🔴 Clop builds custom Windchill web shell for IP theft, 🛡️ CISA vCenter KEV deadline Aug 21, 📋 Oracle patches 925 CVEs in 943-fix CSPU, ⚠️ Microsoft Patch Tuesday 398 CVEs + AFD.sys zero-day, 🔐 BeyondTrust EPM privilege escalation flaws, 🎯 StopAndProtect weaponizes thousands of WordPress sites

Clop ransomware operators built a purpose-built Java web shell tailored to PTC Windchill's internal APIs, database schema, and file-vault structure to exploit CVE-2026-12569 (CVSS 9.3), and Shell, General Electric, and Philips are now confirmed investigating the campaign. ReliaQuest analysis found the implant is not a generic web shell repurposed for the campaign but was engineered with deep knowledge of Windchill's credential storage, file-vault enumeration, and data exfiltration paths, giving Clop a single tool that can decrypt stored credentials, enumerate engineering repositories, and steal files without additional attacker infrastructure. The targeting of PLM systems that store manufacturing intellectual property elevates this beyond a typical file-transfer exploitation campaign. Clop Created Custom Web Shell for Windchill Data Theft Attacks

CISA added CVE-2026-59310 to the Known Exploited Vulnerabilities catalog on August 18 with an accelerated remediation deadline of August 21, confirming active exploitation of the VMware vCenter path traversal flaw in real-world environments. A remote attacker with network access can execute arbitrary code on the vCenter host through the Syslog Server component, and a compromised vCenter gives an adversary control over virtual machine configurations, the ability to deploy malicious VMs, and lateral movement across the entire virtual infrastructure. Organizations running VMware vCenter should apply the patch immediately; if patching cannot meet the August 21 deadline, network segmentation and restricting access to the management interface are minimum interim controls. CISA Adds VMware vCenter Path Traversal CVE-2026-59310 to KEV

CISA, FBI, and HHS published an updated joint advisory on Medusa ransomware, revealing the gang has impacted over 500 critical infrastructure victims since June 2021, with hundreds added in the past year alone. The advisory details Medusa's reliance on access brokers who receive $100 to $1 million per entry, with premium pricing for exclusive partnerships, and covers sectors including healthcare, defense industrial base, critical manufacturing, government services, IT, and financial services. CISA: Medusa Ransomware Hit Over 500 Critical Infrastructure Orgs

Oracle released its August 2026 Critical Security Patch Update on August 18, addressing 925 unique CVEs across 943 patches spanning 23 product families, with 154 patches carrying a critical severity rating. Fusion Middleware alone accounts for 262 patches, making it the single most heavily patched product family, and WebLogic Server, Hyperion, and Fusion Middleware services contain remotely exploitable vulnerabilities that could compromise sensitive business systems. The scale is notable: this between-cycle CSPU nearly quadruples the June 2026 CSPU's patch volume and exceeds the entire April 2026 quarterly CPU. Oracle August 2026 Monthly CSPU Patches 925 CVEs, 154 Critical

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs across Windows, Office, SharePoint, Azure, Exchange Server, .NET, PowerShell, and Visual Studio Code, including 42 critical-rated vulnerabilities and three zero-days. The most urgent is CVE-2026-68820, a Use After Free in the Windows Ancillary Function Driver for WinSock (AFD.sys) that grants SYSTEM-level privileges, which Lazarus group has been exploiting in the wild and CISA added to the KEV catalog with a 3-14 day remediation window. The patch replaces a kernel driver and requires a reboot to take effect, meaning deploying the patch alone is insufficient. [UPDATE] The release also fixes a Windows DNS Server RCE flagged as potentially wormable and six Exchange Server vulnerabilities covering RCE, privilege escalation, DoS, and spoofing. Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs

A binary-planting vulnerability in the Cursor IDE for Windows (CVE-2026-63093) allows arbitrary code execution simply by opening a malicious repository. AI security firm Mindgard discovered the flaw in December 2025 and disclosed technical details in July 2026: Cursor resolves Git-related executables during workspace initialization, and on affected Windows configurations this lookup resolves a git.exe placed in the repository root before the legitimate system Git binary. Subsequent research by Maland showed the attack surface extends beyond Git to other executables including hatch.exe under specific project conditions. The vulnerability targets the IDE's native binary resolution level before any AI features engage, making the attack vector broader than initially scoped. Cursor 0-Day Allows Arbitrary Code Execution by Simply Opening a Repository

