Daily cybersecurity intelligence digest from CyberNetSec.io - August 26, 2026
📊 8 threat intelligence reports covering vulnerabilities, exploits, threat actors, and security advisories.
1. Metabase SQL Injection Flaw (CVE-2026-72898) Under Active Attack
A critical unauthenticated SQL injection vulnerability in Metabase, CVE-2026-72898 (CVSS 10.0), is being actively exploited in the wild. The flaw in the public password reset endpoint allows unauthenticated attackers to execute arbitrary SQL commands, leading to full administrator access, creation of persistent admin accounts, and theft of connected database credentials. Metabase has released patches and urges immediate upgrades for all self-hosted instances.
2. ShieldBreak Zero-Day in Microsoft Defender Allows Privilege Escalation
A new unpatched zero-day vulnerability named "ShieldBreak" (CVE-2026-69414) affects the Microsoft Malware Protection Engine in Microsoft Defender. The flaw allows a local, low-privilege attacker to escalate their privileges to SYSTEM. A proof-of-concept exploit is publicly available, and Microsoft has not yet released a patch, though it rates exploitation as 'more likely.' The vulnerability is a bypass for a previously patched flaw.
3. Chrome 152 Update Fixes 327 Vulnerabilities
Google has released Chrome 152 for Windows, macOS, and Linux, a major security update that addresses 327 vulnerabilities. The patch includes fixes for 10 critical flaws, the majority of which are use-after-free memory corruption issues in components like ANGLE, Aura, and Chromecast that could lead to arbitrary code execution if exploited. Users are strongly advised to update their browsers immediately to protect against potential attacks.
4. SLEEPWALKER: A Passive Windows Backdoor Activated by Network Sniffing
A sophisticated and previously undocumented Windows backdoor named "SLEEPWALKER" has been discovered. The malware remains completely inert in memory, exhibiting no command-and-control traffic. It passively sniffs network packets, waiting for a specially crafted "magic packet" to trigger its execution. Once activated, it runs commands from a custom bytecode language, demonstrating capabilities consistent with a well-resourced threat actor targeting high-value systems.
5. US Treasury Launches Quantum-Readiness Task Force for Financial Sector
The U.S. Department of the Treasury has announced the formation of a Quantum-Readiness Task Force. This public-private initiative aims to accelerate the financial sector's transition to post-quantum cryptography (PQC) to defend against the future threat of quantum computers breaking current encryption standards. The task force will address sector alignment, vendor readiness, and risks from emerging technologies, tackling the 'harvest now, decrypt later' threat.
6. Actively Exploited Gitea RCE Flaw Added to CISA KEV Catalog
CISA has added a critical remote code execution (RCE) vulnerability in Gitea, CVE-2026-60004, to its Known Exploited Vulnerabilities (KEV) catalog, confirming it is under active attack. The 9.8 CVSS flaw allows an attacker with repository write access—easily obtained on default installations—to execute arbitrary code. Federal agencies are mandated to patch by August 28, and all users are urged to upgrade immediately.
7. VCU Responds to Cyberattacks with "Stop, Verify, Report" Campaign
Following a series of cyberattacks, including a large-scale phishing campaign targeting over 7,000 students and a separate Canvas platform hack, Virginia Commonwealth University (VCU) is responding with a new awareness campaign. Titled "Stop, Verify, Report," the initiative aims to educate its community on how to spot and handle suspicious communications, emphasizing that individual vigilance is a key part of the university's defense strategy.
8. Ransomware Activity Surged 22% in July, Reaching 2026 Peak
According to a new threat report from NCC Group, global ransomware activity surged in July 2026, reaching the highest monthly volume of the year. The report recorded 894 cases, a 22% increase from June. The Industrials sector and organizations in North America and Europe remained the top targets. The report also notes the appearance of a new group, 'CRPxO,' and the continued dominance of established actors.
📌 Subscribe to daily updates at CyberNetSec.io
All reports include detailed analysis, IOCs, mitigation strategies, and references.
Top comments (0)