DFIRLab
All Briefings
weeklyAugust 10, 2026 — August 17, 2026Published 07:03 UTC

Weekly Threat Briefing — 2026-08-10 to 2026-08-17

46 findings159 articles9 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
159 Articles2,194 CVEs9,367 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 29
Browse all 46 findings

Executive summary · as of 07:03 UTC

The situation

The week of August 10-17, 2026 saw a dramatic surge in cybersecurity incidents, with critical vulnerabilities under active exploitation and multiple high-profile data breaches affecting millions of users. Most concerning is the active exploitation of a maximum-severity SAP Commerce Cloud flaw (CVE-2026-59310) and a critical VMware vCenter vulnerability (CVE-2026-59310) being used for reverse SSH access. The cryptocurrency sector experienced significant breaches, with SafePal, Trezor, and RingCentral collectively exposing data from over 1.6 million accounts. A major credential theft campaign targeted France's tax authority, potentially compromising 600,000 citizens, while banking fraud operations in Germany and Brazil resulted in €30M in losses.

Browse the full briefing

46 findings · 9 sections
Findings by severity
  • 7 critical
  • 22 high
  • 17 medium
Vulnerabilities5 critical · 3 high

Critical Vulnerabilities Under Active Exploitation

Multiple maximum-severity and critical vulnerabilities are being actively exploited, requiring immediate patching across enterprise infrastructure.

  • Critical severity
    SAP Commerce Cloud RCE Flaw Under Active Attack (opens the source in a new tab)

    Maximum-severity SAP Commerce Cloud remote code execution vulnerability (CVE-2026-59310) is being actively exploited just three days after patch release, according to threat intelligence from Defused.

    Source: RSS
  • Critical severity
    Critical VMware vCenter Flaw Exploited for Persistent Access (opens the source in a new tab)

    CVE-2026-59310 in VMware vCenter Syslog Server is being exploited in active campaigns to deploy reverse SSH tools for persistence and remote access. Global exploitation began earlier this month, and patching alone may not fully mitigate the threat.

    Source: RSS
  • Critical severity
    Metabase SQL Injection Enables Admin Access

    CVE-2026-72898: Unauthenticated remote attackers can inject arbitrary SQL into Metabase application database, granting administrator access to steal credentials and modify configurations.

    Source: KEV
  • Critical severity
    Multiple Critical WordPress Plugin Vulnerabilities

    Several WordPress plugins contain critical flaws including CVE-2024-13784 (ARForms PHP Object Injection), CVE-2026-18316 (Solace Extra unauthorized modification), CVE-2026-18432 (Frontend Admin privilege escalation), and CVE-2026-16098 (ProSolution arbitrary file upload).

    Source: CVE
  • Critical severity
    Scriban Template Engine Multiple Critical Flaws

    Template engine Scriban versions through 7.2.x contain multiple critical vulnerabilities including uncontrolled recursion, stack overflow, access modifier bypass (CVE-2026-73061), and DoS through memory exhaustion. Attackers can modify private properties and trigger resource exhaustion.

    Source: CVE
  • High severity
    macOS Screen Sharing Authentication Bypass Exploited (opens the source in a new tab)

    Netherlands NCSC warns that hackers are actively exploiting a macOS authentication bypass vulnerability to deploy Monero cryptocurrency miners after public exploit code emerged.

    Source: RSS
  • High severity
    Microsoft Windows AFD Use-After-Free Privilege Escalation

    CVE-2026-68820: Windows Ancillary Function Driver for WinSock contains use-after-free vulnerability allowing authorized attackers to elevate privileges locally.

    Source: KEV
  • High severity
    Cisco Firewall Heap Inspection DoS Vulnerability

    CVE-2026-20349: Cisco ASA and FTD devices vulnerable to unauthenticated remote DoS attacks causing unexpected device reloads through heap inspection flaw.

    Source: KEV
Data Breaches & Leaks2 critical · 5 high · 2 medium

Data Breaches & Credential Exposure

Major data breaches this week exposed over 1.8 million accounts across cryptocurrency platforms and enterprise services, with credential theft campaigns targeting government infrastructure.

Malware3 high · 2 medium

Emerging Malware Threats and Campaigns

New malware families targeting macOS and Linux systems, alongside persistent botnet operations converting IoT devices into proxy infrastructure.

Threat Actors3 high · 2 medium

Threat Actor Operations and Law Enforcement Actions

Banking fraud operations, espionage campaigns, and insider threats demonstrate diverse threat actor motivations and capabilities.

Malware4 high

Ransomware Activity

Ransomware groups posted 30 new victims this week, targeting infrastructure, manufacturing, government, and professional services sectors globally.

Tools & Techniques3 high · 1 medium

Adversary Tools, Techniques, and Procedures

Threat actors demonstrate advanced evasion techniques including EDR bypass, credential abuse, and novel authentication mechanisms.

  • High severity
    Safe Mode EDR Bypass Technique (opens the source in a new tab)

    Akira ransomware affiliates successfully disabled EDR solutions by restarting systems into Safe Mode with Networking, allowing data exfiltration while evading detection. Demonstrates limitations of traditional EDR in Safe Mode environments.

    Source: Manual
  • High severity
    SSRF Protection Bypasses via IPv4-Mapped IPv6

    Multiple vulnerabilities demonstrate SSRF protection bypasses using IPv4-mapped IPv6 addresses and 0.0.0.0, affecting compliance-trestle (CVE-2026-52776) and ContextForge DNS validation systems.

    Source: Manual
  • High severity
    OAuth Identity Linking Account Takeover

    Authorizer framework (CVE-2026-35511) vulnerable to zero-click account takeover via OAuth identity linking to unverified email accounts, enabling attackers to hijack accounts without user interaction.

    Source: Manual
  • Medium severity
    Apple Mercenary Spyware Threat Notifications (opens the source in a new tab)

    Apple sent new 'Threat Notification' alerts to iPhone users detecting mercenary spyware attacks. Apple updated notification system to better protect high-value targets from state-sponsored surveillance.

    Source: RSS
Policy1 high · 4 medium

Policy, Regulation, and Governance

Significant policy developments include authorization for private sector offensive operations and new legislation targeting critical infrastructure cybersecurity.

DFIR Lab4 medium

DFIR and Security Operations Insights

Research highlights operational security concerns and emerging detection/prevention capabilities in digital forensics and incident response.

Vulnerabilities2 medium

Service Availability and Infrastructure Incidents

Major service disruptions affected critical communications and AI platforms this week.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.