Researchers at Checkpoint documented StopAndProtect, an operation that combines file encryption with data theft using thousands of compromised WordPress websites as distributed infrastructure for malware delivery, C2 channels, and storage for stolen documents. The campaign begins with ClickFix social-engineering lures hosted on hacked sites, showing a fake CAPTCHA prompt that instructs victims to copy and run a PowerShell command, which launches a hidden process that downloads further payloads. Operational security failures by the developer exposed detailed infection logs, screenshots from infected computers, and source code of the tools used to mass-manage compromised WordPress sites. Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

BeyondTrust disclosed two high-severity flaws in its Endpoint Privilege Management product for Windows under advisory BT26-04, affecting all versions prior to 26.1.2. CVE-2026-40144 (CVSS 7.3) stems from an out-of-bounds read in a kernel-mode component, allowing a standard user to execute code at elevated privilege levels, and CVE-2026-40145 enables anti-tamper bypass, undermining the mechanism that prevents tampering with EPM itself. Both issues were discovered internally during security assessments using frontier AI models and proprietary testing harnesses. A local attacker could use CVE-2026-40144 to escalate to SYSTEM, then combine it with CVE-2026-40145 to disable EPM protections entirely, effectively negating the least-privilege security boundary with no network access required. BeyondTrust Endpoint Privilege Management Flaws Enable Local Privilege Escalation

A threat actor calling itself "Ransom Busters" is contacting ransomware victims offering to retrieve stolen files, destroy backups held by criminal infrastructure, and provide decryption keys, posing as an independent data recovery service. GuidePoint Security's GRIT assesses with moderate confidence that this operation is a ransomware affiliate running a diversion scheme, targeting victims of DragonForce, Settra, and Anubis families. By claiming to have compromised the original ransomware operation's infrastructure, the actor attempts to redirect extortion payments away from the primary group and toward itself, representing a novel double-extortion layer where victims already facing data theft and encryption are approached with a second, conflicting solicitation. Ransomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Attacks

Microsoft Defender Experts have mapped over 30 rotating domains tied to MacSync Stealer, a macOS-focused information stealer and RAT. The campaign uses a legitimate Claude shared-conversation page on claude.ai as the delivery mechanism: attackers bought a Google-sponsored search result for "Claude install guide" that routes users to a poisoned page, where ClickFix instructions download and execute MacSync. The infrastructure supports the full attack chain including payload delivery, C2, credential theft, data staging, and chunked exfiltration, and Microsoft pivoted to tracking recurring endpoint and network behaviors rather than relying on static domain IOCs. Fake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallets Into Minefields

A threat actor using the handle "Satanic" published a 35 GB archive on a data-trading forum containing Stripe secret API keys for 659 merchant accounts, exposing data linked to 688,363 customers across 42 countries. The dataset covers 17,654 files including customer objects, charges, payment intents, checkout sessions, invoices, payouts, refunds, balance transactions, disputes, subscriptions, products, and pricing details spanning January 2022 through June 2026. Of the 659 keys, 650 were live secret keys and 519 had both payment acceptance and payout capabilities. This is not a Stripe infrastructure breach; attackers obtained merchant API keys through unknown initial access vectors. The leaked data does not contain raw card numbers but exposes enough PII and transaction history for targeted phishing, refund fraud, business email compromise, and payment-related social engineering at scale. 659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer Records

D-Link has patched 15 CVEs in the DWR-M961 4G/LTE router, hardware revision C1, covering multiple command injection issues in CGI handlers for FOTA updates, network diagnostics, USSD/SMS operations, SIM configuration, NTP, and L2TPv3 settings, plus three buffer overflow vulnerabilities. Firmware 1.1.5_C1_202607071108 addresses all 18 reported findings across the 15 CVE identifiers. The command injection flaws could allow unauthenticated attackers to execute arbitrary commands on the router if they reach the management interface. D-Link DWR-M961 Router Hit by 15 Command Injection and Buffer Overflow Flaws

CVE-2026-71290 is a critical vulnerability in Apache HttpComponents Client versions 5.4 through 5.6.3 that allows man-in-the-middle attackers to impersonate trusted servers when applications use the asynchronous HttpClient implementation with HostnameVerificationPolicy#BUILTIN. The flaw causes TLS hostname validation to have no effect in vulnerable async configurations, meaning an attacker on the network path can present a fraudulent certificate and the client will accept it. Apache has released patches. Critical Apache HttpComponents Flaw Allows Server Impersonation in MITM Attacks

CVE-2026-33824 is a critical race condition in cng.sys, the Cryptographic Next-Generation kernel module that underpins the Windows Internet Key Exchange Service Extensions, allowing a remote, unprivileged attacker to achieve code execution by sending a single crafted IKEv2 packet. CISA added it to the KEV catalog on August 7 with a remediation deadline of August 27, and a proof-of-concept appeared on GitHub on July 31. Once exploited, attackers can add user accounts with full administrative rights, making this a direct path to domain compromise for organizations that have not patched. Critical RCE Flaw in Windows IKE Extension Now Actively Exploited

