and released hot fixes for ASA versions 9.16 through 9.24 and FTD versions 7.0 through 10.0. The flaw was added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of August 14, 2026 for US civilian federal agencies. No workarounds or indicators of compromise are available.
Trump memorandum authorizes vetted private US companies to conduct government-supervised offensive cyber operations against foreign criminal networks.
The National Security Presidential Memorandum signed August 12 lets vetted private companies run offensive cyber operations against transnational criminal organizations behind ransomware, phishing and sextortion, under US government oversight. The Homeland Security Task Force's National Coordination Center, led by DOJ and DHS executive directors, must give written approval for both Cyber Surveillance Operations and Cyber Effects Operations. Participating companies must post a $1 million bond or escrow, undergo annual review, and notify authorities if they unintentionally target US persons or systems.
Cloudflare's H1 2026 report shows record DDoS scale, with more 1 Tbps+ attacks, multi-vector campaigns, and hacktivist surges against governments.
Cloudflare's H1 2026 DDoS Threat Report documents record-scale attacks, with a significant increase in campaigns exceeding 1 Tbps and April 2026 peaking at 6.46 trillion requests and 165 PB. Most network-layer attacks stayed small and short — 96.62% under 500 Mbps and 90.60% under 10 minutes — but multi-vector campaigns combining HTTP floods with DNS and CLDAP amplification grew. Operation Epic Fury drove 149 hacktivist DDoS claims against 110 organizations in 16 countries, hitting the government sector hardest, and Brazil overtook the US as the leading attack source country.
ICE plans to spend tens of millions on Compliant Technologies' electric shock gloves, whose manual warns of possible sudden death.
According to the Associated Press, US Immigration and Customs Enforcement plans to spend tens of millions of dollars on G.L.O.V.E (Generated Low Output Voltage Emitter) gloves sold by Compliant Technologies, which pulse electrical energy to help agents subdue people. A user manual obtained by 404 Media provides details on how the devices work and notes they may contribute to sudden death.
FBI warns hackers use social engineering and password-stuffing to hijack social media accounts and sell victims' explicit content on criminal marketplaces.
The FBI issued an alert on threat actors who breach social media accounts of adults and children using password-stuffing with credentials from data leak sites, impersonation of social media support staff, and cloned login pages, in order to steal and sell explicit content. Stolen content is often posted with victims' personal information, leading to sextortion, harassment, and stalking. Related DOJ cases include a man who pleaded guilty to hacking about 600 Snapchat accounts and a former University of Michigan coach who accessed records of about 150,000 people across 100+ colleges.
Attackers actively exploit critical VMware vCenter flaw CVE-2026-59310, installing reverse_ssh backdoors on 361 hosts across 47 countries.
QUIRSO observed active exploitation of CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in VMware vCenter allowing arbitrary code execution, patched by Broadcom in late July. Attack chains deploy a malicious cron job running the open-source reverse_ssh tool for persistence, with compromised systems phoning home starting August 3, five days after disclosure. Forensics show 361 unique victim IPs in 47 countries, mostly Germany, the U.S., Turkey, Iran, and France, with the actor suspected to be an APT. Separately, Defused Cyber reports rising scanning indicative of exploitation of related CVE-2026-59309, an unauthenticated auth bypass in vmdir.
Metabase warns an actively exploited zero-day (CVE-2026-72898, CVSS 10.0) grants unauthenticated admin access; Framework, n8n, and Kilo Code disclosed data exposure.
Metabase disclosed a maximum-severity SQL injection affecting versions x.58 through x.63 that lets unauthenticated attackers inject SQL via the /api/session/reset_password endpoint and gain administrator access to Metabase instances. Metabase Cloud was attacked, patches were released, and CISA added CVE-2026-72898 to the KEV catalog with a federal remediation deadline of August 14, 2026. Downstream victims include Framework (customer names, IPs, addresses, phone numbers, and emails accessed), n8n (136 customer records, five with bcrypt-hashed passwords), and Kilo Code (Slack access tokens). Wiz estimates roughly 13% of cloud environments run self-hosted Metabase, with about 2,500 instances internet-accessible.
Fusion center bulletins reveal US law enforcement monitoring anti-Flock social media accounts and warning police ahead of the DeFlock Week of Action against license plate readers.
