Cyber Resilience — News

KEV: CVE-2026-72898 — Metabase Metabase (Metabase SQL Injection Vulnerability)

Wed, 12 Aug 2026 13:40:34 +0000

CISA added CVE-2026-72898 to KEV: unauthenticated SQL injection in Metabase that yields admin access, credential theft, and data exfil. Patch immediately if you run Metabase yourself.

Microsoft releases Windows 10 KB5099539 extended security update

Wed, 12 Aug 2026 13:40:34 +0000

Microsoft shipped Windows 10 KB5099539, the July 2026 ESU rollup with that month’s Patch Tuesday fixes. If you still run Windows 10 under Extended Security Updates, install it.

KEV: CVE-2025-68686 — Fortinet FortiOS (Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability)

Wed, 12 Aug 2026 13:40:34 +0000

CISA added CVE-2025-68686 to KEV. It lets a remote unauthenticated attacker bypass a prior FortiOS symbolic-link patch via crafted HTTP requests, but only after filesystem-level compromise via another flaw. Patch if you run FortiOS yourself.

Mate Security Grows Over 500% Since Q3 2025 and Pushes Past $50M in Funding

Wed, 12 Aug 2026 13:40:34 +0000

Mate Security raised $35M Series A after 500% growth since Q3 2025, pitching an agentic AI SOC at Fortune 500 demand. Large enterprises shopping AI ops tooling may care; most smaller shops can ignore the pitch.

New critical CVE: CVE-2026-50522 — Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a

Wed, 12 Aug 2026 13:40:34 +0000

Another SharePoint deserialization RCE, critical severity. Not one of the three CVEs CISA says are under active exploitation (32201, 45659, 56164) — patch it anyway, on-prem SharePoint is now averaging multiple deserialization bugs per advisory cycle.

The Average Cost of a Data Breach Rises to $5 Million

Wed, 12 Aug 2026 13:40:34 +0000

IBM claims the average data breach now costs $4.99 million, with AI attacks a factor. A breach at a large enterprise means fines and restitution; at a resource-constrained business it can end the company overnight — either way, prevention beats cure.

Cisco security advisory (AV26-807)

Wed, 12 Aug 2026 13:40:34 +0000

Cisco advisory AV26-807 flags active exploitation in ASA and FTD software across multiple versions. Patch now if you run these yourself.

KEV: CVE-2026-0770 — Langflow Langflow (Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability)

Wed, 12 Aug 2026 13:40:34 +0000

CISA adds CVE-2026-0770 to KEV: unauthenticated remote code execution in Langflow, exploitation confirmed. Langflow instances get spun up for AI experiments and forgotten — whether you're an enterprise lab or a two-person shop, find yours, get it off the open internet, patch.

Leak-site claim: krybit lists hisstw.com

Wed, 12 Aug 2026 13:40:34 +0000

krybit claims hisstw.com as a victim. One source, no victim statement, no filing. Claim only — unverified.

Leak-site claim: krybit lists labindia.com

Wed, 12 Aug 2026 13:40:34 +0000

krybit lists labindia.com on its leak site. No filing, no confirmation — leak-site post only. Treat as claimed, not fact. Customers: watch card and account activity for fraud; be wary of 'urgent' emails citing this incident.

Leak-site claim: krybit lists lhyk.com.sg

Wed, 12 Aug 2026 13:40:34 +0000

krybit claims lhyk.com.sg as a victim. Single leak-site posting, no filing, no victim statement. Treat as unverified.

Patch bundle: July 2026 Security Updates — 1164 CVEs, 3 exploited

Wed, 12 Aug 2026 13:40:34 +0000

Microsoft's July 2026 bundle fixes 1164 CVEs including 3 already exploited in the wild (SharePoint CVE-2026-58644, two others). Patch those three out-of-band this week; the rest on your normal cycle. Lean-IT shops without SharePoint can largely ignore it; enterprises running on-prem SharePoint must treat the KEV trio as urgent.

Leak-site claim: qilin lists Wanted

Wed, 12 Aug 2026 13:40:34 +0000

qilin claims Wanted as a victim. Single leak-site posting, no filing, no victim statement. Treat as unverified.

Leak-site claim: SilentRansomGroup lists R... D...

Wed, 12 Aug 2026 13:40:34 +0000

SilentRansomGroup lists R...er on its leak site. Single leak-site posting, no filing, no victim statement. Treat as unverified until corroborated.

Leak-site claim: spacebears lists Basso Fedele & Figli S.r.l.

Wed, 12 Aug 2026 13:40:34 +0000

spacebears leak-site posting names Basso Fedele & Figli S.r.l. (Olio Basso) / Villa Raiano. Single leak-site posting, no filing, no victim statement. Treat as unverified until corroborated.

Leak-site claim: qilin lists Hoc

Wed, 12 Aug 2026 13:40:34 +0000

qilin's leak site lists Hoc. One source, no victim statement, no filing. Claimed — unconfirmed.

