The period from August 1-2, 2026 witnessed a significant surge in critical vulnerabilities across multiple enterprise platforms, with particular concern around authentication bypasses and remote code execution flaws. FreeRDP disclosed 15 vulnerabilities including critical TLS certificate validation weaknesses (CVE-2026-66402, CVE-2026-67289) that could enable man-in-the-middle attacks. GitPython revealed multiple command injection vulnerabilities (CVE-2026-67324, CVE-2026-67308) affecting CI/CD pipelines. ArcadeDB exposed three critical flaws allowing authorization bypass and arbitrary code execution. The healthcare sector faced continued targeting, with CareCloud, Mon General Hospital, and multiple smaller providers reporting data breaches affecting hundreds of thousands of patients. Additionally, 865,336 SplitVPN users had credentials and payment data exposed in a breach, while ransomware groups Qilin, Coinbasecartel, and others listed 14 new victims across manufacturing, healthcare, and professional services sectors. Mozi and Mirai botnet activity remained persistent with 50 malware distribution URLs identified targeting IoT devices.
Multiple critical vulnerabilities disclosed across enterprise software platforms enabling authentication bypass, command injection, and remote code execution
FreeRDP versions through 3.28.0 contain critical TLS certificate validation weaknesses that fail to properly verify certificate identity. Custom Common Name and DNS SAN matching instead of OpenSSL's library functions allows attackers to bypass certificate validation and conduct man-in-the-middle attacks against RDP connections. Affects all FreeRDP client deployments.
FreeRDP before 3.29.0 fails to validate CRLF and control characters in server-controlled RDP redirection TargetNetAddress fields. When connecting through HTTP proxies, attackers can inject malicious headers directly into proxy CONNECT requests, enabling HTTP request smuggling and potential credential theft.
GitPython 3.1.50 fails to recognize joined short-option forms (e.g., -u<value> for --upload-pack), allowing attackers to bypass unsafe option guards. When applications pass attacker-controlled clone options with allow_unsafe_options=False, attackers can execute arbitrary commands through abbreviated dangerous options like upload_pack.
Wazuh workflows before commit 44bf114 contain critical shell injection vulnerability in GitHub Actions CI/CD pipelines. Attackers can submit pull requests with crafted VERSION.json files containing shell metacharacters that are directly interpolated into environment variables, enabling arbitrary command execution on GitHub runners.
ArcadeDB versions before 26.7.2 fail to validate database access permissions in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. Authenticated attackers can access and modify unauthorized databases by directly calling affected endpoints, bypassing intended access controls.
ArcadeDB before 26.7.2 allows authenticated users to execute arbitrary JavaScript code through SQL DEFINE FUNCTION statements with LANGUAGE js, completely bypassing scripting authorization controls. Any user with database access can run malicious scripts without requiring elevated permissions.
ArcadeDB before 26.7.2 allows trigger scripts to access java.lang.* classes via Java.type() because ScriptTriggerExecutor incorrectly permits java.lang.* packages. Authenticated users with UPDATE_SCHEMA permission can create JavaScript triggers invoking java.lang.Runtime.exec() for arbitrary command execution on the database server.
Better-auth SCIM plugin versions 1.4.0-beta.27 through 1.7.0-beta.9 fail to prevent SCIM token issuance for provider IDs already used by SSO, SAML, OIDC, or social providers. Attackers can register SCIM providers using existing provider IDs, then authenticate via the original provider to receive valid SCIM bearer tokens, enabling unauthorized SCIM API access and user provisioning manipulation.
Critical vulnerability in Rails Active Storage framework allows unauthenticated attackers to read arbitrary files from Rails applications and potentially escalate to remote code execution. Organizations running Rails applications with Active Storage should apply patches immediately.
Better-auth 1.1.3 through 1.7.0-beta.9 vulnerable to account takeover when attackers register accounts with victim email addresses before victims sign up. When victims later use magic-link or email-OTP authentication, the system associates their session with the attacker's pre-registered account, granting attackers persistent access.
Major credential exposure affecting 865k VPN users alongside continued healthcare sector breaches impacting over 350k patients
Russian VPN service SplitVPN (formerly NotVPN) suffered a July 2026 breach exposing 865,336 unique email addresses. Compromised data includes IP addresses, geographic locations, device information, and partial credit card data (first 6 and last 4 digits). VPN users should change passwords and monitor payment cards for fraud.
Healthcare IT company CareCloud disclosed a March 16, 2026 breach of its electronic health record environment affecting at least 350,000 individuals. The CareCloud Health division incident involved unauthorized access to patient health information. Full scope of compromised data classes not yet disclosed.
Madrid-based biopharmaceutical company Diater appeared on DeadLock ransomware group's leak site. The company manages 10 years of sensitive patient medical records and healthcare provider information. Double extortion attack threatens public release of highly sensitive healthcare data.
Monongalia County General Hospital (Mon General) disclosed May 6, 2026 phishing attack that compromised personal and medical information of patients. Hospital identified unauthorized email access following successful phishing campaign targeting employee accounts. Patient notification underway.
GO2 Health medical clinic in Brisbane, Australia waited nearly three months before notifying patients of April 2026 phishing attack. Attackers gained access to clinic's main email mailbox containing patient information through phishing compromise. Delayed disclosure raises regulatory compliance concerns.
Oceanside Unified School District in California experienced suspected cyberattack disrupting work email, internet access, Google Drive and other applications. District confirmed network disruption but has not identified incident type. Investigation ongoing to restore services and determine impact scope.
