Today's cybersecurity landscape highlights critical vulnerabilities across major platforms like WordPress and Linux, alongside significant data breaches impacting millions. Threat actors are employing sophisticated phishing techniques and exploiting open-source software to deploy a range of malware.
Critical WordPress XSS Flaw DiscoveredVulnerability
A serious pre-authentication reflected cross-site scripting (XSS) vulnerability, tracked as CVE-2026-64638 with a CVSS score of 8.9, has been found in the WordPress login screen. This flaw affects all versions of the CMS and can be chained to achieve PHP code execution on the server if a logged-in administrator interacts with an attacker-controlled page.
Why it matters: If you use WordPress, update your installation immediately to protect your website from potential remote code execution and maintain its integrity.
Read more at The Hacker News ↗
Linux SCTP Flaw Allows Root Access and Container EscapesVulnerability
An 18-year-old use-after-free bug in the Linux SCTP networking code has been identified, which allows local users to gain full root privileges on a host. Researchers at Tencent demonstrated how this flaw can also be used to escape containers and access the underlying machine. Patches were released on August 3 for stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148.
Why it matters: Businesses running Linux servers should prioritize updating their kernels, especially if SCTP is enabled, to prevent unauthorized root access and container breaches.
Read more at The Hacker News ↗
Metabase SQL Injection Zero-Day Actively ExploitedVulnerability
A critical SQL injection zero-day vulnerability in Metabase, an open-source business intelligence platform, has been actively exploited in data theft attacks. Companies like Framework and Tally have already confirmed breaches impacting their customer data due to this flaw.
Why it matters: If your business uses Metabase, immediately apply any available patches and review your logs for signs of compromise to protect sensitive customer information.
Read more at BleepingComputer ↗
Malicious npm Packages Deliver Cross-Platform RAT and InfostealerThreat
Nearly 800 malicious packages have been uploaded to the npm registry, deploying a powerful cross-platform Remote Access Trojan (RAT) and infostealer. These packages often use AI-generated or typo-squatted names to appear legitimate, targeting Windows, Mac, and Linux systems.
Why it matters: Developers should exercise extreme caution when integrating third-party npm packages, verifying their authenticity and trustworthiness to avoid supply chain attacks.
Read more at The Hacker News ↗
Microsoft 365 Accounts Hijacked by AitM PhishingThreat
A widespread email-driven phishing campaign is actively using Adversary-in-the-Middle (AitM) techniques to compromise Microsoft 365 accounts. Attackers are using residential proxies to mask their malicious logins as normal traffic, aiming to identify financial personnel and collect sensitive payroll and finance-related emails.
Why it matters: Implement multi-factor authentication (MFA) and strong email security policies for all Microsoft 365 users, and train employees to recognize sophisticated phishing attempts.
Read more at The Hacker News ↗
UNC6671 Vishing Attacks Target SaaS DataThreat
The data extortion group UNC6671, also known by aliases like BlackFile and Redact, continues to conduct vishing (voice phishing) attacks against financial services, private equity, and professional services firms. They pose as IT help desk staff to trick employees into revealing sensitive information, often contacting them on personal phones to facilitate urgent 'security migrations' and steal SaaS data.
Why it matters: Educate employees about vishing threats, emphasize that IT will not request sensitive credentials over the phone, and establish clear procedures for verifying IT support requests.
Read more at The Hacker News ↗
Unlimited Technology Systems Data Breach Affects 3.8 MillionBreach
Healthcare software provider Unlimited Technology Systems reported a data breach from October 2025 that impacted over 3.8 million individuals. The incident involved hackers stealing personal, medical, and health insurance information from the company's data center.
Why it matters: Ensure all third-party vendors handling sensitive data have robust security measures in place and strong data breach response plans to protect your customers' information.
Read more at BleepingComputer ↗
Levi Strauss & Co. Corporate Data Stolen via Social EngineeringBreach
Levi Strauss & Co. (Levi's) disclosed that hackers successfully used social engineering tactics against three of its employees. This allowed the attackers to gain access to and steal corporate data stored on the compromised employee machines.
Why it matters: Regular employee training on social engineering awareness is crucial. Implement strong access controls and data loss prevention strategies to limit the impact of successful phishing attacks.
Read more at BleepingComputer ↗
North Carolina Ports Hit by CyberattackRansomware
The North Carolina Ports Authority has confirmed a cyberattack that disrupted its IT systems and caused operational slowdowns at the Port of Wilmington, Port of Morehead City, and Charlotte Inland Port.
Why it matters: Critical infrastructure attacks highlight the importance of robust cybersecurity, incident response plans, and business continuity strategies for all organizations, especially those in essential services.
Read more at BleepingComputer ↗
New Attack Class 'NatJack' Manipulates NAT TablesOther
Security researcher Malcolm Stagg unveiled 'NatJack,' a new class of attacks that exploits Network Address Translation (NAT) connection states. These attacks can hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. The research found affected behavior across various implementations, including Windows.
Why it matters: Understanding emerging network attack vectors is vital for maintaining network security. Businesses should consult their IT teams to assess potential vulnerabilities related to NAT configurations and ensure network devices are properly secured.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.