Public records requests by 404 Media and journalist Dan Boguslaw exposed intelligence bulletins from fusion centers in Colorado, Wisconsin, and Florida tracking anti-Flock sentiment, camera vandalism videos, and the DeFlock National Week of Action against automated license plate readers scheduled for August 16-22. The bulletins highlight Instagram accounts like Nomark.Project posting daily camera takedowns, and a device found during a June 25 traffic stop that could locate Flock cameras. Police are advised to increase patrols around ALPR locations and warned about upcoming DeFlock events, including 11 Florida cities signed up. DeFlock creator Will Freeman said the project never called for vandalism and that over 100 surveillance contracts have been canceled through civic engagement.
US and Korean agencies warn Gunra ransomware actors exploit Fortinet flaws and stealthily exfiltrate large data volumes, targeting critical infrastructure.
US and Korean authorities warned that Gunra ransomware actors exploit Fortinet vulnerabilities to gain access and use stealthy techniques to exfiltrate vast volumes of data, including from Microsoft services. The group is targeting critical infrastructure organizations. Defenders should prioritize Fortinet patching and watch for large, quiet data egress.
NIST is seeking public comment on modernizing the National Vulnerability Database to support AI-powered vulnerability research.
The US National Institute of Standards and Technology announced it is soliciting public input on modernizing the National Vulnerability Database. The initiative aims to make the NVD AI-ready to support AI-powered vulnerability research and analysis.
CISA orders federal agencies to patch exploited Windows Winsock zero-day CVE-2026-68820 by August 25, used by Lazarus in Operation Dream Job.
CISA ordered federal agencies to patch Windows Winsock vulnerability CVE-2026-68820, rated 7/10, by August 25 after confirming exploitation; no workaround exists and a restart is required. Check Point found Lazarus Group hackers impersonated Lockheed Martin and Enveil recruiters on LinkedIn, sent malicious PDFs enabling long-term remote access, then used the zero-day to escalate from limited access to full system control. Targets spanned defense sectors including surveillance, drones and robotics in France, Germany, Brazil and India, as part of Operation Dream Job tracked since 2020.
CISA, FBI, and South Korean agencies warn Gunra ransomware, with 51 victims since April 2025, exploits Fortinet flaws for double-extortion attacks on critical infrastructure.
CISA, the FBI, and South Korean agencies warned of Gunra ransomware attacks targeting healthcare, financial services, government, and professional services worldwide. The Conti-derived operation exploits internet-facing Fortinet FortiOS and FortiProxy flaws CVE-2024-55591 and CVE-2025-24472 for initial access, then deploys double extortion with Salsa20/ChaCha20 encryption and publishes non-payers on a leak site within five to seven days. Ransomware.Live lists 51 victims since April 2025, mostly in South Korea, Brazil, Spain, Thailand, and Hong Kong. The group uses Impacket tools for SMB lateral movement and NTDS credential dumping, tampers with VDI authentication to accept a designated OTP value to bypass MFA, and launched a RaaS affiliate program in January 2026 under the new alias Golden Community.
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
CloudSEK reported that two malicious LiteLLM releases on PyPI (versions 1.82.7 and 1.82.8, live about 40 minutes on March 24) harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords, with captured loot files mapping potential exposure to more than 2,500 organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The campaign is part of TeamPCP (tracked by Google as UNC6780), linked to the Aqua Security Trivy scanner compromise tracked as CVE-2026-33634 and added to CISA's Known Exploited Vulnerabilities catalog on March 26. The payload used a litellm_init.pth file executed at Python interpreter startup and exfiltrated secrets to models.litellm[.]cloud; the FBI's FLASH-20260702-01 advisory urged rotation of CI/CD, publishing, and cloud credentials.
Cisco warns actively exploited flaw CVE-2026-20349 lets unauthenticated attackers crash ASA and FTD firewalls via SSL VPN; CISA added it to KEV.
Cisco fixed CVE-2026-20349 (CVSS 8.6) in Secure Firewall ASA and FTD software, insufficient error checking in HTTP request processing that lets unauthenticated remote attackers force device reloads via crafted requests to the Remote Access SSL VPN service. Hotfixes cover ASA 9.16 through 9.24 and FTD 7.0 through 10.0, and there are no workarounds; Cisco confirmed active exploitation earlier in August but did not name the actor or targets. The flaw was found during internal security testing. CISA added it to the KEV catalog, requiring federal civilian agencies to patch by August 14, 2026.
