DFIRLab
All Briefings
weeklyAugust 3, 2026 — August 10, 2026Published 07:03 UTC

Weekly Threat Briefing — 2026-08-03 to 2026-08-10

44 findings152 articles8 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
152 Articles1,023 CVEs8,453 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 25
Browse all 44 findings

Executive summary · as of 07:03 UTC

The situation

During the period of August 3-10, 2026, the threat landscape was dominated by critical vulnerabilities in enterprise infrastructure, widespread ransomware activity targeting multiple sectors, and major data breaches affecting millions of individuals. Six critical vulnerabilities were added to CISA's KEV catalog, including command injection flaws in Progress LoadMaster, JetBrains TeamCity, and IBM Langflow requiring immediate patching. The NVD disclosed 30 additional high and critical severity vulnerabilities, with MSI router firmware and D-Link devices showing systematic command injection weaknesses. Ransomware groups demonstrated sustained operational tempo with 30 victim organizations disclosed across multiple sectors including healthcare, manufacturing, and education. Notable incidents include Qilin's targeting of Université Libre de Bruxelles and Everest's claims against Omnicell and Ingersoll Rand. Major data breaches impacted over 1.7 million individuals, led by BrinksHome (732k records) and Alcon (218k records), while ShinyHunters conducted aggressive pay-or-leak extortion campaigns. Infrastructure attacks against critical services included cyberattacks disabling 911 systems in Suisun City and disrupting North Carolina Ports operations, demonstrating threat actors' willingness to target emergency and logistics infrastructure.

Browse the full briefing

44 findings · 8 sections
Findings by severity
  • 11 critical
  • 14 high
  • 11 medium
  • 8 info
Vulnerabilities7 critical · 1 high

Critical Vulnerabilities Requiring Immediate Action

CISA added six vulnerabilities to the KEV catalog this week, all enabling remote code execution or authentication bypass in widely-deployed enterprise products.

Malware1 critical · 3 high · 2 medium

Malware Campaigns and Supply Chain Compromises

Multiple high-impact malware campaigns observed, including supply chain attacks, AI coding agent exploits, and widespread Mozi botnet activity.

Threat Actors1 critical · 3 high · 1 medium

Ransomware Groups and Extortion Campaigns

Thirty victim organizations disclosed by ransomware groups this week, with Qilin showing highest activity (17 victims). ShinyHunters conducted aggressive pay-or-leak extortion campaigns.

Data Breaches & Leaks1 critical · 3 high · 3 medium

Data Breaches & Leaks

Major data breaches disclosed affecting over 1.7 million individuals, with healthcare sector particularly impacted. BrinksHome breach exposed 732k records including partial credit card data.

Vulnerabilities1 critical · 4 high

Critical Infrastructure and Emergency Services Attacks

Multiple attacks targeting critical infrastructure including emergency services, ports, and hospitals, demonstrating threat actors' willingness to disrupt essential services.

Tools & Techniques5 medium

Attack Techniques and Detection Research

Security research published on novel attack vectors, detection gaps, and adversary tradecraft evolution.

Policy5 info

Policy, Regulation, and Industry Response

Regulatory actions, settlements, and policy developments affecting cybersecurity landscape.

DFIR Lab3 info

DFIR and Security Research

Digital forensics and incident response methodologies, detection engineering, and threat hunting research.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.