France's Directorate General of Public Finances (DGFiP) disclosed a data breach affecting roughly 678,000 individuals and businesses after attackers accessed internal systems using impersonated credentials, with a threat actor using the handle "ZeroBytes" claiming responsibility on August 12. The attackers compromised accounts by impersonating both a DGFiP employee and an authorized third party, extracting reference tax income, family quotient, withholding tax rates, and company turnover figures. The French Ministry of Economy and Finance issued a formal press release on August 14 confirming the scope. [UPDATE] The breach is notable for its breadth of financial data across nearly 700,000 taxpayers and businesses, and the credential impersonation targeting both internal staff and third-party access suggests prior knowledge of DGFiP's access architecture. French Tax Authority Data Breach Impacts 678,000 Individuals and Businesses

Apple shipped iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 on August 17, patching 28 security vulnerabilities including code execution flaws and kernel memory handling weaknesses. The updates also cover older hardware with iOS 18.7.10 and iPadOS 18.7.10, plus Apple Vision Pro, Apple TV, and Apple Watch. No known exploitation in the wild has been reported yet, but the breadth of affected platforms means a large attack surface remains exposed until organizations roll out the updates. Apple Patches Code Execution and Kernel Memory Flaws in iOS 26.6.1 and macOS

Seqrite researchers documented Operation QUICSILVER, a China-nexus targeted malware campaign against Myanmar government and diplomatic personnel using Burmese-language decoy documents impersonating Myanmar's Information Technology and Cyber Security Department. The attack chain delivers malware through a Virtual Hard Disk file disguised as a JPG image; when mounted, the VHD presents a malicious Windows shortcut that launches a three-stage infection deploying QUICAgent, a custom Golang-based backdoor. Recovered deleted files from the Recycle Bin suggest attackers also maintain interest in diplomatic matters involving ASEAN, BIMSTEC, UN meetings, Malaysia, China, and Myanmar's foreign affairs. Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via Government-Themed Lures

RAVEN is an open-source offensive framework that targets exposed or poorly secured Elasticsearch and Kibana clusters, chaining together reconnaissance, exploitation, full database exfiltration, and persistence mechanisms. The tool can steal entire Elasticsearch databases and rebuild backdoors even after defenders delete them, by reinstalling persistent access through Kibana plugin abuse or index-level manipulation. A single misconfigured cluster can hand an attacker complete data access and durable persistence. RAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted Backdoors

Storm ransomware claimed a fifth victim in four days, hitting WindRose Health Network on August 18 alongside Rood & Riddle Equine Hospital (USA veterinary), Tapper Cuddy LLP (Canada legal), Integra Castings (Canada iron foundry), and Westco Motors Cairns (Australia automotive). The group uses the same playbook on every target: post a leak notice, threaten data publication, and demand contact through provided channels. The breadth across healthcare, legal, manufacturing, and automotive sectors in three countries simultaneously suggests either a broad initial access campaign or an affiliate model feeding multiple operators into the same leak site. [UPDATE] The healthcare targeting at WindRose carries patient safety implications and triggers HIPAA notification obligations. Storm Ransomware Strikes Rood & Riddle Equine Hospital

Suspected Chinese-speaking hackers are actively exploiting CVE-2026-59310 and CVE-2026-59309 in VMware vCenter to deploy Babuk-derived ransomware on ESXi hypervisors, with 361 unique victim IP addresses across 47 countries identified. [UPDATE] CISA added CVE-2026-59310 to the KEV catalog on August 18 with an accelerated remediation deadline of August 21, elevating this to a mandatory federal remediation priority. Suspected Chinese Hackers Turn VMware vCenter RCE Into Root Backdoors and ESXi Ransomware

GitLab released emergency security updates patching CVE-2026-19478, a critical GraphQL directive code injection vulnerability rated CVSS 9.4. [UPDATE] Self-managed GitLab operators should treat this as an immediate priority given the unauthenticated attack vector and the severity of the flaw. GitLab Patches Multiple Security Flaws in CE and EE With 19.2.4 Update

SAP released patches for critical vulnerabilities across SAP Commerce Cloud, SAP Manufacturing Integration and Intelligence, SAP NetWeaver, and SAP Change and Transport System. [UPDATE] The advisory covers code injection and memory corruption flaws on top of the July 2026 patch cycle that addressed CVE-2026-58231, a CVSS 10.0 unauthenticated RCE in Commerce Cloud's Data Hub Adapter extension. SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities

Pokemon Center is notifying customers in the United Kingdom and Germany that personal information was exposed after a cyberattack on CEVA Logistics. [UPDATE] The breach activity began on July 30 and Pokemon Center also cancelled a batch of pending orders; CEVA serves many retail clients beyond Pokemon. Pokemon Center Data Breach Exposes Customers' Personal and Order Data

C2Looper v2 is a Rust-based backdoor that replaces conventional command-and-control infrastructure with GitHub repositories for task delivery, result collection, beacon records, and payload hosting. [UPDATE] ThreatLabz identified the malware in July 2026 and assesses it is delivered through multi-stage ClickFix infection chains, blending into legitimate developer traffic. C2Looper v2 Uses GitHub Repositories as Full Command-and-Control Infrastructure

North Korean threat actor Kimsuky has expanded its espionage toolkit with locally hosted AI development environments as part of Operation GitPower. [UPDATE] By hosting AI capabilities locally, the group can process stolen documents, develop malware, and automate social engineering without relying on public AI services that might log or monitor their activity. Kimsuky Moves AI-Assisted Development Into Local Environment With Operation GitPower

Octagon is a previously undocumented Android banking and cryptocurrency fraud platform marketed as malware-as-a-service, charging buyers $1,400 per month. [UPDATE] First advertised on June 1, 2026, the toolkit targets cryptocurrency wallets, banking apps, and messaging services through hidden VNC sessions for real-time device control. Octagon Android Bot Targets Crypto Wallets and Banking Apps With Hidden VNC and Accessibility Abuse

Gambit Security documented a suspected affiliate of The Gentlemen ransomware-as-a-service operation using Claude Code, OpenAI Codex, and DeepSeek across nearly every phase of a live intrusion campaign targeting internet-exposed VPN appliances. [UPDATE] At least eight organizations were compromised across energy, financial services, manufacturing, and IT sectors in Australia, Mauritius, Thailand, and the United States. Threat Actors Use Claude Code, Codex and DeepSeek AI to Power Cyberattacks

JWR is a phishing-as-a-service framework enabling real-time banking and payment fraud through operator-led victim interaction, streaming victim keystrokes over AES-CTR-encrypted WebSocket channels. [UPDATE] The framework targets banking and payment-service customers in Singapore, the UAE, and Southeast Asia using SMS lures themed around unpaid road-toll notices and postal charges. JWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real-Time Banking Fraud

A proof-of-concept exploit has been released for a Microsoft SCCM attack chain that allows escalation from domain user to full site server compromise. [UPDATE] Organizations running SCCM should audit their hierarchy configurations and verify that domain user accounts cannot escalate to site server privileges. PoC Exploit Released for Microsoft SCCM Attack Chain From Domain User to SYSTEM

Operation ASTERIX is a multi-stage cryptocurrency fraud campaign that chains account enumeration, branded phishing emails, automated voice calls, and trojanized wallet apps to steal seed phrases. [UPDATE] Rapid7 found an exposed Asterisk telephony server containing the operator's full operational toolkit, including bulk phone-number validation against a Crypto.com endpoint. Operation ASTERIX Uses Vishing and Fake Crypto Wallet Apps to Steal Seed Phrases

Shadow hVNC is a malware-as-a-service kit that combines credential theft, browser-session hijacking, reverse proxying, and persistence into a single Windows-focused toolkit, with its defining feature being a hidden virtual desktop. [UPDATE] The malware calls CreateDesktopW to spin up a second Win32 desktop named "RemoteXHidden" and uses SetThreadDesktop to run attacker tools in that invisible session. Shadow hVNC Lets Hackers Operate a Second Windows Desktop Invisible to the Victims

Microsoft has removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2. [UPDATE] WMIC has been heavily abused by threat actors for living-off-the-land attacks; the removal eliminates a commonly abused binary from fresh Windows 11 installations, though WMI itself remains fully functional. Microsoft Starts Removing WMIC Tool Used by Cybercriminals

Watchlist: apply the VMware vCenter patches (CVE-2026-59310, CVE-2026-59309) before the August 21 CISA deadline given active exploitation with ransomware deployment; prioritize the Microsoft AFD.sys zero-day (CVE-2026-68820) which requires a reboot to fully remediate; patch BeyondTrust EPM to 26.1.2 before the privilege-escalation chain is weaponized; audit Cursor IDE deployments on Windows for CVE-2026-63093 and treat untrusted repositories as hostile; and monitor for StopAndProtect campaign activity targeting WordPress environments.