FBI Atlanta is investigating a fake in-flight Wi-Fi hotspot attack on a Delta flight, with DEF CON attendees suspected and no arrests made.
FBI Atlanta confirmed it is investigating an attack involving a rogue Wi-Fi hotspot used against a Delta flight. The timing and technique led to speculation that DEF CON attendees were involved. No arrests have been made, and details about affected victims remain limited.
A federal judge issued a second injunction blocking Trump's executive order that would let the federal government control state mail-in ballot distribution.
US District Judge Indira Talwani issued a second injunction preventing the United States Postal Service from implementing Section 3 of President Trump's executive order on mail-in voting, finding the 23 plaintiff states likely to succeed on constitutional separation-of-powers grounds. The ruling preserves the electoral status quo ahead of the November 2026 midterms while the Trump administration petitions the US Supreme Court to review the case.
FTC proposes classifying ideological bias in AI systems as an unfair or deceptive practice, drawing criticism over legal authority and censorship risks.
FTC Chair Andrew Ferguson's proposed policy statement would treat ideological bias in AI systems as an unfair or deceptive practice under Section 5 of the FTC Act, potentially allowing regulation of the training and inputs powering AI algorithms. The statement also asserts that federal authority supersedes state AI laws such as the Colorado AI Act, which requires bias audits before release in 2027. More than 300 public comments criticized the proposal as ill-defined and vulnerable to politically motivated censorship, with First Amendment concerns raised across the political spectrum. Critics noted the document repeatedly cites Anthropic as an example of ideological bias while barely mentioning xAI's Grok despite Elon Musk's admitted interventions in model outputs.
A passenger on Delta flight 591 allegedly spoofed the airline's in-flight Wi-Fi with a rogue access point, prompting an FBI and FAA investigation.
Delta Airlines is investigating an incident on flight 591 from Las Vegas to Atlanta in which a passenger reportedly created a rogue Wi-Fi network named 'Delta WiFi Fast' to steal sensitive passenger data. The cabin crew deactivated the aircraft's Wi-Fi for roughly 30 minutes, and Delta says flight safety and aircraft operating systems were never affected. The FBI's Atlanta office and the FAA acknowledged awareness of the incident, which bears hallmarks of an evil twin attack involving spoofed login portals and credential harvesting. DEF CON organizers said this year's conference in Las Vegas also suffered multiple similar deauthentication Wi-Fi attacks.
NSA confirmed Kerianne Tobitsch, formerly a senior DHS lawyer, began as the agency's general counsel on June 15, 2026, after a year-long vacancy.
The NSA appointed Kerianne Tobitsch, previously a senior lawyer at the Department of Homeland Security and a former Jones Day partner, as general counsel effective June 15, 2026, filling a role that had been vacant for roughly a year. The role oversees lawyers who review and approve clandestine operations. The previous general counsel, April Falcon Doss, was fired in 2022 after conservative media criticism amplified on social media, and two other senior NSA lawyers retired around that time. Tobitsch is expected to play a role in upcoming congressional efforts to renew FISA Section 702, which sunset in June 2026.
'The Gentlemen' ransomware group hijacked AnMed's Facebook page, claiming theft of 6TB of sensitive patient data during an ongoing cyberattack on the hospital system.
AnMed, a nonprofit medical system with four hospitals in Georgia and South Carolina, is still responding to a July 26 cyberattack involving malware, with 10 facilities remaining closed as of Monday. On Tuesday its Facebook page displayed unauthorized posts claiming 'The Gentlemen' ransomware group exfiltrated 6 terabytes of data, including records on sexual assault, mental health, abortions and harassment; AnMed said the claims are unverified and patient data impact has not been confirmed. The Gentlemen, believed founded by a former Qilin affiliate using the moniker 'hastalamuerte,' extorted 332 victims in the first five months of 2026 per CheckPoint and claimed 125 industrial attacks in Q2 2026 per Dragos. The group typically breaches networks through edge devices, credential brute-forcing and known vulnerabilities, and offers affiliates tools to disable EDR.
Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.
