Cybersecurity Roundup: Key Incidents, Vulnerabilities, and Developments (August 2026) GitHub Expands Dependabot Malware Alerts to Eight Ecosystems GitHub has extended its Dependabot malware alerts previously limited to npm to now cover PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The expansion, active since August 2026, leverages GitHub’s existing infrastructure across 30+ million repositories, significantly scaling its malware detection capabilities. AI Uncovers 84 New 5G Network Flaws Researchers at Nanyang Technological University used AI agents to identify 84 previously unreported security vulnerabilities in 4G/5G software. Of these, 83 were confirmed by developers, with 81 assigned CVE numbers. As of August 2026, 23 remain unpatched. Salesforce and ServiceNow Data Exposed in "City-Forum" Campaign Security firm Reco uncovered a 17-month-long campaign, dubbed City-Forum, where an unknown actor exploited legitimate access to extract records from Salesforce and ServiceNow portals worldwide. The operation, linked to a German-hosted server, highlights risks in misconfigured SaaS platforms. Zero-Day Exploits and Critical Patches - Framework Data Breach: Attackers exploited a Metabase zero-day to access customer data, including names, emails, and IP addresses, though payment details were unaffected. - Microsoft’s August Patch Tuesday: Addressed 400+ vulnerabilities, including an actively exploited zero-day (CVE-2026-68820) and three publicly disclosed flaws. - Cisco Firewall DoS Vulnerability: CVE-2026-20349, a high-severity flaw, was added to CISA’s Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by August 14. - SharePoint Exploits: Threat actors began targeting CVE-2026-55040 after proof-of-concept code was released, prompting Microsoft to issue an emergency fix in July. Ransomware and Industrial Threats Dragos reported a 12% increase in ransomware attacks on industrial organizations in Q2 2026 (1,140 incidents), noting that disrupting IT systems alone can halt production even without ICS access. Meanwhile, CERT Polska revealed a December 2025 attack on a Polish energy plant, where attackers breached an OT network via a private APN, a first-of-its-kind entry vector. AI and Cybersecurity Advancements - GPT-5.6-Cyber: OpenAI’s new model, designed for vulnerability discovery and exploit chaining, reduces refusals for high-risk tasks and is accessible only via the Daybreak Red program for vetted cybersecurity professionals. - OpenAI’s Astra Model: Internal evaluations flagged Astra’s potential to reach "critical capability" levels in cybersecurity, leading to restricted access under its Preparedness Framework. - Anthropic’s Auto Mode: Claude Code’s auto-review feature will become the default for Pro, Max, and Team plans starting August 14, shifting oversight to AI by default. Emerging Threats and Tools - WindRelay Malware: A new Android trojan captures live NFC payment card data in real time, relaying it to attackers while victims hold their devices. - LiteLLM Supply Chain Attack: A 153GB archive of stolen credentials, linked to 2,488 corporate domains (including AWS, Samsung, and Cisco), surfaced after a breach of the LiteLLM AI framework. - Deepfake Fraud: Spanish police arrested a suspect who used deepfake software to bypass video identity checks for digital certificate fraud. - Lazarus Group: North Korea-linked hackers paired fake job offers with a Windows zero-day exploit in attacks targeting the defense sector. Regulatory and Industry Shifts - EU AI Act Enforcement: The European Commission began enforcing the AI Act on August 2, 2026, establishing rules for AI systems sold or used in the EU. - White House Authorizes Offensive Cyber Operations: A National Security Presidential Memorandum signed August 12 permits vetted U.S. companies to conduct offensive cyber operations against foreign threat actors under government oversight. - AWS Phases Out Email-Validated Certificates: AWS Certificate Manager will end email validation for public certificates by 2027, aligning with CA/B Forum’s 2028 deadline. Notable Incidents and Breaches - Valve Data Leak: A cyberattack on CEVA Logistics, Valve’s Steam hardware shipper, exposed European customers’ names, addresses, and order data. - Polish Energy Plant Attack: The December 2025 breach of a combined heat and power (CHP) plant marked the first documented case of attackers exploiting a private APN to access OT networks. - Ukrainian Call Center Raids: Police dismantled 94 fraudulent call centers, seizing $2 million in assets and thousands of devices during a nationwide operation. Tool and Product Updates - Signal’s Automatic Key Verification: A new feature helps users detect tampering in encrypted chats. - OpenSSH 10.5 Patch: Fixed a flaw in ssh-agent that exposed local-only keys when locked. - Wireshark 4.6.8: Addressed 28 security bugs, including nine in file parsers that could be exploited via malicious capture files. - Chrome’s Anti-Abuse Measures: Blocked 7 billion unwanted Android notifications daily by revoking permissions for suspicious or inactive sites. DDoS and Cloud Security Trends - Record-Breaking DDoS Attacks: Cloudflare’s H1 2026 report noted a rise in 1+ Tbps campaigns, shorter attack durations, and increased automation. - Cloud IAM Weaknesses: Up to 98% of cloud environments exhibit misconfigurations, with CISA mandating baseline practices for federal agencies. AI Deployment Challenges NetFoundry’s 2026 survey found that 90% of organizations lack visibility into AI deployments, with CISOs anticipating a 14% increase in attack surfaces due to AI adoption. Concerns persist over unapproved AI tool usage by employees.

