About this episode
This week examines actively exploited flaws affecting network, virtualization, collaboration, and enterprise platforms; phone and job-interview social engineering; ransomware, data breaches, and port disruption; and the growing tension between AI privacy, visibility, and delegated access.
This episode brings together the week’s most relevant cybersecurity stories and their operational context for defenders.
Play the episode, then review the stories and chapter list for the reporting and topics covered.
Stories covered this week
Cisco Warns of High-Severity VPN Flaw Actively Exploited to Crash Devices
Cisco has issued a warning about a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense VPN software that is being actively exploited to remotely crash affected devices. The flaw poses a significant risk to enterprise network stability.
Source: BleepingComputer
Critical VMware vCenter Vulnerability Actively Exploited for Remote Access
Threat actors are exploiting the newly patched critical directory-traversal flaw CVE-2026-59310 in VMware vCenter, allowing remote code execution. This vulnerability carries a CVSS score of 9.8 and requires immediate attention from network defenders.
Source: The Hacker News
AI-Assisted Exploit Enables Unauthenticated RCE on SharePoint Servers
Researchers uncovered a critical SharePoint vulnerability (CVE-2026-55040) allowing unauthenticated remote code execution, aided significantly by an AI agent. The flaw affects multiple SharePoint Server versions, including Subscription Edition, 2019, and 2016.
Source: The Hacker News
Microsoft Defender 'ShieldBreak' Zero-Day Grants SYSTEM Privileges
A new zero-day exploit named 'ShieldBreak' targeting Microsoft Defender was released by Nightmare Eclipse following the August 2026 Patch Tuesday updates. This exploit allows attackers to gain SYSTEM-level privileges on affected machines.
Source: BleepingComputer
Critical SAP Commerce Cloud RCE Flaw Targeted in Active Attacks
A maximum-severity remote code execution vulnerability in SAP Commerce Cloud patched just three days ago is already being actively exploited, warns threat intelligence firm Defused. Immediate patching is advised to prevent attacks.
Source: BleepingComputer
Critical RCE Vulnerability in Siemens Siveillance Video Management Servers
A critical remote code execution vulnerability (CVE-2026-3014) affects Siemens Siveillance Video Management Servers. Siemens urges users to update to the latest patches to mitigate exploitation risks.
Source: CISA
Kimsuky Develops Offline AI Stack to Enhance Phishing and Malware
North Korea’s APT group Kimsuky has built an offline AI infrastructure to improve phishing and automate malware creation, using AI privately on their own servers. This innovation links document search tools to their files and integrates AI components into malware development.
Source: The Hacker News
UNC6671 Vishing Attacks Target Phones to Steal SaaS Data
The UNC6671 group is using vishing attacks, impersonating IT help desk staff to trick employees into security migrations and steal SaaS data. These attacks primarily target financial services, private equity, and professional sectors.
Source: The Hacker News
Sandworm-Linked Group Uses Fake Job Interviews to Deploy Malware
CERT-UA reports that Russian threat actors from Sandworm subgroup UAC-0145 are targeting Ukrainian IT workers with fake recruiter job interviews to install malware through a malicious VPN tool. This social engineering campaign is a sophisticated effort to gain remote command execution on victim systems.
Source: The Hacker News
Lazarus Group Exploits Windows Zero-Day to Deploy New Backdoor
North Korea's Lazarus Group exploited a recently patched Windows zero-day vulnerability to deliver a new backdoor targeting defense and aerospace firms in multiple countries. This activity is part of the broader Operation Dream Job cyber espionage campaign.
Source: The Hacker News
Jewelbug Hackers Breach Govt Webmail While Conducting Crypto Fraud
The Jewelbug hacker group has been simultaneously running espionage campaigns targeting government and military webmail accounts while conducting cryptocurrency fraud schemes. This dual-threat approach demonstrates their evolving tactics in cyber espionage and financial crime.
