Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.
Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.
- Reco tracks 'City-Forum' campaign reading Salesforce and ServiceNow portals worldwide for 17 months
- Framework suffered a breach via an exploited Metabase zero-day exposing customer contact data
- Microsoft's August 2026 Patch Tuesday fixes 400+ flaws, including exploited zero-day CVE-2026-68820
- Cisco patched exploited firewall DoS bug CVE-2026-20349, added to CISA's KEV catalog
- GitHub Dependabot malware alerts now cover eight package ecosystems beyond npm
- Victims
- Framework
- Organizations
- RecoPicus LabsNanyang Technological University
- Countries
- United StatesEuropean Union
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18577 | Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch) | 8.2 | 15% | KEV | KEV |
| CVE-2026-20349 | Unauthenticated Remote DoS in Cisco ASA/FTD SSL VPN Service | 8.6 | 1% | KEVPoC | KEV |
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
From the original article
12 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: GitHub has flagged npm malware since March 2026. Anyone pulling in a bad PyPI, Maven, RubyGems, NuGet, Go, crates. io, or PHP Composer package has had no such warning, because GitHub’s malware detection only ever watched one ecosystem.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.