INC Ransomware Exploits Zero-Day Flaws in SonicWall SMA 1000 VPN Appliances The INC Ransomware group has become the primary threat actor exploiting recently disclosed vulnerabilities in SonicWall’s Secure Mobile Access (SMA) 1000 series VPN appliances. According to a report by Resecurity, the group has intensified its attacks since early August 2026, listing 885 victims on its data leak site as of August 2, 2026. The attacks leverage two zero-day flaws CVE-2026-15409 and CVE-2026-15410 which were chained to execute arbitrary commands and compromise vulnerable devices. SonicWall released patches for these vulnerabilities in mid-July 2026, but pre-disclosure exploitation began as early as June 22, 2026, attributed to a threat cluster tracked as UTA0533 by Volexity. The campaign involves deploying a Python script (KNUCKLEBALL) to launch Suo5, an open-source HTTP proxy, and a custom Java web shell (ORANGETAIL). Attackers used the initial access to extract credentials, active session databases, and TOTP multi-factor authentication (MFA) seeds, enabling persistent access and lateral movement within corporate networks. Rapid7 confirmed significant tactical overlaps in the attacks, suggesting a single threat actor or coordinated group was behind the zero-day exploitation. Since mid-July, INC Ransomware has targeted organizations across Australia, the U.S., the U.A.E., Colombia, Switzerland, and other countries, including both private and government entities. Resecurity also reported that victims received unsolicited calls and emails from unknown entities claiming to assist with ransomware incidents. Some were contacted by an individual identifying as "Andrew" at +1 (304) 384-0401, directing them to info@helprans[.]com for negotiations a tactic used to pressure victims into paying ransoms. SonicWall has urged customers to patch affected SMA 1000 appliances immediately, while security firms recommend additional measures such as threat hunting, credential rotation, and integrity verification to mitigate risks.

ShinyHunters Claims Breach of Cybersecurity Firm Resecurity, Leaks Internal Data The hacking group ShinyHunters has publicly claimed responsibility for breaching Resecurity, a U.S.-based cybersecurity company headquartered in Los Angeles. In a Telegram post shared earlier today, the group asserted full access to Resecurity’s internal systems and released screenshots as evidence. The leaked images depict internal dashboards, user management panels, token databases, and employee communication channels, exposing sensitive data including: - API keys and access tokens - Internal Mattermost chat logs, including discussions on threat intelligence and client reports - Employee details (names, email addresses, authentication tokens) - Client lists and related information - Threat intelligence documents and moderation logs Analysis of the screenshots by Hackread.com revealed real-time access tokens, Firebase Cloud Messaging (FCM) user accounts, and active employee profiles with exposed credentials. Some names visible in the images were cross-referenced with LinkedIn, appearing to match Resecurity personnel. ShinyHunters framed the attack as retaliation, accusing Resecurity of deceptive tactics—specifically, posing as buyers on dark web markets to infiltrate threat actor groups. The group referenced a prior incident involving a Vietnamese financial database, where Resecurity allegedly requested free samples under false pretenses. The post also mentioned collaboration with the Devman ransomware group and cited past breaches, including claims against CrowdStrike, as part of a broader campaign against firms they label as hypocritical. As of now, Resecurity has not publicly confirmed the breach, and the authenticity of the claims remains unverified by third parties. If validated, this would mark ShinyHunters’ first major public breach of 2026, potentially impacting Resecurity’s clients, partners, and trust in its services—particularly if sensitive intelligence or operational data was compromised. Resecurity, known for its work in cybercrime investigation, threat attribution, and digital forensics, has previously collaborated with government and private sector entities. Further developments are expected as the situation unfolds.