Source: BleepingComputer
Akira Ransomware Bypasses EDR Using Safe Mode, Steals Data but Fails to Encrypt
An Akira ransomware affiliate disabled endpoint detection and response by rebooting systems into Safe Mode with Networking, allowing data theft though encryption failed. This technique highlights a notable evasion tactic against EDR solutions.
Source: BleepingComputer
Hundreds of Fake Chrome VPN Extensions Route Traffic Through Proxy
Over 737 fake VPN and proxy extensions on the Chrome Web Store routed user traffic through SOCKS5 proxies operated by a single entity, impersonating popular services. These malicious extensions pose a significant privacy and security risk to users.
Source: BleepingComputer
#StopRansomware: Emerging Gunra Ransomware Threat
Gunra ransomware, a double-extortion RaaS targeting government and critical infrastructure, exploits VPN and RDP vulnerabilities for initial access. It encrypts data with ChaCha20 + RSA-4096 and threatens to leak stolen information on dedicated Tor-based leak sites.
Source: CISA
RingCentral Data Breach Exposes 1.6 Million User Accounts
The ShinyHunters extortion group breached RingCentral in July, compromising personal data from 1.6 million accounts. The incident was disclosed via Have I Been Pwned's data breach notification service.
Source: BleepingComputer
Trezor reports data breach impacting nearly 14,000 customers
Hardware wallet maker Trezor disclosed a data breach affecting almost 14,000 customers after its logistics provider ShipMonk was hacked, exposing customer data. Trezor emphasizes no wallet security or funds were compromised.
Source: BleepingComputer
North Carolina Ports Hit by Cyberattack Disrupting Operations
The North Carolina Ports Authority confirmed a cyberattack affecting IT systems at Port of Wilmington, Port of Morehead City, and Charlotte Inland Port, resulting in operational delays. The incident highlights growing risks to critical infrastructure.
Source: BleepingComputer
Google Advances Private AI Using Homomorphic Encryption with HEIR
Google introduced HEIR, an open-source compiler enhancing homomorphic encryption for private AI computations. This tool enables secure data processing without exposing sensitive information.
Source: Google
AI Delegation Risks: When Broad Access Leads to Security Exposure
AI agents with vague or broad access permissions can extend beyond their intended tasks, creating significant security risks for enterprises. Token Security highlights the need for clear definition of agent intent and strict permission enforcement.
Source: BleepingComputer
Chapters
- Opening
- Cisco Warns of High-Severity VPN Flaw Actively Exploited to Crash Devices
- Critical VMware vCenter Vulnerability Actively Exploited for Remote Access
- AI-Assisted Exploit Enables Unauthenticated RCE on SharePoint Servers
- Microsoft Defender 'ShieldBreak' Zero-Day Grants SYSTEM Privileges
- Critical SAP Commerce Cloud RCE Flaw Targeted in Active Attacks
- Critical RCE Vulnerability in Siemens Siveillance Video Management Servers
- Kimsuky Develops Offline AI Stack to Enhance Phishing and Malware
- UNC6671 Vishing Attacks Target Phones to Steal SaaS Data
- Sandworm-Linked Group Uses Fake Job Interviews to Deploy Malware
- Lazarus Group Exploits Windows Zero-Day to Deploy New Backdoor
- Jewelbug Hackers Breach Govt Webmail While Conducting Crypto Fraud
- Akira Ransomware Bypasses EDR Using Safe Mode, Steals Data but Fails to Encrypt
- Hundreds of Fake Chrome VPN Extensions Route Traffic Through Proxy
- #StopRansomware: Emerging Gunra Ransomware Threat
- RingCentral Data Breach Exposes 1.6 Million User Accounts
- Trezor reports data breach impacting nearly 14,000 customers
- North Carolina Ports Hit by Cyberattack Disrupting Operations
- Google Advances Private AI Using Homomorphic Encryption with HEIR
- AI Delegation Risks: When Broad Access Leads to Security Exposure
- Closing