🔴 Oracle HTTP Server CVE-2026-21962 CVSS 10.0 KEV addition, 🛡️ miniOrange WordPress SAML SSO auth bypass CVSS 9.8, 🔓 Critical Zimbra RCE CVE-2026-73570 actively exploited, 🎯 ShinyHunters impersonates ReliaQuest staff in vishing campaign, 🔑 EvilTokens PhaaS abuses Microsoft device codes for M365 hijack, 💊 Red Hat Keycloak CVE-2026-18963 unauthenticated account takeover

CISA added Oracle HTTP Server CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on August 24 after confirming active exploitation of the unauthenticated access-control flaw in the Oracle WebLogic Server Proxy Plug-in. The CVSS 10.0 vulnerability lets a remote attacker bypass access restrictions and read or modify data in backend application servers that administrators believe are shielded by the proxy layer. Public exploit code has been available since January 21, one day after Oracle patched it in the January 2026 CPU, giving threat actors a nine-month window before CISA's BOD 26-04 binding remediation deadline. The addition signals the flaw is no longer theoretical and that unpatched Oracle HTTP Server instances are at active risk.

Separately, CISA also added Oracle WebLogic CVE-2024-21182 to the KEV catalog on the same day, confirming active exploitation of the unauthenticated T3/IIOP remote-code-execution flaw that Oracle patched in July 2024. The six-month gap between patch and KEV listing points to significant unpatched exposure across enterprise Java environments, particularly organizations running Oracle-based ERP and middleware stacks.

Two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, CVE-2026-61979 and CVE-2026-15981 (CVSS 9.8), let unauthenticated attackers forge SAML assertions and log in as any user including administrators. The plugin turns WordPress into a SAML service provider for corporate IdPs like Microsoft Entra ID and Okta. DigitalOcean's security team detected and blocked an anomalous WordPress admin session attempt on its infrastructure and then reproduced both bypasses on miniOrange Standard edition version 16.1.9. CVE-2026-61979 is a signature-algorithm confusion flaw where the plugin accepts HMAC-SHA1 from incoming SAML responses and treats a public RSA key as the HMAC secret. CVE-2026-15981 causes the plugin to interpret an OpenSSL error return as truthy in PHP, letting malformed signatures pass validation. Patchstack coordinated vendor follow-up and found that the plugin's distribution model, seven plugins with a free version and 30,000 paid customers, obscured actual exposure. The vendor fixed the issues in Standard edition version 17.0.5.

Critical Zimbra RCE flaw CVE-2026-73570 continues to draw exploitation activity. The OS command injection in Zimbra Collaboration Suite's SNMP monitoring component allows unauthenticated attackers to execute arbitrary commands as the zimbra user when SNMP trap notifications are enabled and the swatchdog service is running, which is the default configuration. CERT Polska issued Alert 145/2026 on August 17 confirming active exploitation. CISA added the flaw to KEV on August 22 and ordered Federal Civilian Executive Branch agencies to patch within three days. Shadowserver tracks over 12,100 internet-facing Zimbra servers concentrated in Europe and Asia, and the same ZCS 10.1.20 release patches four additional XSS flaws, a mail forwarding bypass, and an SSRF in the Nextcloud integration.

Hackers impersonated ReliaQuest security staff in a social-engineering campaign attributed to the ShinyHunters extortion group. The attacker registered the domain reliaquest.claims and deployed a counterfeit ReliaQuest single sign-on page behind a CDN. Multiple employees received phone calls from someone impersonating a named member of ReliaQuest's security team, directing them to the fake SSO portal. One employee entered credentials and approved an MFA push notification, granting the attacker a short-lived session with view-only access to the identity dashboard. After ReliaQuest's threat research team posted on X about ShinyHunters registering .claims domains, a newly created account linked to the attackers replied with screenshots of what appeared to be a compromised Okta SSO session, which ShinyHunters subsequently published on their data leak site. The incident highlights the .claims TLD as emerging phishing infrastructure and the effectiveness of vishing combined with MFA push fatigue.

A critical Red Hat Keycloak password-reset flaw, CVE-2026-18963 (CVSS 9.1), lets unauthenticated remote attackers take over arbitrary user accounts by bypassing the password reset process. The flaw affects the keycloak-services component, the core engine behind authentication and identity functions. An attacker can trigger the reset-credentials flow for a chosen account and set a new password without completing the required email verification step, granting account control without credentials, prior access, or user interaction. Red Hat classified the issue as CWE-640 (Weak Password Recovery Mechanism for Forgotten Memory). Any organization running Red Hat Build of Keycloak should apply patches immediately.

TP-Link Archer command injection flaws affecting Archer BE800 V1, Archer BE3600 V1, and Archer AX75 V1 routers were disclosed with firmware patches released August 24. The most critical is CVE-2026-9254 (CVSS 8.7), an unauthenticated flaw in the parental-control feature where a LAN-based attacker can inject arbitrary OS commands as root without credentials, enabling full device compromise including traffic interception and DNS manipulation. Two additional authenticated flaws, CVE-2026-16348 and CVE-2026-78541, affect VPN connection functionality.

