Weekly Cybersecurity Newsletter
Welcome to this week’s edition of the GBHackers cybersecurity newsletter — your weekly cybersecurity bulletin covering the 50 most important stories from August 10–14, 2026. Zero-days set the tone: a Zoom ‘Zoomsday’ zero-click flaw could run code on other participants’ devices, the ShieldBreak zero-day bypassed a Windows Defender patch, and Microsoft’s Patch Tuesday fixed an actively exploited Windows bug.
AI stayed central as China-linked crews used autonomous agents against Taiwan, a LiteLLM supply-chain attack hit AI infrastructure, and Apple warned iPhone users in 110 countries of mercenary spyware — alongside exploited flaws in VMware vCenter, Palo Alto GlobalProtect and Fortinet. Here’s everything your peers are reading this week.
1. Apple Warns iPhone Users in 110 Countries of Mercenary Spyware Attacks
Aug 14, 2026 • gbhackers.com
Apple sent threat notifications to iPhone users across 110 countries warning of government-grade mercenary spyware. The scale of the alerts shows how widely commercial surveillance tools are still being deployed against high-risk individuals.
2. Zoom Zero-Click ‘Zoomsday’ Flaw Lets Meeting Participants Execute Code on Other Users’ Devices
Aug 12, 2026 • gbhackers.com
A zero-click ‘Zoomsday’ flaw lets a meeting participant execute code on another attendee’s device with no interaction. Zero-click bugs in ubiquitous collaboration tools are among the most dangerous a vendor can ship.
3. Hackers Exploit Critical VMware vCenter Flaw to Deploy Reverse SSH Across 47 Countries
Aug 12, 2026 • gbhackers.com
Attackers are exploiting a critical VMware vCenter flaw to deploy reverse SSH across victims in 47 countries. Owning vCenter effectively hands attackers the keys to the entire virtual estate.
4. Microsoft Patch Tuesday August 2026 Fixes an Actively Exploited Windows Zero-Day
Aug 12, 2026 • gbhackers.com
Microsoft’s August Patch Tuesday fixed hundreds of flaws, including a Windows zero-day already under active exploitation. The exploited bug makes prompt, prioritized patching essential this cycle.
5. Levi Strauss Hit by Cyberattack as Hackers Use Social Engineering to Steal Corporate Data
Aug 10, 2026 • gbhackers.com
Levi Strauss confirmed a cyberattack in which social engineering was used to steal corporate data. It is another reminder that well-crafted human-focused attacks still bypass technical defenses.
6. Claude Code Auto Mode Blocks 89% of Dangerous Commands and Prompt Injection Attacks
Aug 11, 2026 • gbhackers.com
Anthropic says Claude Code’s Auto Mode blocks 89% of dangerous commands and prompt-injection attempts. The move reflects a wider push to harden autonomous coding agents against abuse.
7. China-Linked Hackers Use Autonomous AI Agents to Breach Taiwan Government Systems
Aug 13, 2026 • gbhackers.com
China-linked hackers reportedly used autonomous AI agents to breach Taiwanese government systems. It is one of the clearest signs yet of state actors operationalizing agentic AI for espionage.
8. LiteLLM Attack Shows AI Infrastructure Is Becoming a Strategic Software Supply Chain Target
Aug 11, 2026 • gbhackers.com
A supply-chain attack on LiteLLM highlights how AI infrastructure is becoming a strategic target. Compromising a shared AI gateway can ripple into thousands of downstream environments.
9. Agentic AI Models Rebuild Malware and Sustain Real-World Cyber Intrusions, SentinelOne Warns
Aug 14, 2026 • gbhackers.com
SentinelOne warns that agentic AI models are rebuilding malware and sustaining real-world intrusions. The research signals a shift from AI as an assistant to AI as an active operator.
10. Hackers Steal One AI Key, Resell the Compute, and Leave Victims With a Million-Dollar Bill
Aug 14, 2026 • gbhackers.com
Attackers are stealing a single AI API key, reselling the compute, and leaving victims with massive bills. The scheme turns leaked credentials into a fast, scalable fraud.
11. How AI Security Differs From Traditional Cybersecurity
Aug 12, 2026 • gbhackers.com
An explainer on why securing AI systems demands new controls beyond traditional cybersecurity. It covers model, data and agent risks that classic defenses were never built to handle.
