CyberWatch Newsroom Live Intel

Moderate Rapid7 Threat Research

2026-08-27 Rapid7 Threat Research

Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

Introduction Despite modern verification controls, identity theft remains one of the most pervasive threats to both individuals and enterprise organizations. U.S. Federal Trade Commission statistics show over 1 million identity theft reports annually, with related fraud and imposter scams accounting for billions in financial losses each year. While stolen cr…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Metasploit & Exploit Research

Advisory

Important KrebsOnSecurity

2026-08-27 KrebsOnSecurity

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticate...

Fix: Review advisory details and verify patch status across affected endpoints.

Threat Intelligence

Advisory

Moderate Kaspersky Securelist

2026-08-27 Kaspersky Securelist

Threat landscape for industrial automation systems. Q2 2026

All threats In Q2 2026, the percentage of ICS computers on which malicious objects were blocked continued to decrease, falling to 19.15%, its lowest level since 2022. Percentage of ICS computers on which malicious objects were blocked, Q3 2023–Q2 2026 Regionally, the percentages ranged from 8.1% in Northern Europe to 27.9% in Africa. Regions ranked by percen…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Important Cisco Talos Intelligence

2026-08-27 Cisco Talos Intelligence

JavaScript obfuscation: From party trick to phishing kit

We open a JavaScript artifact hoping for code, and instead get string arrays, strangely named functions, encoded URLs, runtime decoders, and eval statements. That is the point where “reading the script” stops being enough. Obfuscated JavaScript is still code, but it is code with the useful context stripped out, the names ruined, the strings hidden, and the r…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Telemetry & Research

Advisory

Moderate Graham Cluley Security

2026-08-27 Graham Cluley Security

US Navy tells sailors and their families: scrub your social media, enemies are watching

The US Navy has told its entire workforce of 340,000 active-duty personnel, 58,000 reservists, and 210,000 civilian employees to clean up their social media profiles, because adversaries might be using them to determine who they are, where they live, and when they may not be at home. Read more in my article on the Hot for Security blog.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Infosec Commentary & Leaks

Advisory

Moderate Graham Cluley Security

2026-08-26 Graham Cluley Security

Smashing Security podcast #482: This hacker leaked GTA 6 – and launched their own cryptocurrency

A hacker calling themselves "CYBERLEEK" has been leaking gameplay footage from GTA 6 ahead of its official reveal this week - but they're not asking Rockstar Games for a ransom. Instead, they've launched their own cryptocurrency, promising to release ever more juicy clips from a virtual strip club... Meanwhile, your smart TV might be doing more than binge-wa…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Infosec Commentary & Leaks

Advisory

Moderate Qualys Security Blog

2026-08-26 Qualys Security Blog

Beyond Patching: What IT Teams Need to Know About Unpatchable Exposures

Executive Summary Most IT teams still operate under a false binary: patch or accept risk . That assumption creates unnecessary operational pressure. Patchless remediation is real and production-proven. Mitigate, Uninstall, Run Custom Scripts, Isolate ; close exposure when no reliable patch exists. Same-day exposure neutralization becomes possible for CISA KE…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Vulnerability Research & Audits

Advisory

Important Qualys Security Blog

2026-08-26 Qualys Security Blog

When an AI Agent Turned Attacker: What Qualys Sees Across Every Phase of the Hugging Face Kubernetes Intrusion

A phase-by-phase detection mapping of the first publicly documented autonomous agent intrusion against production infrastructure — including the phases where no product in our category sees anything at all. Executive Summary On July 9, 2026, an autonomous AI agent running inside an OpenAI capability evaluation escaped its sandbox and launched a multi-day int…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Vulnerability Research & Audits

Advisory

Important CVE-2026-15409 SentinelOne Threat Labs

2026-08-26 SentinelOne Threat Labs

Edge Infrastructure Under Siege: What Two Independent Datasets Reveal About Who’s Exploiting Your Perimeter

A joint Tenable -SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. It is the shared attack surface where state-sponsored threat actors and financially motivated criminal groups independently converge — not the province of a single adversar…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Endpoint & Ransomware Labs

Advisory

Moderate Cisco Talos Intelligence

2026-08-26 Cisco Talos Intelligence

Choose your fighter: Balancing competing requirements to select models for your AI SOC

Selecting a model for your security operations center (SOC) and digital forensics and incident response (DFIR) tasks is important, but selecting the best one is more involved than you might think. SOC tasks rely on a combination of model efficacy, analysis time, cost, and consistency of results. Cisco Talos tested 66 model and reasoning combinations across o…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Telemetry & Research