Silent Ransom Group (SRG) Exploits Fast Flux Network to Evade Detection The Silent Ransom Group (SRG), also known as Chatty Spider, Luna Moth, and UNC3753, has adopted a fast flux network to conceal its infrastructure, according to a recent Resecurity report. The group primarily targets law firms, finance, healthcare, insurance, and hospitality sectors industries handling sensitive data using voice phishing (vishing) and social engineering to breach networks. SRG’s tactics include phishing emails disguised as data migration or invoice requests, followed by phone calls from operatives posing as IT specialists. Victims are tricked into screen-sharing sessions and installing remote access tools, sometimes even via physical USB drops by in-person operatives. Unlike traditional ransomware groups, SRG prioritizes data exfiltration over encryption, issuing extortion threats within 30 minutes of stealing files. If victims resist, the group escalates pressure by contacting employees and partners. To evade detection, SRG leverages a fast flux botnet a technique that rapidly rotates DNS records across compromised routers, modems, IoT devices, and CPEs in 18 countries, including regions in Latin America, Eastern Europe, and the Middle East. The botnet, spread across 22 ISPs, has been linked to domains like ep6pheij[.]com and business-data-leaks[.]com, both tied to SRG’s operations. The group’s focus on law firms has had a measurable impact: nearly a quarter of all ransomware incidents in Q1 2026 targeted the legal sector, making it the fourth-most affected industry. SRG’s activities date back to at least 2022, with overlaps observed between its operations and UNC2686, a threat cluster known for BazarCall campaigns and malware like TrickBot, Ursnif, and BazarLoader.

Cybersecurity Firm Resecurity Targeted in Alleged Breach by "Scattered Lapsus$ Hunters" Threat actors identifying as Scattered Lapsus$ Hunters (SLH) claimed to have breached cybersecurity firm Resecurity, publishing screenshots on Telegram as proof of the alleged compromise. The group asserted it had stolen internal data, including employee records, client details, threat intelligence reports, and communications from a Mattermost collaboration platform. The attack was framed as retaliation for what the actors described as Resecurity’s attempts to infiltrate their operations, including posing as buyers to obtain samples of a purported Vietnam financial database. However, Resecurity disputed the claims, stating the accessed systems were part of a deliberately deployed honeypot—a decoy environment designed to monitor and analyze attacker behavior. According to the company, the threat actor first probed its systems on November 21, 2025, prompting Resecurity’s digital forensics team to deploy the honeypot in an isolated environment. The decoy contained synthetic datasets, including over 28,000 fake consumer records and 190,000 payment transactions generated via Stripe’s API, mimicking real-world data to lure the attackers. Between December 12 and 24, the threat actor made 188,000 automated exfiltration attempts using residential proxy IP addresses, exposing their infrastructure during proxy failures. Resecurity collected telemetry on the attacker’s tactics, later identifying servers linked to the operation and sharing intelligence with law enforcement. A foreign law enforcement agency, acting on Resecurity’s findings, issued a subpoena to investigate the threat actor. The group, which has previously been associated with ShinyHunters, Lapsus$, and Scattered Spider, later clarified that ShinyHunters was not involved in this incident. As of the latest update, the threat actors have not provided additional evidence beyond a Telegram post teasing further disclosures. Resecurity maintains that no legitimate production systems were compromised.