12. CISA Flags Progress LoadMaster Command Injection Vulnerability Exploited in the Wild
Aug 10, 2026 • gbhackers.com
CISA warned that a command-injection flaw in Progress Kemp LoadMaster is being actively exploited. Load balancers sit in the traffic path, making them high-value targets for attackers.
13. Metabase 0-Day Flaw Exploited to Inject Arbitrary SQL and Steal Database Credentials
Aug 10, 2026 • gbhackers.com
A Metabase zero-day is being exploited to inject arbitrary SQL and steal database credentials. Because Metabase connects straight to databases, a takeover exposes core data.
14. Red Hat Kubernetes Flaw Allows Attackers to Escalate Privileges to Cluster-Admin
Aug 11, 2026 • gbhackers.com
A Red Hat Advanced Cluster Management flaw lets attackers escalate to full cluster-admin. Breaking Kubernetes tenancy can expose every workload running on the cluster.
15. Plug & Pwn Attack Exploits Windows PnP to Gain SYSTEM Access With Zero Clicks
Aug 11, 2026 • gbhackers.com
The Plug & Pwn technique abuses Windows Plug and Play to gain SYSTEM access with zero clicks. It turns a routine device-handling mechanism into a reliable privilege-escalation path.
Aug 11, 2026 • gbhackers.com
Researchers disclosed 23 Copeland XWEB Pro flaws that let attackers gain root and manipulate refrigeration systems. Compromising cold-chain controls can threaten food and pharmaceutical safety.
17. Pass-the-Passkey Attack Exploits Windows and Entra ID to Bypass MFA
Aug 11, 2026 • gbhackers.com
A Pass-the-Passkey technique abuses Windows and Entra ID to bypass multi-factor authentication. It undercuts the assumption that passkeys alone make account takeover impossible.
18. Docker CopyEscape Vulnerability Enables Host File Overwrite and Root Code Execution
Aug 12, 2026 • gbhackers.com
The CopyEscape flaw lets a malicious container overwrite files on the Docker host and run code as root. Container escapes break the isolation that CI and multi-tenant setups depend on.
19. ShieldBreak Windows Defender 0-Day Lets Attackers Bypass Microsoft Patch and Gain SYSTEM Privileges
Aug 12, 2026 • gbhackers.com
The ShieldBreak zero-day sidesteps a Microsoft Defender patch to gain SYSTEM privileges. Bypassing the built-in defender most organizations rely on is a serious escalation.
20. CISA Warns Critical Metabase SQL Injection Flaw Lets Unauthenticated Attackers Gain Admin Access
Aug 12, 2026 • gbhackers.com
CISA added a critical Metabase SQL injection flaw to its exploited-vulnerabilities catalog. Unauthenticated admin takeover of analytics tools puts connected databases at direct risk.
21. WordPress RCE Vulnerability Lets Authenticated Authors Execute Remote Code
Aug 13, 2026 • gbhackers.com
A WordPress flaw lets authenticated author-level users execute remote code on the server. Given WordPress’s ubiquity, the bug threatens a vast number of sites.
22. Palo Alto GlobalProtect Vulnerabilities Enable SYSTEM and Root-Level Access
Aug 13, 2026 • gbhackers.com
Newly disclosed Palo Alto GlobalProtect flaws enable SYSTEM- and root-level access on affected devices. VPN clients are a prime target because they sit on privileged endpoints.
23. Microsoft Exchange Server Vulnerabilities Allow DoS, Privilege Escalation, and RCE
Aug 13, 2026 • gbhackers.com
Microsoft disclosed Exchange Server flaws spanning denial of service, privilege escalation and remote code execution. Exchange remains a top target because it sits at the heart of enterprise mail.
24. Critical Dell VMware vSphere Client Flaw Lets Remote Attackers Execute Commands as Root
Aug 13, 2026 • gbhackers.com
A critical Dell VMware vSphere Client flaw lets remote attackers execute commands as root. Compromising virtualization management can cascade across the whole data center.
