Editor's note · James Webb. Five entries in the exploited catalogue in two days, and three of them are stories this issue would have carried anyway. The catalogue used to lag the coverage by weeks. When it moves at the speed of the trade press it stops being a confirmation and becomes a deadline, which is a different thing to plan around.

The entry I would not have predicted is Ray. It schedules training and inference jobs, and it now sits on the same list as vCenter and SharePoint. The argument about model safety assumes the model is the interesting target. The scheduler underneath it is an ordinary internet-facing service with an ordinary code-injection flaw, and that is the part being exploited.

🔍 The find this week: StepSecurity's read of the CloudSEK disclosure. Team PCP took 78,330 secrets from 2,186 organisations through CI/CD pipelines, and the list of who was affected is now public. Two thousand names is a list you can look yourself up in, which is rarer than it should be.

The patch was the starting gun

Issue 3 · 19 August 2026 · about 9 minutes to read

Overview

Nothing this week was novel. What changed is the interval between a fix being published and the first attempt against it, and the first entry of the week was Ray, the framework that schedules AI training and inference jobs, now listed beside vCenter and SharePoint as ordinary exploited infrastructure.

• The catalogue caught up in two days. CISA added Ray on Monday, then Microsoft IKE, SharePoint, VMware vCenter, and Apple macOS on Tuesday. Three of those four are separate items below, so the federal deadline and this issue are describing the same events.
• The gap is now measured in days. SAP Commerce Cloud, rated 10.0, drew exploitation attempts three days after its patch. SharePoint waited for Rapid7 to publish working code. The GeoServer flaw under attack has no patch at all.
• Patching is not eviction. vCenter intrusions leave a reverse SSH tool behind, and one campaign carries ransomware derived from Babuk. The update closes a door on a room somebody is already in.

What mattered

Act now · 6 items

CISA adds Ray, vCenter, SharePoint, and macOS to KEV

Act now · Confirmed · Score 63.8 · cyber · CISA Alerts, CISA Cybersecurity Advisories, The Hacker News (thehackernews.com)

CISA listed a code-injection flaw in Ray, the distributed computing framework used to scale AI and machine learning workloads, on 17 August as CVE-2025-62593. Four more followed the next day: Microsoft IKE (CVE-2026-33824), SharePoint (CVE-2026-55040), VMware vCenter (CVE-2026-59310), and Apple macOS (CVE-2026-65400).

What it changes. Three of those five are separate items in this issue, which is the point: the catalogue is confirming within a day what the coverage reported in the same week. Federal agencies inherit a deadline under BOD 26-04, and everyone else inherits the evidence that exploitation is real.

Macs on the internet are being logged in without a password

Act now · Highly likely · Score 61.4 · cyber · BleepingComputer, Ars Technica, The Hacker News (thehackernews.com), SecurityWeek (+1 more)

The Netherlands National Cyber Security Centre warns that attackers are exploiting CVE-2026-65400, an authentication flaw in the macOS Screen Sharing component rated 9.8, after exploit code became public. Reported intrusions take root and install a Monero miner.

What it changes. A cryptocurrency miner is the cheapest thing an attacker can do with root on a Mac, so read it as a census rather than as the damage. What is being counted is Macs reachable from the internet on the screen sharing port, a configuration most organisations believe they do not have.

vCenter attacks leave persistence a patch will not remove

Act now · Highly likely · Score 59.8 · cyber · The Hacker News (thehackernews.com), BleepingComputer, Dark Reading

Attackers are exploiting CVE-2026-59310, a directory-traversal flaw in VMware vCenter rated 9.8, to install a reverse SSH tool for remote access. Exploitation began earlier this month, and one campaign is attributed to a suspected China-nexus group deploying ransomware derived from Babuk.

What it changes. The hypervisor control plane holds every virtual machine in the estate, so the tool left behind matters more than the flaw that delivered it. Anyone who patched vCenter this month and closed the ticket now has a hunt to run instead.

