🔴 CISA orders NetScaler patch by Saturday, 🏛️ Qilin claims ATF breach, 💾 SQL Server 2019 CVE exploited in wild, 🤖 AI middleware platforms LiteLLM/RAGFlow/Kestra targeted, 🕵️ Aurora affiliate uses Cursor AI for attack planning, 🇷🇺 Russia-linked OAuth phishing hits academics

CISA ordered Federal Civilian Executive Branch agencies to patch Citrix NetScaler appliances by Saturday after adding CVE-2026-8452 to the Known Exploited Vulnerabilities catalog. The flaw is a memory overflow in NetScaler ADC and Gateway appliances configured with Gateway VPN or AAA virtual servers. Citrix initially characterized it as denial-of-service only in June, but watchTowr demonstrated in August that exploitation also yields remote code execution as root on unpatched instances. Shadowserver tracks over 22,000 NetScaler ADC appliances and nearly 1,800 Gateway instances exposed online, though the number of vulnerable configurations is unknown. The gap between Citrix's initial assessment and the RCE demonstration underscores the risk of relying on vendor severity ratings without independent verification, and the binding federal deadline creates urgency across both government and private-sector environments.

The Qilin ransomware group posted the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives to its dark web data leak portal, and ATF confirmed a "major incident" involving a standalone system that operates separately from the ATF enterprise network. ATF terminated connections to the affected environment and initiated incident response with the Department of Justice. The ATF breach sits within a broader Qilin campaign spanning at least five victims in two weeks: B Wright Drywall (Canada, August 10), ASCII Group (US tech, August 16), Medochemie (Cyprus pharma, August 19), Air International Thermal Systems (US manufacturing, August 26), and now a US federal law enforcement agency. The breadth of targets across construction, technology, pharmaceuticals, manufacturing, and law enforcement indicates Qilin is operating at scale with no sector discrimination.

CISA added CVE-2019-1068 to its KEV catalog after confirming active exploitation of the remote code execution flaw in Microsoft SQL Server, which lets an attacker execute code in the security context of the SQL Server Database Engine service account. Despite being a 2019 CVE, the active exploitation signal means unpatched SQL Server instances remain at risk, and the age of the flaw suggests some environments have simply never patched it. The vulnerability affects the database engine itself, meaning a successful exploit grants direct access to the data layer and potentially the underlying host. Federal agencies face a binding remediation deadline; private operators should treat any SQL Server instance still missing this patch as a confirmed target.

Microsoft documented attacks against three AI infrastructure platforms: LiteLLM, RAGFlow, and Kestra. These platforms sit between applications and LLMs, holding sensitive model credentials, workflow permissions, database connections, and container access. A compromise at this layer grants access to cloud credentials, provider API keys, internal services, and compute resources. In the LiteLLM case, attackers likely exploited an exposed gateway surface linked to CVE-2026-42271 (command execution via MCP stdio test endpoints) and CVE-2026-48710 (Starlette host-header validation bypass). After gaining execution, the operators harvested environment variables from /proc/1/environ, which can contain model-provider API keys, LiteLLM master keys, database URLs, passwords, and access tokens. They also accessed the LiteLLM PostgreSQL database to collect model configuration and virtual-key records. The targeting of AI middleware represents a shift from attacking models directly to attacking the plumbing that connects them to enterprise systems.

An Aurora ransomware affiliate's exposed open directory revealed months of operational data, showing the affiliate targeted more than 20 organizations across nine countries between April and July 2026, gaining domain-level or interactive access at 17 victims. The unprotected Linux home directory, served on port 8888, contained victim folders, Kerberos tickets, credential dumps, Active Directory data, shell-history files, Cursor AI chat logs, exploit tools, and Aurora ransomware binaries. The key finding is the affiliate's use of Cursor, an AI coding assistant, to plan attacks in Russian. The recovered chat logs show sustained discussions of Active Directory Certificate Services abuse and domain-compromise paths across multiple victims. The affiliate followed a repeatable playbook using NetExec for lateral movement, Kerberos ticket manipulation for privilege escalation, and SOCKS proxy infrastructure to hide direct connections. The use of AI tools to accelerate attack planning lowers the barrier for affiliates to run complex, multi-victim campaigns.

