Confidential · 05 Aug 2026
🛡️ Daily Cybersecurity Briefing — 2026-08-05 (Wednesday)¶
Window: last 24–48h (August 4–5). Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 152Top actor QilinM&A L30D $125M
💼 M&A ACTIVITY¶
No new deal announcements in the Aug 4–5 window. Black Hat week historically concentrates vendor product launches, not M&A transactions.
L30D summary (Jul 6 – Aug 5): 28+ named deals, $4.7B+ disclosed value. Three transactions dominate: Visa/BioCatch ($2.4B — behavioural biometrics AI), Cyera/Oasis Security (~$1B LOI — AI-native NHI + data security), Okta/Permiso (~$200M — identity threat detection, AI agent governance). Supporting cluster: ThreatLocker $190M Series D, Cathedral Security $160M, Glow Security $180M. Structural theme: AI-powered fraud prevention, non-human identity (NHI), and agentic SOC operations are capturing the majority of disclosed capital. SecurityWeek M&A
⚠️ CRITICAL BREACHES & INCIDENTS¶
ShinyHunters — Aug 4 contact deadline passed on Questel SAS, Alcon Inc., Lumenis Ltd. — data publication status unconfirmedHighAll three deadlines (set Aug 1, expiring Aug 4) have now lapsed with no confirmed public data release found as of this writing. Ransomware.live blocked from cloud session (403); DLS status unverifiable directly. Pattern mirrors the Brinks Home / EY / RingCentral waves where deadlines slipped without immediate dumps. If data is released, it will surface in aggregators first. Claims: Questel SAS (France, IP management — 21M+ Salesforce records + 147 GB internal data); Alcon Inc. (Switzerland, ophthalmology — 25M+ Salesforce records + PII); Lumenis Ltd. (Israel, surgical laser systems — 1.1M+ records + 176 GB internal data). 🟥 Deadline lapsed; publication status unconfirmed — verify via DLS before treating as a breach. BreachNews · Dark Web Informer
Qilin — Service Electric (US telecom) and RUPP Spritzguss (Germany manufacturing) added to DLS, Aug 3–4HighService Electric is a regional US telco; RUPP Spritzguss is a German plastics injection-moulding manufacturer. No statements from either organisation; data scope and impact unconfirmed. Qilin has now claimed 104 victims in August alone, nearly double Akira in second place. 🟥 DLS claims only; verify before treating as confirmed breaches. Ransomware.live · GBHackers
INC Ransomware — Trulite Glass & Aluminum Solutions named on DLS, Aug 4HighUS glass and aluminium manufacturing firm. INC Ransomware is actively exploiting the SonicWall SMA1000 zero-day chain (CVE-2026-15409/15410, CVSS 10.0/7.2) and has now claimed 885+ cumulative victims across US, Australia, UAE, Colombia, and Switzerland. Attack toolkit includes KNUCKLEBALL Python script, Suo5 HTTP proxy, and custom ORANGETAIL Java webshell. 🟥 DLS claim only; no victim statement. The Hacker News · Resecurity
Anubis ransomware — BLACKBURN's Physicians Pharmacy added to DLS, ~Aug 3–4HighUS healthcare pharmacy. Follows the Winn-Dixie and Cameron Regional Medical Center listings this week. No victim statement; data scope unconfirmed. Anubis is continuing a pattern of food retail + healthcare targeting. 🟥 DLS claim only. Ransomware.live
DOUBLECUP — Russian loader-as-a-service deploys ClickFix + PNG steganography against enterprise SaaS usersMediumSOCRadar's Threat Research Unit disclosed DOUBLECUP, active since June 2026: a Go-based loader-as-a-service that hides malware in PNG images cached by the victim's browser, decrypts the payload using the victim's public IP address as the key, then delivers CountLoader or DeviceManager RAT (HTTP + DNS tunnelling for C2 via EtherHiding). Campaigns impersonate NetSuite, Odoo, HubSpot, and Salesforce login pages with fake CAPTCHA prompts. Attribution: Russian-speaking operator. Significant because it targets enterprise SaaS credential paths (not just consumer endpoints) and uses browser-cache steganography to evade endpoint detection. BleepingComputer · The Hacker News · SOCRadar
🔓 CRITICAL VULNERABILITIES¶