EvilTokens is a phishing-as-a-service platform that goes beyond credential theft by abusing Microsoft's OAuth 2.0 device authorization flow to obtain valid M365 tokens. Victims complete a legitimate Microsoft sign-in and MFA challenge, yet unknowingly authorize an attacker-controlled session through a device code. The operation was advertised on Telegram from mid-February 2026 and documented by Sekoia researchers. Panel access costs $1,500 with a $500 monthly fee. Researchers linked the operation to a 16-day campaign affecting 344 organizations across five countries. What distinguishes EvilTokens is its post-compromise playbook: attackers can search compromised inboxes, identify suppliers and payment approvers, and generate convincing business email compromise messages using AI, turning a single hijacked identity into opportunities for invoice fraud and payment redirection.

Threat actors are using sponsored Google Search ads to place a fake OpenAI Codex download page above the legitimate result, targeting macOS users searching for "codex macos download." The ads redirect to Google Sites pages impersonating a Codex download portal. The attack uses ClickFix, a social-engineering technique that instructs victims to open Terminal and paste a command that secretly decodes a Base64-encoded URL, fetches a remote script, and pipes it into zsh for execution. The infection chain has three stages: the pasted command downloads a shell-script loader, which fetches the second-stage payload, which establishes persistence.

Cybercriminals are distributing Vidar infostealer malware through fake Rockstar Games websites advertising a non-existent GTA 6 demo, timed to coincide with leaked footage and maps circulating online ahead of the legitimate Extended Look promotion scheduled for August 27. The downloaded Vidar sample targets saved passwords, browser cookies, session tokens, browsing history, and autofill data. Critically, it extracts browser session data that can let attackers access accounts even after victims change passwords, since stolen cookies preserve authenticated sessions.

The WeedHack malware-as-a-service operation continues spreading despite McAfee's earlier disruption of its command-and-control infrastructure. Researchers found multiple lookalike websites impersonating popular Minecraft clients and mods including Glazed Client, Radium Client, SeedCrackerX, Xenon Client, Nova Client, and Meteor Client. These fake sites copied legitimate branding, FAQs, installation instructions, and even linked to real GitHub repositories. McAfee WebAdvisor blocked over 6,300 access attempts to WeedHack-linked sites in the past month alone, and the campaign has previously infected more than 116,000 gamers. In one case, the top two Google search results for "Xenon Client" led directly to WeedHack distribution pages.

A supply-chain campaign is distributing a native Linux implant called RedShell through trojanized npm packages. The malicious packages, streak-metrics-math, kit-map-vim, streak-map-cache, and at least 10 others, pose as calendar and streak-calculation utilities. The loader uses an async IIFE in the entry file that silently executes the bundled binary on module load, defeating --ignore-scripts protections entirely. A single transitive import anywhere in a project's dependency tree triggers execution. The implant is tied to RedC2, a commercial multi-OS command-and-control framework, and establishes SOCKS5 proxy tunnels and TCP forwarding capabilities, turning compromised Linux machines into pivoting points for internal network access.

SynkLoader is a modular malware framework combining Python, C#, C++, and PowerShell in layered modules designed to evade behavioral detection by mixing languages within single execution chains. The campaign distributes through Microsoft Teams phishing messages impersonating IT help desks, using spoofed @company.onmicrosoft.com addresses. Victims are directed to download an MSI installer disguised as "PowerShell Cleaner" from Azure Blob Storage. Once executed, the MSI drops a PowerShell script running entirely in memory via nested Invoke-Expression and ScriptBlock::Create calls, then deploys a full embedded Python environment to %AppData%. The core loader beacons to C2 domains using a modified ChaCha20 cipher with altered "Sigma" constants, and includes modules for system profiling, a fake Windows lock screen for credential capture, and network tunneling for interactive access.

77 Evil Twin Open VSX extensions harvested developer metadata from the Open VSX marketplace between July 26 and August 1. All 77 shared C2 infrastructure at mangorbit[.]com and replaced the legitimate extension.js with a data-collection stub. The 19 deeply-profiled extensions gathered organizational intelligence including private repo URLs, team size indicators, and CI pipeline details to enable targeted follow-on attacks against specific companies. Open VSX has now unblocked three extension IDs after the legitimate projects they impersonated reclaimed their names, exposing a supply-chain tracking gap where a single extension ID can represent both a removed malicious artifact and a later legitimate release.

Watchlist: patch Oracle HTTP Server and WebLogic instances immediately given the CVSS 10.0 CVE-2026-21962 KEV addition and confirmed exploitation; update miniOrange SAML SSO WordPress plugin to version 17.0.5 or later and review authentication logs for suspicious admin sessions; patch Zimbra Collaboration Suite to ZCS 10.1.20 and disable SNMP notifications if not required; audit Keycloak deployments for CVE-2026-18963 and verify password reset flows enforce email verification; update TP-Link Archer BE800, BE3600, and AX75 firmware to address the unauthenticated parental-control command injection; restrict Microsoft device code authorization flow for users who do not need it and monitor for EvilTokens-style abuse; and audit npm dependency trees for the identified trojanized packages and monitor for SOCKS5 proxy traffic on developer or build systems.