Multiple ransomware groups actively listing new victims across healthcare, manufacturing, construction, and professional services sectors
Qilin ransomware group posted seven new victims on August 1st including The Saturday Evening Post (media), Commercial Furniture Interiors, Dienst Pack Systems (manufacturing), Ceragres (construction materials), Pointe Property Group (real estate), and Schreiner Trockenbau GmbH (construction). Demonstrates continued broad targeting across sectors.
Coinbasecartel group listed four victims including CEN/CENELEC (European standards organizations), MIM Fertility clinic network, M.B. Kahn Construction, and Xs Cad. Targeting of critical European standardization bodies raises concerns about potential disruption to technical standards development and certification processes.
IncRansom ransomware group targeted Quantinuum, a quantum computing company developing advanced quantum computers and cybersecurity solutions. Compromise of quantum computing and encryption technology provider represents high-value target with potential for intellectual property theft.
Global Secret Group ransomware claimed 274 GB of data (56,006 files) from Vernon & Waldrep, a Texas-based physician practice specializing in mental health. Exfiltrated data from mental health specialists represents particularly sensitive patient information with severe privacy implications.
Persistent Mozi and Mirai botnet activity with 50 malware distribution URLs targeting IoT devices across Chinese IP ranges
URLhaus identified 45+ active Mozi botnet malware distribution URLs primarily hosted on Chinese IP addresses. Malware targets MIPS and ARM architecture IoT devices through HTTP distribution on randomized high ports. Mozi continues as dominant IoT botnet threat despite 2021 disruption efforts.
Multiple Mirai botnet variant distribution URLs detected serving ELF binaries for MIPS and ARM architectures. Distribution infrastructure overlaps with Mozi campaigns, suggesting shared IoT targeting tactics. Payloads distributed via /bin.sh and /i endpoints on compromised IoT devices.
Memory corruption, authentication bypass, and injection vulnerabilities across enterprise and web platforms
GitPython before 3.1.50 fails to validate newline characters in config_writer() section parameter, allowing attackers to inject arbitrary .git/config sections. Attackers can forge [core] sections with hooksPath directives pointing to attacker-controlled directories, executing malicious code during Git operations.
GitPython before 3.1.51 fails to block abbreviated Git option names like upload_p (abbreviation of upload_pack) in its unsafe options guard. Attackers can bypass blocklist protections by using abbreviated dangerous option names that Git resolves to full options enabling command execution.
GitPython before 3.1.51 lacks protection against dangerous Git options in Repo.archive(), git.ls_remote(), Repo.iter_commits(), and Repo.blame(). Attackers can pass options like --exec/--upload-pack as keyword arguments to execute arbitrary commands when allow_unsafe_options=False is set.
Better-auth before 1.6.11 advertises the 'none' algorithm and accepts plain PKCE by default in oidcProvider and mcp plugins. Attackers can downgrade to no signature validation or intercept authorization codes when PKCE plain is negotiated, enabling OAuth token theft and authentication bypass.
Better-auth before 1.6.21 contains multiple SSO authentication bypass vulnerabilities including domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, and reflected account-linking. Attackers can sign in as arbitrary users through various SSO exploitation paths.
Better-auth SCIM 1.5.0 through 1.7.0-beta.3 fails to bind non-organization SCIM providers to creators. Authenticated users can manage other users' SCIM providers, regenerate bearer tokens, and invalidate legitimate tokens. Attackers gain unauthorized SCIM API access to provision/deprovision user accounts.
FreeRDP before 3.29.0 disclosed 10 memory corruption vulnerabilities including heap buffer overflows, out-of-bounds reads, use-after-free, and null pointer dereferences. Vulnerabilities affect client and server components in AsyncUpdate, RAIL, RDPEI, TSMF, smartcard, and HTTP gateway handlers. Remote attackers can crash processes or potentially achieve code execution.
ArcadeDB before 26.7.2 exposes cluster token in cleartext via GET /api/v1/server endpoint. Authenticated users can retrieve arcadedb.ha.clusterToken and use it with X-ArcadeDB-Cluster-Token header to impersonate any user via X-ArcadeDB-Forwarded-User, gaining unauthorized administrative access to the cluster.
Federal courts reviewing FCC data breach notification rules amid regulatory uncertainty
Full Sixth Circuit panel will rehear case upholding expanded FCC telecom data breach notification rules. Republican-controlled FCC indicated likely reversal of rules. Industry groups and GOP lawmakers seek judicial invalidation while agency reviews policy. Outcome will significantly impact telecom sector breach disclosure requirements.
30 WordPress plugin CVEs disclosed with severities ranging from medium to critical, primarily XSS and authorization bypass issues
Critical severity WordPress plugin vulnerability disclosed with CVSS 9.8. Specific plugin and vulnerability details not provided in source data. Organizations running WordPress should review NVD entry and apply patches if affected plugin is in use.
WordPress plugin contains authorization bypass vulnerability with CVSS 8.8. Attackers with authenticated access can bypass permission checks to perform unauthorized actions. Plugin identification and patching required for affected WordPress installations.
28 WordPress plugins contain various XSS, authorization bypass, and information disclosure vulnerabilities. CVSS scores range from 4.9 to 8.1. Most are stored XSS requiring authenticated access. Organizations should review WordPress plugin inventory and apply available security updates.
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.