Google Threat Intelligence Group detailed three Russia-linked clusters (UNC6293, UNC7005, UNC5976) conducting OAuth phishing, device-code phishing, and credential harvesting against academics, think tanks, and organizations in the US and Europe. GTIG assesses with moderate confidence that UNC6293 is an initial-access subcluster of ICE RELIC, formerly APT29. The campaigns do not exploit software flaws but abuse legitimate OAuth consent flows to trick targets into granting access to email, cloud accounts, or messaging platforms. UNC6293 used domains including foreignrelations[.]us and dosportal[.]app for OAuth phishing, with the first domain mimicking content from the Council on Foreign Relations. The infrastructure overlap and the use of Evilginx reverse-proxy setups suggest a maturing operation that combines multiple credential-theft techniques into coordinated campaigns targeting US and European academia and policy institutions.

Researchers documented SLEEPWALKER, a Windows backdoor that uses five distinct covert channels for command reception: raw network packets, DNS queries, SMB named pipes, ICMP ping traffic, and VMware VMCI communication. The malware impersonates Microsoft's dpapi.dll and is side-loaded by ESET Management Agent, checking the host process name before activating and copying version information from ESET to blend in. Once triggered, SLEEPWALKER decrypts and executes attacker-supplied bytecode through a custom interpreter supporting 23 instructions for task scheduling, data transfer, staged payload assembly, and in-memory shellcode execution. The design avoids traditional C2 patterns: no beaconing, no hardcoded server, no listening port, no embedded final payload. It remains dormant until a precisely crafted and encrypted trigger packet arrives, making it extremely difficult to detect through outbound traffic monitoring or network scanning.

AnonyMousKIT is an AI-powered Phishing-as-a-Service platform designed to unlock stolen iPhones by social-engineering owners into surrendering their device passcode, Apple ID credentials, and live two-factor authentication codes. The platform runs as a credit-based criminal service: subscribers enter stolen device details and the system generates customized phishing lures claiming the device was found or is being held by Apple Support. The most notable feature is its use of conversational AI voice agents across five personas, including English, Spanish, and Brazilian Portuguese versions of an "Apple Support representative" named Alice. The AI agent uses victim-specific details, asks the target to confirm ownership, requests the iPhone passcode, and directs the victim to a phishing page via SMS. The platform operates across five channels: email, SMS, WhatsApp, recorded calls, and live AI voice calls, logging 200 AI voice interactions during the research period. This represents the industrialization of social engineering through AI.

Microsoft SharePoint Server remains the target of a summer-long exploitation wave, with the chain of CVE-2026-55040 and CVE-2026-63520 now confirmed under active attack. CVE-2026-55040, a JWT token validation bypass rated CVSS 9.1 patched in July, was weaponized within one day of Rapid7 publishing its PoC on August 11. On August 24, VulnCheck released a PoC for CVE-2026-63520, the BCS-side RCE, and Defused reported seeing the full chain probed in honeypots one day later. Both PoCs are public and attackers are chaining them within days of disclosure. Confirm both the July and August updates are applied and migrate 2016 and 2019 servers off unsupported versions.

Microsoft shipped emergency patches for two actively exploited zero-days in its Defender antimalware products. CVE-2026-41091 is a privilege escalation bug in the Malware Protection Engine caused by improper link resolution before file access, chaining to SYSTEM-level privileges. CVE-2026-45498 targets the Defender Antimalware Platform and enables denial-of-service. CISA added both to the KEV catalog. Check Point Research published technical analysis showing how Defender's own signed boot-time recovery driver can be abused to delete arbitrary kernel-level security software. The patched versions are Malware Protection Engine 1.1.26040.8 and Antimalware Platform 4.18.26040.7.

