VulnHub

Researchers have discovered a new method of distributing Go-based malware through a centralized repository operated by HashiCorp. This marks a significant shift, as attackers are now using Terraform providers and Go modules to deliver malicious payloads. The specific malicious modules identified are 'gocommunity-io/dockerd' and 'kreuzwenker', which have been downloaded a combined total of 222 times. This incident raises concerns about the security of widely used development tools and platforms, as it demonstrates that even trusted repositories can be exploited to spread malware. Developers and organizations need to be vigilant and scrutinize the sources of their dependencies to avoid potential infections.

A security issue has been discovered with GitLab's email feature for filing issues. Each user is assigned a private email address that, if obtained by someone else, can be used to push code and run Continuous Integration (CI) jobs in the user's name. This means that anyone with access to this email address can submit changes to any branch the user can push to, including the main branch. This vulnerability poses a significant risk as it allows unauthorized code submissions and could lead to malicious alterations in projects. GitLab users need to be aware of this issue to safeguard their accounts and projects from potential exploitation.

A group of cybercriminals has exploited open-source AI tools to target online retailers, resulting in the theft of over 600,000 credit card records. These attackers have infected more than 100 websites with malicious skimming scripts, allowing them to capture sensitive payment information from unsuspecting customers. This incident poses a significant risk to both consumers and businesses, as compromised credit card data can lead to fraudulent transactions and financial loss. Online retailers must take immediate action to secure their systems and protect customer data. Users should also monitor their bank statements and consider using virtual cards for safer online shopping.

Researchers have identified a serious vulnerability affecting MikroTik routers that allows attackers to gain full administrative control without needing a password or SSH key. Known as the MikroTrick chain, this issue arises from two flaws in the RouterOS software: an SSH state-machine vulnerability (CVE-2026-67279) and an argument-injection bug in the login process (CVE-2026-86060). These vulnerabilities can be exploited on routers that are exposed to the internet, putting numerous devices at risk. Users of MikroTik routers should take immediate action to secure their devices, as the potential for unauthorized access could lead to significant data breaches or network disruptions.

In the first half of 2026, the United Arab Emirates and Saudi Arabia faced a significant increase in cyberattacks, accounting for half of all incidents reported in the Gulf region. These attacks have become more complex, posing serious challenges for cybersecurity teams in both countries. The rise in incidents affects various sectors, raising concerns about the security of sensitive data and critical infrastructure. This situation highlights the urgent need for enhanced cybersecurity measures and collaboration among nations to combat these evolving threats. The implications of these attacks could be far-reaching, affecting not only businesses but also national security and public trust in digital systems.

Researchers at GitGuardian have discovered 474 leaked GitHub App keys that are still active and capable of authenticating, including some with admin access. This situation poses significant risks as these keys can allow unauthorized users to access and manipulate repositories. The affected keys could potentially lead to data breaches or unauthorized changes in projects hosted on GitHub. Developers and organizations using GitHub should immediately review their app keys and regenerate any that may have been compromised to prevent misuse. This incident serves as a reminder of the importance of securing sensitive credentials and regularly auditing access permissions.

A recent report from InfraTrust indicates that attackers are increasingly focusing on network management systems that control enterprise infrastructures. This trend involves exploiting several serious vulnerabilities soon after vendors disclose them, raising alarms for organizations that rely on these systems for their operations. The implications are significant, as compromised management systems can lead to unauthorized access and control over critical network resources. Companies using such systems need to ensure they are updated and patched against these vulnerabilities to protect their environments. The report emphasizes the urgency for proactive measures in securing these essential components of enterprise networks.

Threat actors have compromised two legitimate MemTensor packages on the npm and PyPI repositories to distribute a malicious program called sckit. This implant targets Windows, Linux, and macOS systems and is designed to steal credentials. Researchers from Aikido, SafeDep, Socket, and StepSecurity have reported on the affected libraries, particularly the @memtensor/memos-cloud-openclaw-plugin versions. This incident raises significant security concerns for developers and users who may have unknowingly installed these compromised packages. It's crucial for affected users to take immediate action to safeguard their systems.

Arista Networks has addressed a zero-day vulnerability in the VeloCloud Orchestrator (VCO) On-Prem deployments, which is currently being exploited by attackers. This flaw poses a significant risk, as it allows unauthorized access to the system, potentially compromising sensitive data and network operations. Users of the VCO should apply the security patches released by Arista immediately to protect their systems. The urgency of this patching process is underscored by the fact that the vulnerability is actively being exploited in the wild. Organizations relying on VeloCloud Orchestrator must prioritize this update to mitigate the risk of an attack and safeguard their network infrastructure.

A recent report indicates that only 21% of industrial security leaders have a complete inventory of their operational technology (OT) assets, despite 88% claiming their security programs are mature. This discrepancy raises concerns about the effectiveness of security measures in place, as comprehensive asset inventory is crucial for identifying vulnerabilities and managing risks. The report suggests that while many organizations are adopting artificial intelligence to enhance their security efforts, true autonomy in security operations remains uncommon. This situation could leave many industrial environments vulnerable to cyber threats, as lacking an accurate asset inventory makes it difficult to protect against potential attacks. As industries increasingly rely on automation and connected systems, addressing these gaps in OT security will be essential for safeguarding critical infrastructure.

In August 2026, ransomware attacks hit a new high, with 1,073 companies around the world targeted. The industrial sector suffered the most, indicating a worrying trend as attackers increasingly focus on critical infrastructure. This spike in attacks highlights the ongoing vulnerability of organizations to ransomware, which can lead to significant operational disruptions and financial losses. Experts recommend that companies enhance their cybersecurity measures and prepare incident response plans to mitigate the impact of such attacks. With the rise in frequency, it’s crucial for businesses to stay vigilant and informed about potential threats.

The FBI and CISA have issued a fact sheet aimed at critical infrastructure operators to address the risks associated with working with third-party industrial control system (ICS) integrators. These integrators can inadvertently introduce security vulnerabilities, particularly if they are given excessive access to systems or if they operate outside U.S. jurisdiction. A recent incident involved foreign cyber actors gaining access to a U.S. industrial automation company, potentially compromising sensitive customer data and schematics. The agencies emphasize the importance of applying the principle of least privilege and conducting thorough risk assessments when engaging third-party services. Operators are encouraged to implement strict cybersecurity measures in contracts and maintain independent operational capabilities to mitigate risks in case of integrator compromise.