Leak-site claim: Orova lists Ganzhou Xinye Craft Co., Ltd.

Wed, 12 Aug 2026 13:40:34 +0000

Orova leak-site posting names Ganzhou Xinye Craft Co., Ltd.. Single leak-site posting, no filing, no victim statement. Treat as unverified.

Leak-site claim: Panzer lists Xpress Tech

Wed, 12 Aug 2026 13:40:34 +0000

Panzer's leak site lists Xpress Tech. One source, no victim statement, no filing. Claim only — unverified.

KEV: CVE-2026-20316 — Cisco Secure Firewall Management Center (FMC) (Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability)

Wed, 12 Aug 2026 13:40:34 +0000

CISA added CVE-2026-20316 to KEV: hard-coded password in Cisco Secure FMC, exploited as a zero-day. Patch if you run FMC (enterprises, MSPs); most smaller shops don't deploy it and can skip this.

Leak-site claim: qilin lists G.M.A.

Wed, 12 Aug 2026 13:40:34 +0000

qilin's leak site lists G.M.A. GRANDI MARCHE AUTOMOBILI - S.R.L. Single-source, no filing, no advisory. Claimed — unconfirmed.

Leak-site claim: qilin lists Crown Group

Wed, 12 Aug 2026 13:40:34 +0000

qilin's leak site lists Crown Group. No filing, no confirmation — leak-site post only. Treat as unverified.

KEV: CVE-2026-46817 — Oracle E-Business Suite (Oracle E-Business Suite Improper Privilege Management Vulnerability)

Wed, 12 Aug 2026 13:40:34 +0000

CVE-2026-46817 hits CISA's KEV: unauthenticated, network-reachable takeover of Oracle Payments in E-Business Suite, and exploitation is confirmed. If your EBS instance touches the internet, patch now — the module attackers get is the one that moves money.

Leak-site claim: dragonforce lists QPC Global

Wed, 12 Aug 2026 13:40:34 +0000

dragonforce leak-site posting names QPC Global. One source, no victim statement, no filing. Claimed — unconfirmed.

Leak-site claim: interlock lists AngMar Companies

Wed, 12 Aug 2026 13:40:34 +0000

interlock lists AngMar Companies on its leak site. The posting cites 710 GB. No filing, no confirmation — leak-site post only. Claim only — unverified.

KEV: CVE-2026-16812 — Arista VeloCloud Orchestrator (Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability)

Wed, 12 Aug 2026 13:40:34 +0000

CISA added CVE-2026-16812 to KEV: unauthenticated OS command injection in on-prem Arista VeloCloud Orchestrator, actively exploited. Patch VCO now if you self-host it; managed/cloud SD-WAN tenants can skip this one.

Tenable security advisory (AV26-724)

Wed, 12 Aug 2026 13:40:34 +0000

Tenable released a patch for critical vulnerabilities in Security Center 6.6.0–6.8.0. Update now if you self-host it (some enterprises); most smaller teams use the hosted Tenable.io or Vulnerability Management and can ignore this one.

Two new high severity WordPress vulnerabilities, patch immediately!

Wed, 12 Aug 2026 13:40:34 +0000

WordPress 7.0.2 patches CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API RCE) — both already under active exploitation per SecurityWeek and CCCS. If you run WordPress, update now; this is a huge share of lean-IT sites.

Leak-site claim: payload lists B&B Hydraulik

Wed, 12 Aug 2026 13:40:34 +0000

payload's leak site lists B&B Hydraulik. Single leak-site posting, no filing, no victim statement. Treat as claimed, not fact.

Leak-site claim: payload lists Stücheli Architekten

Wed, 12 Aug 2026 13:40:34 +0000

payload lists Stücheli Architekten on its leak site. No filing, no confirmation — leak-site post only. Claim only — unverified.

Leak-site claim: payload lists Baya Technologies

Wed, 12 Aug 2026 13:40:34 +0000

payload claims Baya Technologies as a victim. No filing, no confirmation — leak-site post only. Claimed — unconfirmed.

Leak-site claim: krybit lists www.kilpi-koskinen.fi

Wed, 12 Aug 2026 13:40:34 +0000

krybit claims www.kilpi-koskinen.fi as a victim. No filing, no confirmation — leak-site post only. Claim only — unverified.

Leak-site claim: krybit lists www.apsanet.com.ar

Wed, 12 Aug 2026 13:40:34 +0000

krybit claims www.apsanet.com.ar as a victim. Single leak-site posting, no filing, no victim statement. Claim only — unverified.

KEV: CVE-2026-25089 — Fortinet FortiSandbox (Fortinet FortiSandbox OS Command Injection Vulnerability)

Wed, 12 Aug 2026 13:40:34 +0000

CISA added CVE-2026-25089 (FortiSandbox OS command injection) to KEV. Unauthenticated remote code execution via crafted HTTP requests; patch the affected 4.4 and 5.0 branches now.