25. Fortinet FortiWeb and FortiClient Flaws Let Unauthenticated Attackers Gain Access and Execute Code
Aug 14, 2026 • gbhackers.com
Fortinet disclosed FortiWeb and FortiClient flaws that let unauthenticated attackers gain access and run code. Security appliances remain a favorite entry point for opportunistic attackers.
26. Android Banking Droppers Surge as Malware Operators Change Packaging Tactics
Aug 10, 2026 • gbhackers.com
Android banking droppers are surging as operators shift packaging tactics to evade store defenses. The droppers quietly deliver banking trojans onto victims’ phones.
27. Play Ransomware Masquerades as PsExec to Blend Into Legitimate Windows Administration
Aug 10, 2026 • gbhackers.com
Play ransomware is disguising itself as PsExec to blend into normal Windows administration. Impersonating trusted admin tools helps the crew avoid early detection.
28. New CSS Bomb Attacks Let Hackers Steal Passwords and Tokens From Webmail Users
Aug 10, 2026 • gbhackers.com
New ‘CSS bomb’ attacks weaponize email styling to steal passwords and tokens from webmail users. The technique abuses CSS that most mail clients render without a second thought.
29. New Abyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC Access
Aug 11, 2026 • gbhackers.com
The new Abyssos RAT hijacks browser sessions, steals credentials and grants attackers remote VNC access. Its broad capabilities make it a flexible tool for hands-on intrusions.
30. DeadLock Ransomware Disables Windows Defender, Backups and Event Logs Before Encrypting Files
Aug 11, 2026 • gbhackers.com
DeadLock ransomware disables Windows Defender, backups and event logs before encrypting files. Wiping recovery and forensic data maximizes damage and pressure to pay.
31. One ClickFix Lure Can Give Hackers a Persistent Remote Shell Through New CNCMachineRMS RAT
Aug 12, 2026 • gbhackers.com
A single ClickFix lure can plant the new CNCMachineRMS RAT for a persistent remote shell. The malware hides its Windows API calls to slip past static analysis.
32. Jewelbug Uses Public Google Docs as a Malware Command-and-Control Delivery Channel
Aug 13, 2026 • gbhackers.com
The Jewelbug group abuses public Google Docs as a command-and-control delivery channel. Hiding C2 in trusted cloud services helps the operation evade network defenses.
33. Phantom Stealer Uses PNG Steganography and PowerShell Injection to Steal Credentials
Aug 13, 2026 • gbhackers.com
Phantom Stealer hides its payload in PNG images and uses PowerShell injection to steal credentials. Steganography helps the malware smuggle code past content inspection.
34. Kimwolf v7 Removes Exploitation Code and Leaves Infection to External Loaders
Aug 13, 2026 • gbhackers.com
The latest Kimwolf v7 strips out its own exploitation code and relies on external loaders for infection. The modular design makes the toolkit stealthier and harder to attribute.
35. Gunra Ransomware Uses Up to 100 ChaCha20 Threads to Rapidly Encrypt Linux Systems
Aug 13, 2026 • gbhackers.com
A Linux variant of Gunra ransomware spins up as many as 100 ChaCha20 threads to encrypt systems fast. Speed reduces the window defenders have to detect and stop the attack.
36. New AmnesiaStealer Malware Targets macOS Users via ClickFix Attacks
Aug 14, 2026 • gbhackers.com
AmnesiaStealer targets macOS users through ClickFix lures that trick them into running commands. Once active, it harvests credentials and browser session data.
37. Aeternum Hides Malware Commands on the Polygon Blockchain Where Takedowns Can’t Erase Them
Aug 14, 2026 • gbhackers.com
The Aeternum botnet stores command-and-control data on the Polygon blockchain, beyond the reach of takedowns. Anchoring C2 on-chain makes the infrastructure remarkably resilient.
38. CISA Urges Organizations to Patch Exposed VPNs and Segment Networks Against Gunra Ransomware
Aug 11, 2026 • gbhackers.com
CISA urged organizations to patch exposed VPNs and segment networks to blunt Gunra ransomware. The crew repeatedly abuses internet-facing VPNs as its way in.
39. City-Forum Hackers Target Salesforce and ServiceNow Instances Worldwide for Data Theft
Aug 13, 2026 • gbhackers.com
The City-Forum group is targeting Salesforce and ServiceNow instances worldwide to steal data. SaaS platforms hold vast troves of customer and operational records.
