Everything verified in the last 24 hours, held to a constant relevance bar. Read top to bottom, or load older findings to reach further back.
Latest findings
Five US agencies warn of an active threat to Siemens S7 PLCs — AI-written Python tooling built on the standard S7 libraries, dressed as legitimate OT monitoring software
The NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency issued a joint advisory on 2026-08-19 on an active threat to Siemens S7 Series programmable logic controllers, naming S7-200, S7-300, S7-400, S7-1200 and S7-1500 as actively targeted. Actors locate exposed controllers through internet-scanning services including Censys and ZoomEye and attack critical and high-severity vulnerabilities, outdated software and weak authentication. The tooling is the notable part: AI-developed Python scripts using the snap7.dll and python-snap7 libraries to speak S7comm, disguised as legitimate OT monitoring software, with read and write access to PLC memory, configuration data and ladder-logic programs. The agencies assess the activity as focused on persistent reconnaissance, potentially preparing for disruption, and state that ongoing PLC targeting is broader than Siemens.
DOJ's superseding indictment against Iran's Mabna Institute names Switzerland twice — among the countries whose universities were compromised, and among those whose companies had employee mailboxes taken
The US Department of Justice unsealed a 14-count superseding indictment on 2026-08-18 charging 17 members of the Mabna Institute, an Iran-based company that has run intrusions on behalf of the Islamic Revolutionary Guard Corps since at least 2013; nine were charged in 2018 and eight are new. The indictment covers 144 US and 178 foreign universities, at least 42 US and 11 foreign companies, at least five US federal and state agencies and two NGOs. DOJ's own release names Switzerland in both foreign-victim lists. The tradecraft is unglamorous and still current: spearphishing against academic staff, reuse of stolen credentials to log into professor accounts and pull research, and — for the corporate and government intrusions the new defendants are charged with — password spraying, which DOJ says cost victims more than $20 million to investigate and remediate.
Spain's Castilla-La Mancha regional government confirms a cyberattack after the Panzer extortion group lists it — the government confirms the intrusion, not the group's data claims
The regional government of Castilla-La Mancha confirmed to Spanish outlet Escudo Digital that it suffered a cyberattack, that all response protocols were activated, and that competent authorities and potentially affected individuals have been informed — after the extortion group Panzer listed the administration and claimed roughly 3 GB of stolen data. What Panzer claims to hold is education-heavy and includes minors: student and family records, Google Workspace user files, documentation on pupils with specific educational-support needs, school-census and electoral-process material, internal email and administrative documents. None of that is confirmed by the government, and Escudo Digital states plainly that the group's publication must be treated as a claim pending verification. No access vector has been stated by anyone.
Latvia's vehicle-registration authority lost payment records on two-thirds of the country's population — and the provider contractually watching its infrastructure round the clock did not notice
Latvia's Road Traffic Safety Directorate (CSDD), the national vehicle-registration and driver-licensing authority, states that between 8 and 10 August 2026 an attacker obtained payment-receipt data going back to 2008 on 1.2 million individuals and 200,000 legal entities — roughly two-thirds of Latvia's population. Names, personal identity codes, payment amounts and dates, licence plates and registered addresses were taken; phone numbers, email addresses, usernames and passwords were not. CSDD's own staff discovered and stopped the intrusion within hours, while its outsourced IT provider, contracted for round-the-clock monitoring, neither detected it nor alerted the agency. CERT.LV assesses the attack was targeted and preceded by preparation; a second targeted attempt the following weekend was blocked. The supervisory board has resigned and the agency's chief intends to.
Grandoreiro's loader decides it is in a sandbox when it finds seven ordinary desktop shortcuts — an inverted environment check, behind a two-hop DLL sideload
Acronis's Threat Research Unit analysed a Grandoreiro banking-trojan wave delivered as a renamed copy of the legitimate Duplicate Files Finder utility, which loads its genuine dependency and is in turn used to sideload a malicious library under the ordinary-looking name of a MinGW runtime component. Before any command-and-control attempt the loader runs a staged environment gate whose standout check is inverted: if desktop shortcuts for all seven of a named set of mainstream consumer applications are present at once, it concludes it is in an analysis image and terminates. Acronis's telemetry places the largest share of samples in Mexico, with Spain and several Latin American countries forming a secondary cluster and European presence described as limited but notable. The command-and-control server was offline during analysis, so the protocol detail is static analysis rather than observed traffic.