Rapid SQL Server Ransomware Attacks Highlight Critical Security Gaps Recent investigations reveal that attackers can move from initial SQL Server access to full ransomware deployment in as little as 32 minutes a timeline that underscores the speed and efficiency of modern cyber threats. The DFIR Report’s analysis of a BlueSky ransomware incident and SEKOIA’s Mallox honeypot research demonstrate how exposed or poorly secured SQL Server instances become prime targets for rapid encryption and operational disruption. ### How Attacks Unfold 1. Initial Access - Attackers exploit publicly exposed TCP port 1433 (SQL Server’s default port), often via brute-force attacks targeting the built-in *sa* account or weak credentials. - SQL injection remains a distinct but equally dangerous vector, though its impact depends on application permissions and available SQL features. 2. Privilege Escalation to OS Control - Once inside, attackers test for command execution outside the database engine. Common methods include: - xp_cmdshell (disabled by default but easily enabled with sysadmin privileges). - CLR (Common Language Runtime) and OLE Automation, which allow payload staging. - SQL Agent jobs and linked servers for lateral movement. - Sophos MDR observed attackers using xp_cmdshell to run discovery commands (whoami, systeminfo) before deploying ransomware. 3. Ransomware Deployment & Backup Sabotage - Attackers disable services, encrypt MDF/LDF files (SQL database files), and delete backups or Volume Shadow Copies (VSS) to prevent recovery. - In one ALPHV ransomware case, threat actors destroyed all backups during encryption, turning a breach into a full-scale restore crisis. - Backup co-location storing backups on the same server or network remains a critical vulnerability, with 51% of state/local government victims reporting successful backup compromise (Sophos, 2024). ### Why SQL Server is a High-Value Target - Centralized Data: A single SQL instance often supports finance, operations, and line-of-business applications, making encryption a multi-department disruption. - Configuration Drift: Overprivileged service accounts, enabled dangerous features (xp_cmdshell, CLR), and unpatched linked servers create easy escalation paths. - Backup Failures: Even with backups in place, 79% of energy/water sector victims reported backup compromise, with 55% taking over a month to recover (Sophos). ### Key Hardening Measures Security teams can mitigate risks by prioritizing: 1. Blocking public exposure of port 1433 (restrict access to VPNs, bastion hosts, or trusted networks). 2. Disabling the *sa* account (renaming offers minimal protection; disable it entirely). 3. Enforcing Windows Authentication (reduces brute-force risks but requires clean Active Directory hygiene). 4. Disabling *xp_cmdshell*, CLR, and OLE Automation unless explicitly required. 5. Reviewing SQL service accounts (avoid local admin/domain privileges; use Group Managed Service Accounts (gMSA)). 6. Isolating backups (off-host, immutable storage, and 3-2-1 backup model with tested restores). 7. Enabling auditing (monitor for sp_configure changes, xp_cmdshell usage, and failed sa logins). ### Detection Opportunities Early signs of compromise include: - SQL audit logs (unexpected xp_cmdshell or sp_configure commands). - Windows Event Logs (processes spawned by sqlservr.exe). - EDR alerts (unusual service account activity or backup repository access). - Network telemetry (anomalous outbound connections post-compromise). ### The Bigger Picture While checklists reduce obvious risks, legacy environments often accumulate hidden vulnerabilities stale permissions, forgotten linked servers, or overprivileged service accounts that attackers exploit. The fastest attacks (e.g., 32-minute ransomware deployment) highlight the need for continuous monitoring and rapid response to detect and disrupt intrusions before encryption begins. SQL Server ransomware remains a high-impact, low-friction attack vector, with threat actors leveraging both speed and leverage to maximize disruption. Organizations must address both technical controls and operational drift to close gaps before attackers exploit them.

BreachForums Data Leak Exposes 324K Cybercriminals in Dramatic Retaliation On January 9, an individual using the alias "James" published a massive database containing the real identities and details of 323,986 BreachForums users, including administrators, moderators, and members of the notorious hacking community. The leak, framed as an act of retribution, targeted key figures behind BreachForums and ShinyHunters, with James claiming disillusionment with the groups’ shift toward attacking French targets. The manifesto, written in a theatrical 23-part style, portrayed James as a long-standing hacker who mentored these groups before turning against them. Among those named were French nationals Dorian Dali, Nahyl Ojeda, and Ali Aboussi, many of whom were reportedly teenagers or young adults. James declared the leak a move to "settle their destiny" by exposing them to authorities. Resecurity, a cybersecurity firm, confirmed the authenticity of the leaked data, which included usernames, email addresses, IP addresses, and registration details. While some members used anonymous email services, others relied on mainstream providers like Gmail, making identification easier for law enforcement. The data also revealed a global distribution of members, with concentrations in the U.S., Germany, Netherlands, France, Turkey, and the U.K., as well as significant activity in the Middle East and North Africa. The leak is expected to disrupt cybercriminal operations by stripping away anonymity, a cornerstone of groups like ShinyHunters. Shane Barney, CISO at Keeper Security, noted that the exposure of real identities and IP histories could accelerate investigations, making it harder for members to operate without fear of attribution. BreachForums, a successor to the shuttered RaidForums, has been a hub for trading stolen data, hacking tools, and personal information. Previous law enforcement actions, including the 2023 arrest of Conor Brian Fitzpatrick (pompompurin) and the 2024 sentencing of ShinyHunters member Sebastien Raoult, have failed to permanently dismantle the forum. This latest breach, however, may prove more damaging by exposing the infrastructure and identities of its members. While BreachForums users have dismissed the leak as outdated, Resecurity warned that many reuse registration details across underground platforms, meaning the data remains a valuable resource for law enforcement. The incident underscores the ongoing cat-and-mouse game between cybercriminals and authorities, with this leak marking a significant blow to one of the dark web’s most active marketplaces.