42
42
57
42
42
57
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Compromised maintainer account published malicious versions of popular Rust crates with 245M downloads, delivering a build-time payload via typosquatted proc-macro1 dependency.
The Rust Project deleted malicious releases of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io after a compromised maintainer account added a typosquatted dependency, proc-macro1, whose build script downloaded and executed a remote payload during compilation. Each malicious version was online for 86 to 107 minutes on August 20, 2026, before deletion. The build script disabled TLS validation and deployed OS-specific implants on Unix, macOS, and Windows, with builds alone sufficient to trigger execution. Wiz Research confirmed active exploitation, noting the impacted packages appear in 35% of cloud and code environments and over 75% of Rust-using environments; arrayref alone has 245 million all-time downloads and 403 dependent crates.
82
57
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
68
47
42
47
42
57
57
42
42
42
CVE-2026-34908: Ubiquiti Networks UniFi OS Server access control ...
CVE-2026-34908, a CVSS 10.0 access-control bypass in Ubiquiti UniFi OS, was added to CISA's KEV catalog amid reported active exploitation.
CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog on June 23, 2026, with remediation due June 26 under BOD 26-04 guidance. The CVSS 10.0 improper access control flaw (CWE-284) in Ubiquiti UniFi OS allows unauthorized system changes without authentication. Multiple news reports referenced by the page describe the max-severity UniFi flaws being exploited in attacks, and an official patch is available.
68
57
Risky Bulletin: BEC campaign steals €35 million from French notaries
Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.
A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.
72
42
57
57
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Malicious .git core.fsmonitor configs let attacker code run in AI coding agents like Claude Code and Codex; four of eight flaws remain unpatched.
Manifold Security disclosed eight flaws across seven command-line AI coding agents where a repository's Git core.fsmonitor configuration causes agent-spawned commands to execute attacker code outside the sandbox and without approval prompts. Fixes shipped for goose (CVE-2026-72718, CVSS 4.0 score 7.0), Claude Code on one path, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path were still unpatched as of September 1. OpenAI issued three CVEs for the same class in Codex, including CVE-2026-19592, and prior related bugs include CVE-2021-43891 in Visual Studio Code and CVE-2022-24346 in JetBrains IDEs. Exploitation requires the repository to arrive with its .git directory intact, such as via archives, shared drives, or USB sticks rather than an ordinary clone.
68
57
57
47
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).
Vercel patched two critical Next.js flaws enabling unauthenticated remote code execution: a heap buffer overflow in libheif's AVIF image scaling (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) and a Windows path traversal (CVE-2026-75604, CVSS 9.0). The AVIF flaw affects only sites explicitly enabling AVIF optimization and overwrites roughly 16,384 bytes past the buffer; the path traversal affects Windows-hosted Next.js deployments on versions 13.4-15.5.23 and 16.0-16.3.2. Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026, with the AVIF researchers releasing a Python PoC demonstrating RCE on multiple applications. No exploitation had been reported as of August 27, 2026.
68
60
60
Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.
55
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.
Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.
72
57
42
42
57
47
42
57