Lazarus used the August Windows zero-day on defence firms

Act now · Highly likely · Score 59.8 · cyber · SecurityWeek, BleepingComputer, The Hacker News (thehackernews.com)

Check Point attributes zero-day exploitation of CVE-2026-68820 to Lazarus, the North Korean group behind Operation Dream Job. The flaw gives SYSTEM access, and the campaign delivered a previously unseen backdoor named ForestTiger to defence and aerospace companies in France, Germany, Brazil, and India.

What it changes. This is the same identifier Microsoft patched at August's Patch Tuesday and issue 02 carried as one flaw already in use. The attribution arrives a week later and names the targets, so the sectors listed should treat the August update as an incident trigger rather than as routine maintenance.

A 10.0-rated SAP flaw drew attacks three days after the fix

Act now · Highly likely · Score 59.8 · cyber · The Hacker News (thehackernews.com), BleepingComputer, SecurityWeek

SAP patched CVE-2026-58231, rated 10.0, in the Commerce Cloud Data Hub Adapter. It lets an unauthenticated attacker abuse a default authentication client and run arbitrary code. Threat intelligence firm Defused recorded exploitation attempts three days after disclosure.

What it changes. Three days is shorter than the change window most organisations run for a commerce platform, so the question is what to do during the gap rather than whether to patch. An allow list in front of the Data Hub Adapter answers it until the update lands.

A Cisco firewall flaw is being used to drop VPN service

Act now · Likely · Score 58.9 · cyber · The Hacker News (thehackernews.com), WaterISAC

Cisco says CVE-2026-20349, rated 8.6, has been exploited in the wild. It is insufficient error checking when Secure Firewall ASA and FTD software processes HTTP requests, and an unauthenticated remote attacker can use it to take the remote-access VPN down. WaterISAC circulated a notification to utility members.

What it changes. Denial of service against the VPN concentrator is an availability problem for staff and a visibility problem for defenders, because the appliance that restarts is also the one holding the session records. Water utilities were told first, which says something about who runs these boxes at the edge.

Also this week

Attacking the agents themselves

• Replayed reasoning blocks gave up keys and passwords. Researchers found that the encrypted reasoning objects OpenAI, Anthropic, and Google carry between API calls could be replayed into a different session. Recovered material included internal reasoning and, during testing, API keys and passwords held in session logs.

Machines on defence

• Google puts agents on source code review after leaks. Google Threat Intelligence describes an agentic source-code review pipeline built for the case where proprietary code has been stolen, combining structured analysis, enforced sceptical validation steps, and human domain expertise.

Risk with a body

• A survey maps where attacks enter embodied agents. A new survey organises threats to foundation-model-powered embodied agents by where an adversary first enters the control loop rather than by technique, and covers attack surfaces, defences, and evaluation.

Industrial and critical infrastructure

• Dirty Frag reaches Hitachi Energy asset monitoring. CISA published an advisory for Hitachi Energy APM Edge versions 6.10 and earlier, affected by the Dirty Frag vulnerabilities, with impact on confidentiality, integrity, and availability. The vendor lists recommended immediate actions.