Leak-site claim: qilin lists Service Evaluation Concepts

Wed, 12 Aug 2026 13:40:34 +0000

qilin claims Service Evaluation Concepts as a victim. One source, no victim statement, no filing. Treat as unverified.

Leak-site claim: qilin lists tommer construction

Wed, 12 Aug 2026 13:40:34 +0000

qilin's leak site lists tommer construction. No filing, no confirmation — leak-site post only. Claimed — unconfirmed.

Leak-site claim: direwolf lists Leafwell

Wed, 12 Aug 2026 13:40:34 +0000

direwolf lists Leafwell on its leak site. Single leak-site posting, no filing, no victim statement. Claim only — unverified. If you're a customer: change that password anywhere you reused it, and watch your statements.

Leak-site claim: aurora lists FREYWILLE

Wed, 12 Aug 2026 13:40:34 +0000

aurora leak-site posting names FREYWILLE. One source, no victim statement, no filing. Treat as unverified until corroborated. If you're a customer: change that password anywhere you reused it, and watch your statements.

Microsoft unveils MAI-Cyber-1-Flash, promises cybersecurity AI at half the cost

Wed, 12 Aug 2026 13:40:34 +0000

Microsoft launches MAI-Cyber-1-Flash, its first cyber-specific model inside MDASH, claiming better CyberGym scores than Mythos and GPT-5.6 Sol at half the cost. Vendor numbers until someone independent runs the test.

Erlang security advisory (AV26-750)

Wed, 12 Aug 2026 13:40:34 +0000

Canadian Cyber Centre flagged two old OTP versions vulnerable in Erlang/OTP (10.2 before 11.7.4, 6.0 before 17.0.4). Patch if you run these yourself.

Bulletin de sécurité Red Hat (AV26-803)

Wed, 12 Aug 2026 13:40:34 +0000

Red Hat AV26-803 flags a vulnerability in Advanced Cluster Management for Kubernetes 2. Patch if you run it yourself; most smaller teams use hosted Kubernetes services and can ignore this one.

OpenAI Launches Two-Tier Security Access Program Alongside GPT 5.6 Cyber

Wed, 12 Aug 2026 13:40:34 +0000

OpenAI's GPT-5.6-Cyber is trained to find zero-days and build exploit chains with fewer refusals. No mechanism disclosed. Expanded access to frontier models will help arm defenders at least as much as attackers.

Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

Wed, 12 Aug 2026 13:40:34 +0000

Gunra ransomware is exploiting known Fortinet flaws (including MFA bypasses) and Schneider Electric bugs to hit critical infrastructure worldwide. Patch the affected systems now if you run them yourself; smaller teams may need to make sure their MSP patch the Fortinet flaws.

Grafana security advisory (AV26-796)

Wed, 12 Aug 2026 13:40:34 +0000

Canadian Cyber Centre issued an advisory on a vulnerability in Grafana MCP Server and mcp-grafana <=1.0.0. Update if you self-host (some enterprises); most smaller teams use hosted Grafana and can ignore this one.

Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days

Wed, 12 Aug 2026 13:40:34 +0000

Microsoft's August 2026 Patch Tuesday fixes 421 CVEs, including one exploited zero-day in afd.sys that reaches SYSTEM and two other zero-days. Patch today.

Pulsetto Vagus Nerve Stimulator

Wed, 12 Aug 2026 13:40:34 +0000

CISA advisory ICSMA-26-223-02 flags CVE-2026-18844 in all versions of the Pulsetto Vagus Nerve Stimulator: hidden commands can disable safety mechanisms or alter output.

Mira Hormone Monitor, Mira Android App

Wed, 12 Aug 2026 13:40:34 +0000

CISA reports that Mira Hormone Monitor firmware and the Mira Android app have multiple flaws that let attackers access or alter health data, steal session tokens, hijack accounts, or DoS the device. Update all affected versions if you use them.

8-K Item 1.05: Hewlett Packard Enterprise Co reports material cybersecurity incident

Wed, 12 Aug 2026 13:40:34 +0000

HPE filed an 8-K Item 1.05 disclosing a material cybersecurity incident. A giant can absorb this. If one breach could sink your company, rehearse it now: tested backups and an offline IR plan. Customers should watch for HPE notices.

Looks like JFrog's 0-days let OpenAI's models hack Hugging Face

Wed, 12 Aug 2026 13:40:34 +0000

Hugging Face experience with AI "Safety": 1) Compromised by an OpenAI model not available to the general public; 2) Asks another guardrailed model for assistance - the model refuses to help; 3) Turns to a Chinese model without guardrails to defend itself. What better illustration we must make frontier AI available to defenders.

Deloitte strengthens AI governance to support trusted enterprise adoption

Wed, 12 Aug 2026 13:40:34 +0000

Deloitte strengthens AI governance to support trusted enterprise adoption

Microsoft’s massive Patch Tuesday releases continue as AI reshapes bug discovery

Wed, 12 Aug 2026 13:40:34 +0000

Microsoft’s massive Patch Tuesday releases continue as AI reshapes bug discovery