40. Beacon CRM Data Breach Exposes Customer Data via a Compromised AWS Access Key
Aug 14, 2026 • gbhackers.com
Beacon CRM disclosed a breach that exposed customer data after an AWS access key was compromised. Leaked cloud keys remain one of the fastest paths to mass data exposure.
41. Trezor Shipping Provider Data Breach Exposes Personal Data of 13,689 Customers
Aug 14, 2026 • gbhackers.com
A breach at a Trezor shipping provider exposed personal data of 13,689 customers. Physical-address leaks are especially sensitive for cryptocurrency hardware-wallet owners.
42. Dysphoria Hijacks Routers, Gateways and IP Cameras to Build a Massive IoT Botnet
Aug 14, 2026 • gbhackers.com
The Dysphoria botnet hijacks routers, gateways and IP cameras to assemble a massive IoT army. The compromised devices fuel DDoS attacks and residential-proxy services.
43. PATCHCORD Infrastructure Hosts SuperShell C2 for Remote Commands and Webshell Management
Aug 14, 2026 • gbhackers.com
Researchers linked PATCHCORD infrastructure to SuperShell C2 used for remote commands and webshell management. Mapping the hosting helps defenders block the operation at the network edge.
44. GitHub Expands Dependabot Malware Alerts to Detect Malicious Packages Across 8 Ecosystems
Aug 10, 2026 • gbhackers.com
GitHub extended Dependabot malware alerts from npm to eight package ecosystems. Broader coverage helps developers catch malicious dependencies before they reach production.
45. Trump Administration Authorizes Cyber Operations Against Foreign Criminal Networks
Aug 13, 2026 • gbhackers.com
The administration authorized offensive cyber operations against foreign criminal networks. The policy shift signals a more aggressive posture toward transnational cybercrime.
46. The Best Intrusion Detection & Prevention (IDS/IPS) Tools, Compared and Priced (2026)
Aug 10, 2026 • gbhackers.com
GBHackers’ 2026 guide compares the leading IDS/IPS tools on features and pricing. It is a practical starting point for teams evaluating network threat detection.
47. The Credential Stuffing Prevention Market Is Growing: What’s Driving Expansion?
Aug 11, 2026 • gbhackers.com
An industry look at why the credential-stuffing prevention market is expanding. Relentless account-takeover attacks are pushing organizations to invest in dedicated defenses.
48. How CTOs Keep Control When QA Moves Outside the Building
Aug 10, 2026 • gbhackers.com
An advisory piece on how CTOs maintain security and control when QA is outsourced. It focuses on governance and data protection across external testing teams.
49. Securing IoT Power Line Monitoring: A Six-Stage Assurance Method
Aug 13, 2026 • gbhackers.com
A technical guide lays out a six-stage assurance method for securing IoT power-line monitoring. It targets the operational-technology gaps common in utility deployments.
50. DEF CON Attendees Allegedly Jam Plane Wi-Fi and Launch an ‘Evil Twin’ Phishing Attack
Aug 12, 2026 • gbhackers.com
DEF CON attendees allegedly jammed in-flight Wi-Fi and ran an ‘evil twin’ phishing attack. The episode is a vivid reminder that on-network experimentation can carry real legal consequences.
What does this weekly cybersecurity newsletter cover?
Each issue of the GBHackers cybersecurity newsletter rounds up the week’s 50 most important stories — critical vulnerabilities, ransomware attacks, data breaches, AI security threats, phishing campaigns, and malware research — curated by our editorial team from everything published on gbhackers.com.
How is a cybersecurity bulletin different from daily security news?
A cybersecurity bulletin condenses hundreds of daily headlines into a single prioritized weekly briefing. Instead of monitoring feeds all day, security teams get the exploited CVEs, active campaigns, and breaches that actually matter — with direct links to the full analysis of each story.
How do I subscribe to the GBHackers weekly cybersecurity newsletter?
Visit gbhackers.com and follow us on LinkedIn or X (@gbhackers_news) to get every weekly issue. The newsletter is free and lands once a week, every week.
Found this cybersecurity bulletin useful? Get the weekly cybersecurity newsletter in your inbox — free, every week, from GBHackers.
A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers…
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…