Microsoft Threat Intelligence reports the DeadLock ransomware operation uses the Session messaging network and Polygon blockchain smart contracts to host victim chat, proxy server addresses, and its data leak blog, making takedowns harder. First detected in July 2025, the group has claimed 96 victims, mostly in Italy, Spain, Poland, Türkiye, and the U.S., with deployments by affiliates of Lynx and INC ransomware. The encryptor uses Curve25519 with XChaCha20, drops an interactive HTML recovery chat application, geofences CIS-linked countries, and clears logs and shadow copies to evade forensics.
ICE will pay LexisNexis millions more dollars for continued data access feeding Palantir's ELITE platform used by Enforcement and Removal Operations.
Newly published procurement records show ICE plans to pay LexisNexis millions more dollars for continued access to data that feeds Palantir's ELITE platform. The system helps ICE's Enforcement and Removal Operations identify which neighborhoods to target by combining data from private suppliers and government agencies. The news comes as ICE arrested more than 51,000 people in July, many of them at airports.
Extortion group ExfilSquad lists 13 new US, UK and Swedish victims and now distributes stolen data via peer-to-peer torrents.
ExfilSquad, a data-theft extortion collective that emerged in mid-2026, announced 13 new victims in the US, UK and Sweden with an August 5, 2026 negotiation deadline. The group skips ransomware, instead stealing data and threatening publication on a dark web leak site. Resecurity says its TTPs center on exploiting misconfigured Microsoft Dataverse, Power Pages, case management and CRM portals. The group now distributes stolen data through per-victim torrent trackers and web seeds, making leaks hard to contain.
Iran-linked hackers hit water utilities in New Jersey and Alabama, bringing confirmed US water-infrastructure attacks to at least 12 states.
Iran-linked hackers attacked the Cape May Sewer Department and Woodbine Water Department in New Jersey and the Childersburg Water, Sewer and Gas system in Alabama on July 27, bringing confirmed US water-sector attacks to at least 12 states since late July. The intrusions targeted internet-exposed industrial control systems, including Rockwell Automation PLCs, with roughly 12 hours of impact in New Jersey and no impact on water quality or service. The FBI confirmed seven affected states by July 30, and CISA has urged utilities to remove PLCs from direct internet exposure. New York announced more than $9 million in grants to strengthen water-sector cybersecurity.
NIST issued a Federal Register RFI seeking public input on overhauling the National Vulnerability Database for AI-scale, machine-consumable security data.
NIST published a request for information arguing the National Vulnerability Database must adapt as LLMs increasingly find and exploit vulnerabilities at machine scale. The RFI seeks input on integrating automation into vulnerability reporting, faster dissemination to defenders, and transparency and auditability in AI-driven decisions. It follows the White House-backed Gold Eagle clearinghouse at Treasury and the VINCE program with Carnegie Mellon's Software Engineering Institute for AI-discovered vulnerability reports.
Ransomware and cyberattacks disrupted local governments in California, Oklahoma, South Dakota, Texas and Wisconsin, taking Suisun City's 911 offline.
Suisun City, California (population 30,000) shut down its IT network after malicious software hit 911 routing, police and fire dispatch; the city declared a state of emergency and the FBI is investigating. Coweta, Oklahoma confirmed a ransomware attack affecting all computers and digital services, with off-site backups slated for restoration. Mitchell (South Dakota), Coryell County (Texas) and Washburn County (Wisconsin) also disclosed cyberattacks that shut down networks and disrupted phone and payment systems.
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile).
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
CVE-2026-81578 is an improper access control flaw (CWE-305) in the web management interface of PaperCut MF and PaperCut NG in which administrative requests from unauthenticated remote users trigger backend actions before access validation completes. An attacker can invoke administrative functions without logging in, allowing modification of certain system configurations. When chained with CVE-2026-82078 (unsafe dynamic class loading), the flaw has been used to achieve unauthenticated code execution. Any organization running PaperCut NG/MF, particularly servers whose web management interface is reachable from the internet or untrusted networks, is affected. The vulnerability was added to CISA KEV on 2026-08-31 and is being exploited in the wild as part of an AI-orchestrated campaign that compromised roughly 395–440 organizations.
Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
Google Chrome versions prior to 152.0.7977.82 contain a type confusion flaw (CWE-843) in the V8 JavaScript engine, which mishandles object types during engine operations (public proof-of-concept writeups indicate it is reachable through array sorting and WebAssembly-related code paths). A remote attacker triggers the flaw simply by getting a user to open a crafted HTML page, with no privileges or authentication required. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, and public reporting shows it being chained with Windows zero-days (the 'BlueMoon' exploit kit) by Chinese espionage groups for broader compromise. Any user of an unpatched Chrome or another build embedding the affected V8 engine is exposed. The vulnerability is a zero-day that was actively exploited in the wild before patching, was added to CISA's KEV on 2026-09-04, and has five public proof-of-concept references.
· Google Chrome prior to 152.0.7977.82 · Google Chromium V8 V8 engine versions bundled with Chrome prior to 152.0.7977.82 KEV PoC ×5mass
Actively Exploited Out-of-Bounds Write in Google Chrome V8
CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown.
· Google Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8') prior to 153.0.8010.36 KEVmass
Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)
CVE-2026-86218 is a static code injection flaw (CWE-96) in N-able's N-central on-premises remote monitoring and management (RMM) platform, carrying a maximum CVSS 4.0 score of 10.0. An unauthenticated, remote attacker triggers it by sending crafted network input to the N-central server that is improperly neutralized and persisted into application-managed code, which the server then executes — no privileges (PR:N) or user interaction (UI:N) are required. Successful exploitation yields full server compromise with high impact on confidentiality, integrity, and availability, and because N-central acts as the management hub for downstream customer endpoints, compromise can expose the entire managed estate. Any organization running an affected N-central release (before 2026.3.1.14) — primarily MSPs and corporate IT departments using N-able RMM — is affected. The flaw is confirmed exploited in the wild: N-able patched it as a zero-day, CISA added it to the KEV catalog on 2026-09-08, and it is the fourth N-central hotfix in five weeks, though no public PoC is known and ransomware use is unknown.
· N-able N-central before 2026.3.1.14 KEV PoC ×2large
Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that allows an attacker to execute unauthorized code or commands. It is triggered by sending specially crafted packets to an affected device, causing an out-of-bounds write in heap memory that can be leveraged for code execution. Successful exploitation gives attackers command execution on the appliance; in observed intrusions against FortiGate firewalls, attackers have deployed custom Node.js malware and a post-exploitation RAT dubbed PivotC2. Any organization running the affected Fortinet products is at risk, with internet-facing FortiGate firewalls the primary concern. The flaw was added to CISA's KEV on 2026-09-09, confirming active exploitation in the wild (ransomware use unknown); no public PoC is known.
· Fortinet FortiOS · Fortinet FortiSwitchManager KEV PoC mass
Unauthenticated Remote DoS in Cisco ASA/FTD SSL VPN Service
CVE-2026-20349 is a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software, caused by insufficient error checking when processing HTTP requests. An unauthenticated, remote attacker can trigger it by sending a crafted HTTP request to the SSL VPN service on an affected device. A successful exploit causes the device to reload unexpectedly, resulting in a denial-of-service condition; no credentials or user interaction are required, and confidentiality and integrity are not affected. Any organization running ASA or FTD software with the Remote Access SSL VPN service enabled is affected, especially devices whose VPN interface is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-11 and is reported as exploited in the wild, though no public proof-of-concept is known.
Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
CVE-2026-83549 is a post-authentication OS command injection flaw (CWE-78) in the Appliance Management Console (AMC) of SonicWall SMA1000 appliances. An attacker who authenticates to the AMC with administrator privileges can, under specific conditions, inject arbitrary operating system commands and achieve remote code execution on the appliance. Only organizations running SMA1000-series appliances, including the SMA 6210, SMA 7210, and SMA 8200v models cited in the data, are affected. CISA added the flaw to the KEV catalog on 2026-09-02, and news reports describe active exploitation, possibly chained with companion zero-day CVE-2026-83548, with reverse shells and cryptocurrency miners observed; no public proof-of-concept is known. EPSS assigns an 8.5% probability of exploitation within 30 days (95th percentile).
· SonicWall SMA1000 series appliances - Appliance Management Console (AMC) · SonicWall SMA 6210 (SMA1000 series firmware) KEVmoderate
Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.
· Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) as shipped with the Windows versions listed below · Microsoft Windows 10 1607, 1809, 21H2, 22H2 KEVmass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.