🔴 SAP Commerce Cloud RCE exploited in wild 3 days after patch, 🛡️ Defender ShieldBreak bypasses July fix to SYSTEM, 🎯 Clop steals 89GB from Shell via PLM flaw, ⚠️ macOS Screen Sharing root access for Monero miners, 💥 ExfilSquad leaks 382GB of D365 data from 13 orgs, 🔗 ChainDrop npm worm turns IDE configs into droppers

Active exploitation of SAP Commerce Cloud's CVE-2026-58231 is now confirmed in honeypot telemetry, just three days after the July patch dropped. The CVSS 10.0 flaw lets unauthenticated attackers execute arbitrary code remotely, and Defused researchers say threat actors reverse-engineered the patch to identify the vulnerable code path before any public proof-of-concept existed. This marks the fastest documented transition from SAP disclosure to exploitation this year, so organizations running Commerce Cloud storefronts should treat this as an emergency patch cycle. SAP July 2026 Security Updates

Microsoft's July fix for the Defender RoguePlanet privilege escalation (CVE-2026-50656) did not hold. Security researcher Nightmare Eclipse released ShieldBreak, a proof-of-concept that achieves SYSTEM on fully patched Windows 11 25H2 and Server 2025 by exploiting a race condition in mpengine.dll that the patch left intact. The exploit requires only Defender enabled and a standard user account, and Microsoft says it is actively investigating with no patch timeline. This is the tenth entry in Nightmare Eclipse's 2026 series against Microsoft products, and the first to defeat a patch built specifically to stop them. Microsoft Defender ShieldBreak zero-day

Clop has listed Shell on its leak site claiming 89GB of stolen engineering drawings, facility photographs, and project roadmaps, exploiting CVE-2026-12569 in PTC Windchill and FlexPLM industrial product lifecycle management systems. The same campaign also targeted General Electric and Philips, with Clop claiming backups, system files, and blueprints from both companies. Shell confirmed it is investigating a potential incident and working with security specialists, but the targeting of PLM systems that store manufacturing intellectual property makes this a national security concern beyond the energy sector. Shell investigates Clop data theft claims

The Netherlands' NCSC confirmed active exploitation of CVE-2026-65400, a macOS Screen Sharing authentication bypass that grants network-based attackers VNC access without valid credentials. In all observed cases, attackers gained root access and deployed Monero miners on internet-facing Macs with Screen Sharing enabled. Apple patched the vulnerability on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, but unpatched systems remain exposed. macOS Screen Sharing flaw exploitation

The Azure exfiltration campaign tracked as TheHatman expanded its victim disclosures, with new forum posts naming McDonald's (1.7 million employee records), Vodafone, Tata Consultancy Services, HCL Technologies, Kyndryl, Gap Inc., and InterContinental Hotels Group. The data consists of internal directory exports pulled from compromised Azure and Entra ID tenants using stolen credentials, not platform vulnerabilities. Organizations should audit Azure AD sign-in logs for anomalous bulk export activity and enforce conditional access policies limiting data retrieval. Azure exfiltration campaign

ExfilSquad, a data-extortion group that first appeared in late July, leaked 382GB of data from 13 organizations running Microsoft Dynamics 365 CRM and ERP, containing roughly 27 million records. Fortra researchers assessed the breach stems from misconfigured Power Pages portals that left Dataverse tables publicly readable, not from a Dynamics 365 software vulnerability. The attack bypasses all network-level defenses because the access path is through the SaaS portal layer, so organizations using Power Pages should audit portal permissions and verify that Dataverse tables are not exposed to anonymous access. ExfilSquad leaks D365 data

SafePal disclosed a data breach affecting about 39,798 customers after an order-tracking flaw was exploited to steal names, email addresses, shipping addresses, phone numbers, and purchase details for orders placed between March 2025 and April 2026. The cryptocurrency hardware wallet maker says wallet seed phrases, private keys, and payment card numbers were not exposed, but the contact data is already circulating on cybercrime forums and customers have reported phishing emails and phone calls dating back to May. SafePal data breach

The ChainDrop npm supply-chain worm has compromised 444 packages and over 1,300 versions by hijacking GitHub Actions OIDC tokens to generate valid SLSA provenance attestations for poisoned releases. The worm injected payloads into IDE configuration files (.claude/settings.json and .vscode/tasks.json), turning developer tooling into a dropper that executes when a project folder is opened, without running npm install. This undermines the trust model of supply-chain defenses that assume the install step is the critical action. ChainDrop npm worm

HoneyMyte (Mustang Panda) upgraded its CoolClient backdoor with a signed Windows kernel-mode rootkit that hooks the Nsiproxy driver to hide command-and-control infrastructure from endpoint detection. The campaign targets government and intelligence entities across Myanmar, Mongolia, Pakistan, and Russia, using PlugX as a first-stage implant before deploying CoolClient. The signed driver gives the malware a trust anchor that survives certificate revocation, moving evasion below the user-mode layer where most endpoint inspection operates. HoneyMyte CoolClient kernel rootkit

An Akira ransomware affiliate exploited missing MFA on a SonicWall SSL VPN to gain initial access on August 4, then forced the compromised system into Safe Mode with Networking to disable EDR and antivirus protections for roughly ten minutes. The SOC Fortress case study marks the first documented Akira use of the Safe Mode boot trick as an anti-EDR weapon, shifting from the group's usual practice of running encryptors from clean virtual machines. Even when encryption later failed on virtual-memory errors, the attacker had already exfiltrated data and harvested credentials, preserving leverage. Akira Safe Mode EDR bypass

France's Ministry of Economy and Finance confirmed a breach of the General Directorate of Public Finances (DGFiP) affecting 678,000 individuals, after a threat actor using the handle "ZeroBytes" listed a stolen database for sale on PwnForums on August 12. The exposed data includes reference tax income, family quotient, withholding tax rates, and for businesses, company names and SIREN numbers. The DGFiP notified CNIL and is working with ANSSI, but the tax data gives attackers precisely the material needed for convincing phishing and identity theft campaigns. French tax authority breach

Watchlist: prioritize SAP Commerce Cloud patching for CVE-2026-58231 given active exploitation with no public PoC, monitor for ShieldBreak follow-on activity until Microsoft issues a fix, audit Power Pages portal permissions for anonymous Dataverse exposure, and verify Screen Sharing is disabled on internet-facing Mac systems.