OSINT / CyberSec report 13.08.2026 00:08

1. Threat actors are actively exploiting a critical directory traversal vulnerability in VMware vCenter tracked as CVE-2026-59310 to gain persistent remote access (thehackernews.com).

2. CISA confirmed that ransomware groups are actively abusing a high severity remote code execution vulnerability in Microsoft SharePoint tracked as CVE-2026-55040 (bleepingcomputer.com).

3. Cisco reported that CVE-2026-20349, a high severity flaw in ASA and FTD software, is being exploited in the wild to trigger remote denial of service conditions (thehackernews.com).

4. Microsoft released security updates for August 2026 addressing 398 vulnerabilities, including one Windows kernel driver zero day under active exploitation (thehackernews.com).

5. The Gunra ransomware operation is targeting critical infrastructure by exploiting vulnerabilities in Fortinet and Schneider Electric products (thehackernews.com).

6. The DeadLock ransomware group has adopted decentralized blockchain backed infrastructure to protect its communication and data leak operations (thehackernews.com).

7. Russian state linked actor UAC-0145, a subgroup of Sandworm, is using fake job offers to distribute trojanized VPN clients to IT professionals (thehackernews.com).

8. Malicious LiteLLM releases on PyPI previously exposed sensitive credentials including cloud and SSH keys for over 2100 organizations (thehackernews.com).

9. Researchers identified a new version of the Kimwolf botnet, v7, which targets Android and IoT devices using HTTP/2 fingerprinting for stealthy DDoS attacks (thehackernews.com).

10. A critical vulnerability in SAP Commerce Cloud, CVE-2026-58231, allows unauthenticated attackers to execute arbitrary code due to insufficient authorization checks (thehackernews.com).

11. Mozilla revoked its Firefox and Thunderbird Linux signing key after an unencrypted copy was accidentally committed to a private repository (thehackernews.com).

12. Cloudflare reported a 519 percent surge in hyper volumetric DDoS attacks exceeding 1 Tbps during the first half of 2026 (blog.cloudflare.com).

13. Researchers discovered that malicious Model Context Protocol servers can split instructions to trick AI coding agents into exfiltrating secrets (reddit.com).

14. A security researcher released a proof of concept for ShieldBreak, a zero day vulnerability in Microsoft Defender that bypasses patches for CVE-2026-50656 (thehackernews.com).

15. Vulnerabilities in the Zoom annotation tool could allow meeting participants to hijack the computers of other attendees (thehackernews.com).