Ubiquiti patched 22 vulnerabilities across its UniFi product line, including three rated CVSS 10.0. CVE-2026-77537 allows remote unauthenticated compromise of UniFi Protect. CVE-2026-77550 enables authentication bypass via CRLF injection on UniFi OS devices. CVE-2026-77554 is a command injection in UniFi Talk. All three require low-complexity attacks with no user interaction. Patched versions: UniFi Protect 7.2.105+, UniFi Talk 5.3.2+, UniFi OS Server 5.1.21+.

Google pushed Chrome 152.0.7977.64/.65 to stable channels with 327 security fixes, ten rated Critical. Multiple sources flagged at least two as particularly dangerous, both triggerable by simply visiting a malicious page with no user interaction. The scale of 327 fixes in a single stable update is above Chrome's typical cadence.

Avada, one of the most widely deployed WordPress themes, carries CVE-2026-18431, rated CVSS 9.8, a chain of six flaws enabling unauthenticated remote code execution with zero user interaction. The vulnerability affects versions up to 7.16 and Fusion Builder plugin up to 3.16.

Critical vulnerabilities in the Windows WatchGuard Agent allow unauthenticated attackers to execute arbitrary code with elevated privileges. CVE-2026-57910 (CVSS 9.3) and CVE-2026-57909 (CVSS 9.4) issue SYSTEM-level access on Windows and root on Linux. Upgrade to WatchGuard Agent 1.25.13.0000 or later.

SonicWall's NetExtender Linux VPN client carries CVE-2026-66152, a path traversal allowing arbitrary file writes with root privileges, and CVE-2026-66153 affecting the auto-upgrade mechanism. Patch to beyond version 10.3.5.

NVIDIA NemoClaw contains CVE-2026-65105, a flaw letting attackers hijack AI agents via DNS rebinding through Ollama's unauthenticated API on port 11434. A single visit to a malicious website enables persistent model poisoning.

Binary Defense identified Dindoor, a new Windows backdoor attributed to MuddyWater, found in infections at U.S. software and banking organizations. The backdoor hijacks the legitimate Deno JavaScript runtime to execute payloads, making it harder to spot because the runtime itself is signed and trusted.

A newly disclosed GPUThor Rowhammer attack can bypass error-correcting code protections on NVIDIA GPUs, enabling denial-of-service and privilege escalation. Demonstrated against Ampere-class workstation GPUs with GDDR6 memory.

Zimbra CVE-2026-73570 is a critical OS command injection in the SNMP monitoring component, now confirmed actively exploited and subject to a CISA Binding Operational Directive. Unauthenticated attackers execute arbitrary commands as the zimbra user by sending crafted SMTP requests when SNMP trap notifications are enabled. Patched in ZCS 10.1.20. Shadowserver tracks over 12,100 internet-facing Zimbra servers.

Watchlist: patch Citrix NetScaler appliances immediately for CVE-2026-8452 given the CISA KEV binding deadline; apply the SQL Server patch for CVE-2019-1068 across all unpatched instances; audit AI middleware platforms LiteLLM, RAGFlow, and Kestra for exposed gateway surfaces and rotate credentials; monitor for Qilin ransomware activity following the ATF breach confirmation; update Microsoft Defender to Malware Protection Engine 1.1.26040.8 and Antimalware Platform 4.18.26040.7; apply both July and August Patch Tuesday updates to SharePoint and migrate 2016 and 2019 servers off unsupported versions; update Ubiquiti UniFi Protect to 7.2.105+, UniFi Talk to 5.3.2+, and UniFi OS Server to 5.1.21+; force Chrome to 152.0.7977.64 or later; update Avada beyond version 7.16; upgrade WatchGuard Agent to 1.25.13.0000; update SonicWall NetExtender beyond 10.3.5; audit NVIDIA NemoClaw deployments; and patch Zimbra to ZCS 10.1.20 or disable SNMP notifications.