CVE-2026-9198 — IBM Langflow CVSS 9.8 — CISA KEV August 4; unauthenticated RCE on AI agent builderCriticalLangflow (open-source visual AI agent builder) exposes two chained endpoints on default deployments: `/api/v1/auto_login` mints SUPERUSER tokens for any unauthenticated network caller; `/api/v1/validate/code` executes attacker-supplied Python via `exec()`. No authentication required; any internet-exposed Langflow instance is fully compromised. Fix: upgrade above version 1.10.0. Scope: enterprises using Langflow for AI workflow automation and agentic application development. This is the second AI-infrastructure component added to KEV this year (after Anthropic tool-access misconfiguration in July). Immediately audit Langflow deployments for internet exposure; take any unsupported instances offline. CISA KEV · SentinelOne VDB · GBHackers
CVE-2026-34486 — Apache Tomcat EncryptInterceptor bypass — CISA KEV August 4; public PoC, unauthenticated-to-RCE pathCriticalRegression from an incomplete fix for CVE-2026-29146: changed control flow causes decryption failures to "fail open" instead of "fail closed," allowing unencrypted Tribes clustering messages to be accepted and processed. If the Tribes receiver port (default TCP/4000) is reachable and the target has usable Java deserialization gadgets on the classpath, exploitation moves from garbage traffic to arbitrary code execution. Public proof-of-concept exploit code released. Affected versions: 9.0.0.M1–9.0.116, 10.1.0-M1–10.1.53, 11.0.0-M1–11.0.20. Fix: upgrade to 9.0.117, 10.1.54, or 11.0.21 respectively. Tomcat is ubiquitous in Java enterprise stacks — audit clustering configurations and firewall TCP/4000 immediately. CISA KEV · SOCRadar · Field Effect
CVE-2026-18556 — N-able N-central auth bypass (CISA KEV August 4) — predecessor to CVE-2026-18577HighA second N-able N-central KEV addition within 48 hours (18577 was added August 3). This is the earlier of the two auth bypass CVEs in N-central's authentication path; the August 3 addition (18577) was an incomplete fix for 18556. The FCEB remediation deadline for both is August 6 — tomorrow. Apply N-central hotfix 2026.3.1.7 immediately. MSPs managing thousands of downstream client environments are the highest-risk targets. CISA KEV
TP-Link Omada ZTP — 15 vulnerabilities disclosed at Black Hat (Forescout Vedere Labs) — full network takeover chainHighForescout researchers identified 15 flaws in TP-Link Omada's zero-touch provisioning (ZTP) mechanism, presented August 4–5 at Black Hat USA 2026. Vulnerability classes: hardcoded cryptographic keys and certificates, insecure transmission of device/site credentials, weak certificate validation enabling MitM, race condition in cloud-based device adoption, XSS in controller web interfaces. Chained with two previously disclosed CVEs (CVE-2025-7850, CVE-2025-7851), they allow full remote code execution on the controller and then lateral movement to every managed device. Scope extends beyond Omada to VIGI IP cameras, Festa routers, Tapo and Kasa smart home lines. Over 1,800 internet-accessible Omada controllers identified. TP-Link is patching incrementally; some structural weaknesses will not be patched until later 2026; some rated "low severity" will not be patched at all. Take Omada controllers off public internet immediately; assume MitM risk on unpatched ZTP deployments. SecurityWeek · BleepingComputer · Industrial Cyber
LegacyHive Windows zero-day — day 21 unpatched; Patch Tuesday August 11 in 6 daysHighWindows User Profile Service local privilege escalation (NightmareEclipse, disclosed July 15) remains functional on all supported Windows versions. No CVE, no official patch. Microsoft has acknowledged and is working on a fix for next Patch Tuesday (August 11). 0patch micropatch is the only available mitigation. Combined with BlueHammer CVE-2026-33825 (confirmed in ransomware chains), this delivers unauthenticated-to-SYSTEM in two steps. BleepingComputer · SecurityWeek
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
