45
60
50
60
60
60
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.
CVE-2026-5430 (CVSS 9.8-10.0), an improper cryptographic signature verification flaw in WSO2 API Manager, lets JWT authentication be bypassed with unsupported algorithms, enabling administrative account takeover. watchTowr honeypots captured forged JWT tokens with baked-in administrator privileges on September 13, 2026, which could expose API credentials, consumer keys, and secrets for every registered application. Affected products include WSO2 API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Fixes are available via GitHub pull requests and subscription update levels, and users are urged to patch immediately.
78
Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor
Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.
Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.
78
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut shipped maintenance releases replacing emergency patches for two actively exploited flaws abused in AI-assisted attacks on 395 organizations.
PaperCut released PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10, superseding Emergency Patch Releases 1-3 for CVE-2026-81578 and CVE-2026-82078, which enable authentication bypass and arbitrary code execution on susceptible instances. GreyNoise and Blackpoint Cyber reported a suspected Russian-speaking actor weaponizing both flaws against at least 395 organizations in 48 countries, concentrated in the U.S. education sector. The campaign used hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model, originating from IP 45.142.193.132, and avoided organizations in Russia, China, Hong Kong, Thailand and Iran.
78
Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks
Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.
Proofpoint identified a new exploit kit dubbed BlueMoon chaining a Chromium V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel LPE (CVE-2026-85880). At least four distinct threat clusters, most with suspected China nexus, adopted the kit within days starting with TA412 (Violet Typhoon/APT31) on August 28, 2026. Both Chrome-side flaws were patch-gap zero-days with roughly a four-week exploitation window; the Windows LPE only works on Windows 10 and Server 2019/2022. TA412 used spearphishing posing as university interns to deliver the GemStone browser backdoor disguised as a Google Gemini extension; other clusters delivered ShadowPad via DLL sideloading and a Rust loader against targets in aerospace, government, and finance.
86
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.
Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.
82
Researcher Publishes CrowdStrike Privilege Escalation Zero Day
Researcher NightmareEclipse published FalconFlank, a zero-day local privilege escalation in CrowdStrike Falcon Sensor abusing its Office malicious macro remediation feature.
A researcher known as Nightmare Eclipse published details of FalconFlank, a zero-day privilege escalation that abuses the Microsoft Office malicious macro removal feature in CrowdStrike Falcon Sensor, verified working on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike urged customers to disable the Office File Suspicious Macro Removal policy while it investigates, noting customers remain protected via Cloud Anti-malware for Microsoft Office Files; no CVE has been assigned. The same researcher previously released the Exploitarium dump of over 30 PoC exploits, and researcher Kevin Beaumont confirmed FalconFlank works.
62
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
Google patches actively exploited Chrome V8 zero-day CVE-2026-85046 (CVSS 8.8); CISA adds it to KEV with a September 18 deadline.
Google fixed 12 Chrome vulnerabilities, including CVE-2026-85046, a high-severity (CVSS 8.8) type confusion bug in the V8 JavaScript and WebAssembly engine. The flaw, reported by researcher Salvatore Gulizia on August 4, 2026, allows remote arbitrary code execution inside the browser sandbox via a crafted HTML page. Google confirmed the exploit exists in the wild, and CISA added the CVE to its KEV catalog, requiring Federal Civilian Executive Branch agencies to patch by September 18, 2026. This is the sixth actively exploited Chrome zero-day patched in 2026.
88
Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC
Researcher Nightmare Eclipse released a PoC for FalconFlank, a privilege escalation zero-day in CrowdStrike Falcon's Office macro remediation feature.
Researcher Nightmare Eclipse published a zero-day PoC dubbed FalconFlank targeting CrowdStrike Falcon's Microsoft Office malicious macro removal feature, achieving privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 with Optimal Protection and macro removal enabled. Kevin Beaumont independently confirmed the exploit works. The same researcher also released HardBreacher, an elevation-of-privilege bug in Kaspersky Endpoint (since fixed via update), PrettyPrague, an Avast Sandbox flaw that dumps the SAM database for a SYSTEM shell (Gen Digital is developing a patch), and GreenSection, an Nvidia memory corruption bug that crashes systems. CrowdStrike advises customers to disable the Suspicious Macro Removal Windows policy while it investigates.
55
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.
CISA added CVE-2026-65400 (macOS Screen Sharing, CVSS 9.8), CVE-2026-55040 (SharePoint, CVSS 9.1), CVE-2026-59310 (VMware vCenter, CVSS 9.8) and CVE-2026-33824 (Microsoft IKE Service Extensions, CVSS 9.8) to the KEV catalog. The macOS flaw was abused to deliver a Monero miner, while the vCenter bug was exploited by a suspected China-nexus APT to install reverse_ssh backdoors and Babuk-derived ransomware across 361 victim IPs in 47 countries. Unit 42 linked CVE-2026-33824 to a Chinese-speaking actor running an AI-enabled campaign using DeepSeek. FCEB agencies must patch by August 21, 2026 under BOD 26-04.
86
Apple macOS Screen Sharing Flaw Exploited on Internet
Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.
NCSC-NL reported active exploitation of CVE-2026-65400 (CVSS 9.8), an authentication flaw in macOS Screen Sharing patched on August 6, 2026, with root access gained and a Monero miner planted on internet-exposed systems using port 5900. Related Screen Sharing bugs CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760 were fixed in macOS Tahoe 26.6, and researcher @osxreverser noted a pre-auth flaw fixed alongside them affecting roughly 40,000 exposed hosts. Calif said an AI agent produced working exploits for both pre-auth bugs in four hours, underscoring the shrinking gap between patch release and weaponization.
82
Cyberattack forces UT San Antonio to delay start of fall semester
UT San Antonio delayed fall semester start by three days after a weekend cyberattack was caught at the network edge before core systems.
The University of Texas at San Antonio, which serves more than 42,000 students, moved its fall semester start from August 19 to August 24 after a weekend cyberattack on its academic network. Officials said the intrusion attempt was caught at the edge of the network before reaching core systems and that no evidence of data theft has been found. The university took systems and services offline for review, causing phone system outages and password reset tool delays. The incident follows the Instructure Canvas breach during spring finals week that exposed data tied to millions of students and staff worldwide.
60
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Attackers exploit SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) after Rapid7's PoC release, with 12 exploitation attempts recorded since July 19, 2026.
Microsoft patched CVE-2026-55040 in its July 2026 Patch Tuesday; the 9.1-severity flaw chains four weaknesses in SharePoint's JWT token validation pipeline, letting unauthenticated attackers forge valid JWTs and impersonate any SharePoint site user or administrator. Threat actors began exploiting the bug after Rapid7 released a Python PoC that forges tokens and enumerates domain users by SID. KEVIntel telemetry shows 12 exploitation attempts since July 19, 2026, eight of them on August 12-13 following the PoC release, originating from eight IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. This is the fifth SharePoint vulnerability exploited this year, alongside CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.
78
60
60
60
60
60
60
60
60
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild
60
60
60
60
60
60
60
60
60
60
57
60
60
60