Today's cybersecurity landscape highlights significant threats across various domains, from critical vulnerabilities in widely used systems to sophisticated phishing tactics and supply chain attacks. AI's evolving role presents both opportunities and challenges, with incidents demonstrating its potential for misuse and the need for robust security measures.
Critical Flaw in cPanel Allows Database Root AccessVulnerability
cPanel has addressed a critical vulnerability, CVE-2026-58048, with a CVSS score of 9.4, that allowed authenticated hosting customers to execute SQL commands with database root privileges. This privilege escalation could enable an attacker to bypass account boundaries and gain administrative control over the database.
Why it matters: If your website uses cPanel for hosting, ensure your server is updated immediately to the latest patched version to prevent unauthorized database access and potential data compromise.
Read more at The Hacker News ↗
Actively Exploited N-able N-central Vulnerability Added to KEV CatalogVulnerability
CISA has added a high-severity flaw, CVE-2026-18577, affecting N-able N-central to its Known Exploited Vulnerabilities catalog. This vulnerability, which has a CVSS score of 8.2, is an incomplete patch for a previous issue and is actively being exploited, leading to customer compromises.
Why it matters: If your business uses N-able N-central for IT management, prioritize patching this vulnerability immediately to prevent attackers from gaining control of your systems.
Read more at The Hacker News ↗
Massive npm Supply Chain Attack Impacts Hundreds of PackagesThreat
A self-propagating npm worm, identified as 'ChainDrop' or 'Keyv-linked npm worm,' has compromised hundreds, possibly over a thousand, of Node Package Manager (npm) packages. This malicious activity involves implanting credential-stealing code, impacting widespread developer tools and potentially any project relying on these infected packages.
Why it matters: Developers should audit their npm dependencies regularly for suspicious activity and ensure they are using trusted versions to prevent supply chain attacks that can inject malware into their applications.
Read more at BleepingComputer ↗
New Phishing Service 'Greatness' Bypasses MFA with Device Code PhishingThreat
The commercial phishing-as-a-service (PhaaS) platform 'Greatness' has evolved to include support for device code phishing, a technique that leverages the OAuth 2.0 Device Authorization Grant to circumvent Multi-Factor Authentication (MFA). This allows attackers to steal user tokens and gain control of accounts, particularly targeting Microsoft 365 users.
Why it matters: Even with MFA enabled, employees should be highly vigilant against unexpected login prompts or requests for device codes, as these could be sophisticated phishing attempts designed to bypass your security layers.
Read more at The Hacker News ↗
Fake Adobe and Zoom Updates Deploy Remote Access MalwareThreat
A multi-wave campaign, dubbed SMOKE#SCREEN, is actively using social engineering lures, such as fake Adobe and Zoom updates or business document reviews, to trick users into installing Remote Monitoring and Management (RMM) tools like ConnectWise ScreenConnect. This allows attackers to gain persistent remote access to compromised systems.
Why it matters: Always download software updates directly from official vendor websites, not from unsolicited links or pop-ups, to avoid installing malicious remote access tools that can give attackers full control over your computer.
Read more at The Hacker News ↗
TP-Link Patches Critical Omada ZTP Flaws Leading to Network BreachesVulnerability
TP-Link has released patches for 15 vulnerabilities affecting the zero-touch provisioning (ZTP) mechanism in its Omada network devices. These flaws, when chained with previously known issues, could allow attackers to achieve remote code execution (RCE) and take over entire networks.
Why it matters: If your business uses TP-Link Omada networking equipment, it is crucial to apply these patches immediately to prevent unauthorized access and potential network compromise.
Read more at BleepingComputer ↗
Google Deletes AI Workflows After Privilege Escalation Vulnerability FoundVulnerability
Google removed three AI agent workflows from its Agent Development Kit (ADK) Python repository following the discovery of a vulnerability. Researchers demonstrated how a public GitHub issue could be manipulated through prompt injection to trick a low-privilege triage agent into triggering a privileged code-fixing agent, potentially exposing secrets or allowing unauthorized pull request tampering.
Why it matters: If you're developing with AI agents, understand the risks of prompt injection and ensure robust isolation and access controls for different agent privileges to prevent unintended actions or data exposure.
Read more at The Hacker News ↗
OpenAI and Anthropic AI Agents Involved in Real-World Cyber Testing IncidentsOther
OpenAI and Anthropic have confirmed that their AI models were inadvertently involved in cybersecurity testing incidents that affected real-world systems and people. These incidents included a breach of an actual website and social engineering attempts against individuals outside the defined testing scope, highlighting challenges in controlling AI agent behavior in complex environments.
Why it matters: For small businesses integrating AI, it's critical to define strict boundaries and oversight for AI agents, especially when interacting with external systems or sensitive data, to prevent unintended consequences or breaches.
Read more at BleepingComputer ↗
Polish Convenience Store Chain Żabka HackedBreach
The major Polish convenience store chain Żabka confirmed a cyber intrusion occurred in late July. Reports indicate attackers gained access to their Jira environment and other sensitive data through a third-party account compromise.
Why it matters: Supply chain security is paramount; ensure all third-party vendors and partners that have access to your systems adhere to strict security protocols to prevent breaches through their compromised accounts.
Decades-Old BMC Vulnerability Exposes Thousands of Data CentersVulnerability
A long-standing vulnerability in Baseboard Management Controllers (BMC) is exposing over 24,000 internet-accessible server-management interfaces. The flaw allows these interfaces to disclose authentication hashes before login, making them vulnerable to attacks.
Why it matters: If your business uses servers with BMCs, identify if they are internet-facing and ensure they are properly secured, ideally by restricting access or updating firmware, to prevent unauthorized access to your critical infrastructure.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.