CISA KEV triple update August 4 — CVE-2026-9198 (Langflow), CVE-2026-18556 (N-able), CVE-2026-34486 (Tomcat) added; FCEB deadline August 6 for N-able CVEsCriticalThree actively exploited vulnerabilities added in a single day, continuing the elevated KEV pace through Black Hat week. The IBM Langflow and Apache Tomcat additions are the most operationally impactful outside the MSP sector: Langflow is embedded in many enterprises' AI agent pipelines; Tomcat is a foundational Java web component with a published PoC. CISA
Laundry Bear (Russia/GRU) — CISA Advisory AA26-204A — Zimbra zero-click XSS (CVE-2025-66376) — active since July 2025CriticalThis advisory (issued July 23, 2026; joint CISA/NSA/FBI + international partners) covers a campaign not previously noted in this briefing series. Laundry Bear (also: Void Blizzard, CL-STA-1114, TA488 — Russian state-supported) is exploiting a Zimbra Collaboration Suite Classic UI XSS flaw that fires on email view — no link click required. The payload steals the last 90 days of inbox content, email address, password, Global Address List, and 2FA tokens. Campaign active since July 2025 (13+ months). Targets: defense industrial base, federal and local government, education, energy, law enforcement, media, NGOs, and technology. If your organisation runs on-premises Zimbra and has not applied the July 2025 patch for CVE-2025-66376, treat existing email accounts as fully compromised. CISA AA26-204A · BleepingComputer · Help Net Security
Black Hat USA 2026 Briefings — Day 1, August 5 — AI agent exploitation emerges as distinct attack disciplineHigh35 of 121 briefings directly address AI security, AI red teaming, or LLM-assisted offensive security. Key disclosures today: Check Point Research demonstrates exploitable logic across LangChain, CrewAI, AutoGen, and Semantic Kernel runtimes (no specialised tools required post-injection); Shoshitaishvili presents scientific foundations of autonomous exploit generation for IoT, browsers, kernels, and bootloaders. Microsoft's Agentic Security keynote (Weston): "The End of Rare" — AI-powered vulnerability discovery makes previously-rare attack classes cheap and frequent. Government keynote follows August 6 (Katherine Sutton, Asst Secretary of War for Cyber Policy — AI's role in US offensive cyber operations). Anthropic also announced Project Glasswing: AI-powered coordinated vulnerability disclosure program processing 10,000+ findings across 200 partner organisations, producing 9 CVEs. Black Hat USA 2026 · SecurityWeek · Straiker AI
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
INC RansomwareCritical885+ cumulative victims; accelerating since August 1 via SonicWall SMA1000 zero-day chain (CVE-2026-15409 + CVE-2026-15410, CVSS 10.0/7.2). Trulite Glass & Aluminum Solutions added to DLS August 4. Toolkit confirmed: KNUCKLEBALL Python loader, Suo5 HTTP tunnel proxy, ORANGETAIL Java webshell for persistence. Multi-sector, multi-country; post-exploitation social engineering includes fake "recovery assistance" phone calls. The Hacker News · Resecurity
QilinCritical104 victims claimed in August alone (as of Aug 3–4), nearly double Akira in second place. 443% YoY surge; 1,500+ total cumulative victims. New DLS additions in window: Service Electric (US telecom), RUPP Spritzguss (Germany manufacturing). Continues to actively exploit CVE-2026-0257 (Palo Alto GlobalProtect, CISA KEV May 29). Most prolific active group globally. GBHackers
ShinyHuntersHighFourth-wave contact deadline (Aug 4) lapsed on Questel SAS, Alcon Inc., Lumenis Ltd. with no confirmed public data release. All four ShinyHunters waves (EY, Brinks Home, RingCentral; now Questel/Alcon/Lumenis) follow the Salesforce-targeting Entra vishing tradecraft. ShinyHunters announced "permanent" hosting of stolen data even post-payment — a significant deterrence shift for victim negotiations. Dark Web Informer
AnubisHighThird new DLS posting in four days: BLACKBURN's Physicians Pharmacy (US healthcare). Prior: Winn-Dixie (grocery) + Cameron Regional Medical Center. Healthcare + food retail pattern; no victim statements; all unverified. 🟥 DLS claims only.