Advisory

Important CVE-2018-0802 Kaspersky Securelist

2026-08-26 Kaspersky Securelist

Exploits and vulnerabilities in Q2 2026

The vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of vulnerabilities emerging, particularly in the Linux networking subs…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate SentinelOne Threat Labs

2026-08-25 SentinelOne Threat Labs

The Path to the Autonomous SOC: The Early Returns of AI & What It Means for Cybersecurity

The question has shifted. Security leaders spent several years debating whether AI would reshape security operations. That debate has settled. Now the conversation is about pace. How fast can the foundation be built, and what do organizations that moved early have to show for it? For the second year, SentinelOne® commissioned 451 Research to survey 611 North…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Endpoint & Ransomware Labs

Advisory

Important Palo Alto Unit 42

2026-08-25 Palo Alto Unit 42

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution appeared first on Unit 42 .

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

APT Threat Hunting

Advisory

Moderate Cisco Talos Intelligence

2026-08-25 Cisco Talos Intelligence

The safety penalty: Reclaiming operational sovereignty in the age of AI

As frontier models advance in cyber capability, their guardrails also become more restrictive. Defenders relying on these models to power core SOC processes cannot afford to pay the “safety penalty” of being blocked by these safeguards. Organizations should monitor model refusal rates and use the data to create a strategy to ensure operational sovereignty. T…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Telemetry & Research

Advisory

Critical CVE-2026-69414 Qualys Security Blog

2026-08-25 Qualys Security Blog

CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days

Executive Summary ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026, and Microsoft assigned the CVE on August 14, and no patch is available yet. Qualys…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Vulnerability Research & Audits

Advisory

Critical CVE-2026-63520 Rapid7 Threat Research

2026-08-24 Rapid7 Threat Research

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Latest threat intelligence analysis from Rapid7 Threat Research: Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520).

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Metasploit & Exploit Research

Advisory

Moderate Graham Cluley Security

2026-08-24 Graham Cluley Security

Malicious Firefox add-ons caught stealing cryptowallet seed phrases and browser credentials

Every time you add an extension or plugin to your browser, there's a risk that you might be doing more than managing your cryptocurrency wallet, generating passwords, taking notes, or tracking sports results. There's a chance that you have just handed a complete stranger access to your savings. Read more in my article on the Hot for Security blog.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Infosec Commentary & Leaks

Advisory

Moderate CVE-2026-19478 Check Point Research

2026-08-24 Check Point Research

24th August – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 24th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Latvia’s Road Traffic Safety Directorate (CSDD) has confirmed a breach affecting payment records of more than 1.2 million people – roughly two-thirds of the country’s population – as well as 200,000 organization…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Exploit Research & Analysis

Advisory

Critical Graham Cluley Security

2026-08-24 Graham Cluley Security

Gunra ransomware: what you need to know

The ransomware gang Gunra has been creating havoc - exploiting unpatched VPNs and firewalls to steal data, encrypt systems, and extort victims across healthcare, finance, manufacturing, and more. Read more in my article on the Fortra blog.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Infosec Commentary & Leaks

Advisory

Moderate Palo Alto Unit 42

2026-08-21 Palo Alto Unit 42

Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42 .

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

APT Threat Hunting

Advisory

Moderate CVE-2026-33824 SentinelOne Threat Labs

2026-08-21 SentinelOne Threat Labs

The Good, the Bad and the Ugly in Cybersecurity – Week 34

The Good | U.S. Charges Iranian Cyberattackers Over Mass Intellectual Property Theft The U.S. Justice Department has indicted 17 Iranian nationals associated with the Mabna Institute, a state-sponsored hacking-for-hire firm , for executing a massive global cyber espionage campaign. Operating since 2013, the malicious network systematically targeted academic …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Endpoint & Ransomware Labs

Advisory

Moderate Kaspersky Securelist

2026-08-21 Kaspersky Securelist

The invisible passenger in your car

While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app might be reaching users’ devices without their knowledge. Further …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate Cisco Talos Intelligence

2026-08-20 Cisco Talos Intelligence

Is Cyber missing the Marque?

Welcome to this week’s edition of the Threat Source newsletter. Hello friend. I’m Mick . This is my first Threat Source newsletter, so I should probably introduce myself before I start telling you all the things I think you should be paying attention to. With assistance from an unnamed LLM, my bio reads like this: Mick Baccio is a globally recognized securit…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Telemetry & Research

Advisory

Important Check Point Research

2026-08-20 Check Point Research

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

Research by: Jiří Vinopal ( @vinopaljiri ) Abstract What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver could be instructed to execute arbitrary file and registry operations from Ring 0 – without exploits, vulnerabilities, or memory corruption? In this publicatio…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Exploit Research & Analysis

Advisory