🔴 Iran-linked hackers shut down UK power plant for 4 days, 🛡️ WordPress Pods CVE-2026-19598 CVSS 9.8 affects 100K+ sites, 🔓 Node.js isolated-vm sandbox escape threatens AI agents, 🎯 ShinyHunters claims CyrusOne breach demands $13M, 🚗 Android car head unit botnet campaign widens, 💰 CoinbaseCartel hits 7th victim across 4 countries

Iran-linked hackers forced a small UK power-generation facility offline for four consecutive days in July, in what analysts from Huntress, Dragos, and Check Point describe as the first known Iranian cyberattack to completely shut down a British energy site. The plant, described by the Department for Energy Security and Net Zero as a "small-scale energy generator," fell below the statutory reporting threshold, which may explain why the intrusion took over a month to become public. Dragos flagged that the technique is "very repeatable and could be deployed at scale," and the UK's thousands of distributed energy assets represent an expanding attack surface. The incident sits within a broader Iranian campaign targeting water systems and critical infrastructure across the US, Israel, UAE, Bahrain, Kuwait, Qatar, Saudi Arabia, Cyprus, and Romania since the US-Iran conflict intensified.

A critical privilege-escalation flaw in the WordPress Pods plugin, CVE-2026-19598, allows unauthenticated attackers to gain full administrator control of affected sites. The CVSS 9.8 vulnerability affects all versions through 3.3.9, which has over 100,000 active installations. Discovered by Nhien Pham through the Wordfence Bug Bounty Program, the bug resides in the pods_admin AJAX router where a JSON compatibility path causes the error-handling routine to log and return instead of terminating execution, letting attackers bypass authentication entirely. Full site takeover including code execution and data exfiltration is straightforward once the flaw is exploited, and the simple bypass mechanism makes mass exploitation likely once details circulate.

A critical vulnerability in isolated-vm, a Node.js sandboxing library used by AI agents and automation platforms that execute untrusted code, allows attackers to escape their V8 isolate and hijack host process control flow. The flaw, GHSA-864f-rcv7-6rh4, affects versions before 7.0.1 and 6.2.0 and exploits a time-of-check, time-of-use condition in the ExternalCopy transferList validation where a JavaScript getter can return a real ArrayBuffer during validation and a different value during transfer. The library receives over 1 million downloads per week, making this a high-priority patch for any organization running AI agent infrastructure or serverless runtimes that process model-generated code.

Kaspersky's research into the Android car head unit malware campaign continued to draw additional coverage, reinforcing the finding that the MoYu group compromises DoFun-manufactured Android infotainment systems through the legitimate TWCore system app to sideload JarService, which then pulls encrypted payloads for proxy botnet enrollment and ad fraud. The supply-chain angle remains the critical differentiator: vehicles with these head units are effectively pre-compromised before the owner interacts with the infotainment system, and firmware update channels are rarely monitored by end users.

ShinyHunters claimed a breach of CyrusOne, the US-based data center and colocation provider, demanding $13 million for 12.9 million Salesforce records and 645 GB of SharePoint data comprising over 288,000 files. The claim surfaced on August 23 with an update indicating ShinyHunters removed the victim's name while asserting the data remained in their possession. Separately, the August 24 deadline for BOK Financial arrived with no confirmed data publication yet, though the threat remains active.

CoinBaseCartel added a seventh victim to its mid-August campaign: PT Bank Perekonomian Rakyat Bintan in Indonesia, joining Patel CPA Office, Abacus Advisors, Integrated Health Systems, Tower Insurance, and RXPE Group across four countries. The geographic and sector breadth suggests an opportunistic mass-compromise campaign rather than targeted operations, and the pattern of simultaneous claims against unrelated organizations points to a common initial access vector deployed across multiple victims.

Emperador ransomware continued to draw attention for its claimed attack on Vietnam Electricity (EVNHANOI), threatening to publish over 300GB of exfiltrated data including 13.36 million customer records. The breach targets critical energy infrastructure at national scale, with the group demanding negotiation or full public disclosure of what would be one of the largest utility data exposures in Southeast Asia.

A supply chain vulnerability in Google's Gemini CLI continued to gain coverage, demonstrating how developer tooling trust chains can be weaponized for cloud infrastructure takeover through a malicious GitHub issue that compromised a GCP project.

SecurityWeek's roundup of three active banking trojan families picked up additional reporting: Manic, Grandoreiro, and ToxicPanda 2.0 each with distinct toolchains targeting financial institutions across multiple regions. Grandoreiro has been active since at least 2019, ToxicPanda 2.0 succeeds the original lineage, and Manic combines banking fraud with spyware capabilities.

Watchlist: patch WordPress Pods to version 3.4.0 or later immediately given the unauthenticated nature and 100K+ install base; update isolated-vm to 7.0.1 or 6.2.0 in any environment running AI agents or untrusted code execution; monitor ShinyHunters' claims against CyrusOne and BOK Financial for data publication; audit Android infotainment systems sourced from DoFun or Shenzhen Driving Control Technology for the MoYu proxy botnet; and track Iranian cyber activity against distributed energy infrastructure in the UK and allied nations.