The Hacker News

While AI coding tools offer upsides such as faster development and more code, they pose challenges for security teams. The rapid introduction of open-source packages via AI can result in managing numerous dependencies. This increases vulnerabilities, leading to a growing backlog and increased remediation work.

Red Hat and the Keycloak project released patches addressing a critical security flaw in the open-source identity and access management server. This vulnerability, identified as CVE-2026-18963, could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. Red Hat assigned this flaw a 9.1 rating on the CVSS scoring system.

Cybersecurity researchers identified Operation QUICSILVER, a cyber espionage campaign targeting Myanmar's government and information technology sectors. This campaign uses graduation ceremony invitation lures to deliver a Go backdoor named QUICAgent. Seqrite Labs assessed that this activity originates from a China-nexus threat actor.

A more urgent security threat comes from AI super-adopters who are hardcoding unvetted tools into critical business operations. While enterprise security teams focus on general employee usage of tools like ChatGPT and Claude, new research published by Akamai warns about this specific risk posed by the top 5% of enterprise power users.

Cybersecurity researchers disclosed details of UAT-10147, a Chinese-speaking cybercrime group that targets Windows and Linux web servers globally. The attacks span multiple sectors including education, media, technology, and gaming. The vast majority of the targeted systems are located in Brazil, Bolivia, China, Canada, and Vietnam.

A newly disclosed security flaw in GitLab, identified as CVE-2026-19478, is under active exploitation shortly after public disclosure. This vulnerability is a code injection that permits an unauthenticated attacker to modify or delete publicly accessible projects and rewrite their data on GitLab under specific conditions.

Microsoft issued a warning about a maximum-severity security flaw in Entra ID, which was reportedly exploited in the wild. The vulnerability, tracked as CVE-2026-69836 and assigned a CVSS score of 10.0, allows for remote code execution impacting Microsoft's cloud-based identity and access management service.

Security researchers at Cycode disclosed a chain of flaws in AIT-GUI, the operator console for NASA/JPL's open-source AMMOS Instrument Toolkit. These flaws allow an unauthenticated attacker to issue arbitrary commands to the software’s spacecraft and instrument command bus. The vulnerability was tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on CVSS v3.1.

Cybersecurity researchers identified an updated version of ToxicPanda 2.0, also known as TgToxic, featuring significant enhancements including a set of 167 remote commands and expanded global targeting. The Android malware specifically features a PIN harvesting workflow that targets over 140 banking and cryptocurrency applications.

Cybersecurity researchers disclosed a critical flaw in the Elementor Pro WordPress plugin that could allow unauthenticated attackers to upload PHP and execute code. The vulnerability, designated CVE-2026-32475, has a CVSS score of 9.0 out of 10.0 and involves an unrestricted file upload mechanism within the Forms module.

Cybersecurity researchers flagged a global cybercrime operation that abuses thousands of hacked WordPress websites. This infrastructure is used to spread malware and steal data, commandeering infected hosts. The criminals store stolen documents, screenshots, and activity logs using an entire toolkit of criminal software.

CISA added four critical vulnerabilities related to macOS, SharePoint, vCenter, and Microsoft IKE to its Known Exploited Vulnerabilities catalog. CISA stated that these shortcomings are being exploited in the wild. One specific vulnerability noted is CVE-2026-65400, which is an improper authentication flaw impacting Apple macOS.

Microsoft Defender Experts linked over 30 web domains to MacSync Stealer, a macOS-focused information stealer. The investigation correlated recurring endpoint and network behaviors across changing infrastructure, allowing tracking of the malware's process from payload retrieval through data collection, staging, and exfiltration.

New findings revealed a JavaServer Pages (JSP) web shell targeting enterprise Product Lifecycle Management (PLM) software, specifically connected to PTC Windchill and FlexPLM servers. This web shell was deployed after exploiting a critical security flaw and is characterized as an extortion platform capable of mapping sensitive data.

Cybersecurity researchers flagged a new typosquatting campaign targeting RubyGems users using a Windows-based information stealer. This campaign steals browser credentials and crypto wallets. OpenSourceMalware discovered the threat, which is currently being tracked under the moniker StubMaker.

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year. According to research published by agent security platform Reco, this activity was named the City Forum campaign and traces back to server 158.220.87.79.

SafePal disclosed that an authorization flaw in an order-tracking plug-in exposed personal data belonging to approximately 39,798 customers. The exposed information included names, email addresses, shipping addresses, phone numbers, and purchase details. Affected customers were individually notified via email on August 16.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical flaw affecting Ray to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. This vulnerability can potentially trigger a browser-based RCE. Ray is described as an open-source, Python-native distributed computing framework used for scaling AI and machine learning workloads.

Cybersecurity researchers flagged a previously undocumented Linux botnet family called Evooo1Bot. This malware derives its core functionality from the Mirai botnet source code and can turn internet-facing devices into SOCKS proxies. Although it reuses the DDoS engine, the botnet extends the original framework with numerous capabilities.

Threat actors are exploiting a newly disclosed Microsoft SharePoint vulnerability, CVE-2026-55040 (CVSS score: 9.1), after the release of a public proof-of-concept code. This critical flaw involves weak authentication and was patched by Microsoft during its July 2026 Patch Tuesday updates.