Ordinary exploitation that still matters

• SharePoint attacks followed the public proof of concept. Attackers began exploiting CVE-2026-55040, an authentication bypass in Microsoft SharePoint rated 9.1, after Rapid7 published proof-of-concept code. Microsoft shipped the fix in its July Patch Tuesday, and CISA added the flaw to the exploited catalogue this week.
• A shipping provider leaked 14,000 hardware wallet owners. Trezor says nearly 14,000 customers had names, addresses, email addresses, and phone numbers taken in a breach at ShipMonk, its logistics provider. Separately, more than 1,000 charities were exposed through Beacon CRM after an AWS access key was found in public JavaScript build artefacts.
• A WordPress form plugin accepts PHP uploads from anyone. Forminator Forms carries CVE-2026-15748, rated 9.8, an arbitrary file upload that lets an unauthenticated attacker place an executable file on the server. The plugin reports more than 600,000 active installations, and SecurityWeek puts the exposed count at about 300,000.
• A seller claims 3.6 million records from Azure tenants. A threat actor is advertising employee databases said to come from the Microsoft Azure environments of McDonald's, TCS, Vodafone, and other large companies, claiming 3.6 million records obtained with compromised credentials.
• One control panel ran both espionage and crypto theft. Researchers describe Jewelbug, a China-linked group running government and military espionage alongside cryptocurrency fraud, both administered from XG-Web, a browser-centred remote access and information-stealing framework.
• A published Defender zero-day gives SYSTEM from any account. A researcher released proof-of-concept code for ShieldBreak, an unpatched flaw in Microsoft Defender that grants SYSTEM privileges from an ordinary user account. It bypasses the fix for CVE-2026-50656, and Kevin Beaumont reports the code works on current Windows 11.
• A GitLab flaw lets strangers delete public projects. GitLab patched CVE-2026-19478, rated 9.4, which under certain conditions lets an unauthenticated attacker modify or delete public projects and user data. Dark Reading reports that the sparse technical detail makes exploitation hard to detect on self-managed instances.
• An unpatched GeoServer SQL injection is under attack. watchTowr reports exploitation attempts against a GeoServer zero-day disclosed on 12 August with no CVE identifier and no fix. The flaw is an SQL injection in the open-source mapping platform that can lead to remote code execution.
• Ransomware crews picked up an April Windows flaw. CISA says ransomware operators are now exploiting a high-severity Windows Task Host vulnerability that it flagged as actively exploited in April.
• watchTowr reports pre-auth RCE in Citrix NetScaler SAML. A single post from Kevin Beaumont points to watchTowr research claiming pre-authentication remote code execution through one of the Citrix NetScaler SAML vulnerabilities, tracked as CVE-2026-8452.
• GE and Philips are checking Clop's data theft claims. General Electric and Philips say they are investigating claims by the Clop ransomware group that it breached their systems and took data. Neither company has confirmed a breach, the claim comes from the group's own leak listing, and BleepingComputer is the only source carrying it.

Rules and enforcement

• The White House opens offensive operations to private firms. A presidential memorandum directs the National Cyber Council to establish a programme under which private companies can apply for approval to carry out offensive cyber operations against transnational cybercrime groups.
• NIST asks how to rebuild the NVD for machine consumers. NIST published a request for information on modernising the National Vulnerability Database for machine-consumable security data and AI-assisted analysis. Socket reports an unreleased internal tool called V-etalon, disclosed after years of automation plans produced no public enrichment system.

From the research frontier

• Three papers on where agentic assistants break. This week's research batch: a survey of vulnerabilities in agentic large language models that hold real privileges, a benchmark for assistants that must gather personal information scattered across mobile apps, and a consistency measure for telling a stable answer from pattern matching.

This week's focus

CISO. Ask for the count of internet-facing systems in this issue that you own: vCenter, SAP Commerce Cloud, Cisco ASA, macOS Screen Sharing, and GeoServer. The answer should be a number produced from an inventory, not an assurance. →

Vulnerability management. Work the five catalogue additions of 17 and 18 August as this week's queue, and search vCenter for the reverse SSH tool before closing the ticket. The patch does not remove what is already resident. →

Platform engineering. Put an allow list in front of the SAP Commerce Cloud Data Hub Adapter, or take it off the internet until the update lands. Attempts arrived three days after the patch, which is shorter than the change window most commerce platforms run. →

What we deliberately left out

Things that got attention elsewhere but did not, on inspection, change anything:

• AI 'watermark removers' flood the web. Almost none can prove they work.: carried by 3 outlets, with no new technical detail and no change in exposure.
• AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS: carried by 3 outlets, with no new technical detail and no change in exposure.
• Flock is tightening its rules in response to a growing surveillance backlash: carried by 3 outlets, with no new technical detail and no change in exposure.

Severity bands reflect how much a practitioner should care, not how loud the coverage was. Confidence follows standard intelligence language: confirmed, highly likely, likely, possible, unsubstantiated.