57
42
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
42
57
57
60
57
57
57
57
57
42
Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation
Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.
Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents threat actors operationalizing agentic AI: in one Mandiant investigation, a financially motivated actor built and executed a credential-harvesting operation in under six hours, with an exposed 'Recon' framework managing more than 23,800 harvested secrets including cloud and AI-service API keys. A Chinese-speaking actor tracked as knaithe used a DeepSeek-powered Hermes Agent for automated reconnaissance and vulnerability enumeration, pivoting from Langflow to n8n and enabling manual exploitation of exposed Citrix NetScaler, Marimo, Apache Tomcat, and VPN infrastructure. Operators harvested Citrix session cookies from process memory to bypass MFA, obtained AWS credentials from compromised Marimo instances, and deployed the Go-based NKAbuse backdoor, with reported RCE and data exfiltration. Google notes fully autonomous end-to-end AI attack pipelines have not yet been observed in the wild.
72
Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch
Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.
Cisco released fixes for seven internally discovered vulnerabilities in IOS XR, its Linux-based network operating system for carrier-grade routers. Two flaws, CVE-2026-20274 and CVE-2026-20279, are rated CVSS 9.8 (critical) and involve lifetime resource control issues that can enable unauthenticated remote code execution with root access; the other five are rated 8.2-8.8 and cover buffer overflows, access control failures, and out-of-bounds access. All IOS XR releases including IOS XR7 are affected regardless of configuration, no workarounds exist, and remediation requires software maintenance upgrades (SMUs) or fixed releases 26.2.2/26.3.1. Cisco says the flaws are not known to be actively exploited, but experts urge immediate patching of internet-facing and core routing systems, citing parallels with Salt Typhoon tradecraft.
68
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.
Check Point attributes Operation Dream Job attacks to Lazarus Group exploiting CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in Windows AFD.sys patched in August 2026 Patch Tuesday. The campaign targets defense and aerospace firms in France, Germany, Brazil, and India via trojanized PDF viewers and DLL side-loading, deploying backdoors Troy, ForestTiger, and the FudModule 3.1 kernel rootkit. Attackers also compromise WordPress, SharePoint, and Roundcube servers as C2, using CVE-2025-49113 and the RelayShell PHP web shell.
78
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
Cisco warns actively exploited flaw CVE-2026-20349 lets unauthenticated attackers crash ASA and FTD firewalls via SSL VPN; CISA added it to KEV.
Cisco fixed CVE-2026-20349 (CVSS 8.6) in Secure Firewall ASA and FTD software, insufficient error checking in HTTP request processing that lets unauthenticated remote attackers force device reloads via crafted requests to the Remote Access SSL VPN service. Hotfixes cover ASA 9.16 through 9.24 and FTD 7.0 through 10.0, and there are no workarounds; Cisco confirmed active exploitation earlier in August but did not name the actor or targets. The flaw was found during internal security testing. CISA added it to the KEV catalog, requiring federal civilian agencies to patch by August 14, 2026.
72
42
57
57
42
42
42
42