Laundry Bear (Russia)MediumStanding campaign via Zimbra CVE-2025-66376 zero-click XSS; CISA advisory AA26-204A July 23. 13+ months active; defense industrial base + government + NGO targeting. See Intelligence Agency section above.
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
Black Hat USA 2026 Day 1 signals a structural shift in the attack economy: AI agent exploitation has matured from a research curiosity to a commodity discipline in under 12 months — and US government officials speaking tomorrow (Katherine Sutton, Katherine Sutton, Asst Secretary of War for Cyber Policy) will address for the first time how AI fits into formal US offensive cyber doctrine.CriticalCheck Point's briefing today confirms exploitable logic in the four leading AI agent frameworks (LangChain, CrewAI, AutoGen, Semantic Kernel) requires no specialised tools post-injection — it is a defender problem, not a researcher problem. Microsoft's keynote framing ("The End of Rare") is the most significant industry acknowledgement that AI removes the cost barrier on rare-class attacks. The policy implication: AI agent security is no longer a DevOps concern — it is a force-multiplier for adversaries at every tier and must be integrated into procurement, vendor risk, and IR frameworks. Black Hat USA 2026 · Straiker AI
Three simultaneous CISA KEV additions in a single day (August 4) — hitting AI agent infrastructure (Langflow), Java enterprise middleware (Tomcat), and MSP management platforms (N-able) — signals that attackers have identified the integration and orchestration layer as the new primary attack surface.CriticalThese are not endpoint or network components — they are the connective tissue between enterprise systems. Langflow sits in AI pipeline orchestration; Tomcat underpins Java application servers across financial services, government, and manufacturing; N-able is the control plane for tens of thousands of MSP-managed SMEs. Exploiting one Tomcat cluster or one Langflow server does not compromise one organisation — it compromises everything downstream. The pattern of this KEV batch is strategic, not opportunistic. CISA
Russia's DOUBLECUP loader-as-a-service (targeting NetSuite/Odoo/HubSpot/Salesforce) represents an escalation of the Russian criminal ecosystem into enterprise ERP and CRM credential theft — a direct supply-chain intelligence risk for any company using Russian-adjacent contractors or offshore development with access to these platforms.HighDOUBLECUP's choice of impersonation targets (NetSuite = Oracle financials + supply chain; Odoo = ERP; HubSpot/Salesforce = CRM and sales) is deliberate: these platforms hold pricing data, customer contracts, financial forecasts, and M&A pipeline data. Credential theft from a sales CRM is an intelligence windfall for a state-adjacent actor. The PNG steganography delivery mechanism — loading malware from the browser's own cache — bypasses content inspection tools that check network transfers. BleepingComputer · SOCRadar
The Laundry Bear Zimbra campaign (AA26-204A) — running since July 2025 across defense, government, education, energy, and NGOs — is structurally more significant than its July 23 advisory date suggests: a zero-click email exfiltration tool operating for 13+ months across allied nations' defense industrial bases represents a sustained intelligence collection operation, not an opportunistic hack.HighThe 90-day email history exfiltration window means Laundry Bear has near-complete visibility into the communication channels of its target set — program schedules, budget discussions, contract negotiations, personnel movements. The UK NCSC, ACSC, and Canadian Centre for Cyber Security are co-signatories on the advisory, which means the footprint is confirmed across multiple Five Eyes nations. Any UK/AU/CA defense contractor or government body running on-premises Zimbra should treat mailboxes as already read. CISA AA26-204A · FDD
M&A activity
Socure → Fravity—
Brinqa → PlexTrac—
Munich Re (via HSB) → $575M—
Fortinet → Virtue AI—