"Ransom Busters" emails ransomware victims before their incident is public, offering to delete the stolen data for a fee — and the tooling says it is the same affiliate who took it
GuidePoint Security's research team documents an entity calling itself Ransom Busters that emails ransomware victims at their own domain, asking for the CEO or IT leadership, claiming years of unauthorised access to criminal infrastructure and offering to return stolen files and delete the attackers' copies for $20,000-$60,000. The anomaly that gives it away is timing: the outreach arrives before the intrusion is public knowledge. Across two responses GuidePoint found the same reconnaissance scanner, the same cloud-exfiltration utility, the same remote-management tool installed by script, a local backdoor account with an identical fixed password and an identical attacker workstation name — an operator-level match recurring across incidents attributed to DragonForce, Settra and Anubis. GuidePoint assesses with moderate confidence this is one affiliate working across those programmes and diverting payments from them; Coveware independently confirmed responding to at least one incident with contact from the same party.
Oracle's August 2026 Critical Security Patch Update carries three unauthenticated CVSS 10.0 flaws — one of them in the LDAP server of Oracle Internet Directory
Oracle published its August 2026 Critical Security Patch Update — its monthly release, distinct from the quarterly cumulative Critical Patch Update — on 2026-08-18 with 943 new security patches, and Switzerland's NCSC relayed it to its own constituency the following day. Three flaws in the release carry a CVSS 3.1 base score of 10.0 with Privileges Required and User Interaction both None in Oracle's own risk matrix: CVE-2026-61241 in the LDAP server of Oracle Internet Directory, and CVE-2026-70880 and CVE-2026-70921 in Hyperion Data Relationship Management and Hyperion Financial Management. Fusion Middleware alone accounts for 262 patches of which Oracle states 182 may be remotely exploitable without authentication, and E-Business Suite for 120 of which 27 may be. No flaw in this cycle is reported as exploited by any source.
CVE-2026-64849 — MLflow: the SSRF guard resolves the webhook host and then throws the answer away, so one redirect turns an unauthenticated tracking server into a reader of its own cloud credentials
CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities catalog on 2026-08-19 with a 2026-09-02 remediation date, recording confirmed exploitation of a server-side request forgery in MLflow. On a default MLflow tracking server the model-registry webhooks API is unauthenticated, including a test endpoint that returns the upstream response status and body to the caller. The URL guard resolves the webhook hostname and rejects non-public addresses at registration, but never pins the resolved address to the connection, and delivery follows HTTP redirects without re-validating where they lead — so a webhook pointed at an attacker-controlled public HTTPS host that answers with a redirect reaches internal and cloud instance-metadata services and reflects what it finds. Fixed in MLflow 3.15.0.
CVE-2026-73570 — Zimbra Collaboration: a pre-auth command injection patched without a CVE in July is now recorded as actively exploited, four weeks after the fix shipped
Zimbra shipped ZCS 10.1.20 on 2026-07-21 with a fix for a command injection in the SNMP monitoring component, described at the time only in general terms and with no vulnerability flagged as exploited. The identifier CVE-2026-73570 was published on 2026-08-13, and ENISA's EU Vulnerability Database now records the flaw as exploited since 2026-08-18 — a determination CERT-FR relayed to its constituency on 2026-08-19. The flaw needs no authentication: improper sanitisation of untrusted input during SNMP notification processing lets a crafted SMTP request reach arbitrary operating-system command execution as the Zimbra user. It applies only where the optional zimbra-snmp package is installed and SNMP notifications are enabled, which is the check that decides whether an estate is affected at all.
CVE-2026-19490 — Citrix NetScaler: an authentication bypass on Gateway and AAA virtual servers (CVSS 9.3), and on older builds no SAML configuration is needed to be exposed
Citrix published a bulletin on 2026-08-19 covering two NetScaler ADC and NetScaler Gateway flaws, relayed the same day by CERT-EU as advisory 2026-010. CVE-2026-19490 is an authentication bypass using an alternate path, scored 9.3, against appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server; CVE-2026-19489 is a memory overflow reachable only where SIP ALG is enabled on a Large Scale NAT group. The exposure boundary is the operationally important part: on 14.1-43.56 and 13.1-61.28 and later the bypass applies only when a SAML action is configured, but on earlier builds and on 13.1 FIPS any Gateway or AAA virtual server configuration is enough. Fixed in 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS and 13.1-37.277. Rapid7 reports no observed exploitation as of 2026-08-19 and still recommends emergency patching.