Confidential · 18 Aug 2026
🛡️ Daily Cybersecurity Briefing — 2026-08-18 (Tuesday)¶
Window: last 24–48h (August 17–18). Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 113Top actor QilinM&A L30D $94.5M
💼 M&A ACTIVITY¶
No new deals announced August 17–18MediumThe market is in its mid-August lull. SecurityWeek's July 2026 roundup (21 named deals) remains the most recent published summary. No announcements in the 48-hour window.
L30D summary (Jul 19 – Aug 18): 35+ named deals tracked; disclosed capital exceeds $5.1B. Largest: Cyera → Oasis Security ($1B, NHI/DSPM); ThreatLocker $190M Series D; Zenity $125M Series C; Datavault AI → CyberCatch $94.5M all-cash; Obsidian Security $85M Series D. Consolidation theme unchanged: AI-agent governance, NHI security, and autonomous offensive security dominate capital allocation. SecurityWeek M&A tracker
⚠️ CRITICAL BREACHES & INCIDENTS¶
TaxAct — 2 million+ user records allegedly acquired; 450,000 already leaked publicly; unauthenticated API endpoints cited as entry vectorHighOn August 17, DataBreaches.net and malware.news reported that a threat actor claimed to have acquired more than 2 million TaxAct.com user records (emails, phone numbers, usernames) by exploiting unauthenticated API endpoints requiring only knowledge of URL paths. The actor published a sample of 25,000 records as proof and is advertising the remainder. TaxAct has not confirmed the breach or issued a public statement as of August 18. 🟥 Unconfirmed; TaxAct response pending. Given TaxAct's customer base of ~11 million tax filers, a 2M-record exposure of account identifiers would be materially significant for credential-stuffing and phishing targeting financial credentials. DataBreaches.net · malware.news
INC Ransom claims Otter Tail County, Minnesota — county government systems targeted; attack estimated August 11HighINC Ransom posted Otter Tail County (population ~60,000, west-central Minnesota) to its DLS on August 17. Ransomware.live attributed the attack to approximately August 11, predating the public listing. No official confirmation or impact statement from the county as of August 18. 🟥 DLS claim; extent of disruption unverified. Context: INC Ransom has claimed 893+ victims this year and is the dominant actor currently exploiting the SonicWall SMA 1000 chain (CVE-2026-15409/15410, CVSS 10); county government environments running unpatched perimeter appliances remain a primary target. ransomware.live
🔓 CRITICAL VULNERABILITIES¶
CVE-2025-62593 — Ray AI framework DNS rebinding RCE (CVSS 9.4) added to CISA KEV August 17HighCISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17 based on evidence of active exploitation. The flaw affects the Ray distributed AI/ML computation framework (Anyscale/ray-project): the Ray Dashboard and Ray Client server expose administrative endpoints without authentication; a DNS rebinding attack delivered via malicious web page or malvertising executes arbitrary code in the Ray worker's OS context. Prior to version 2.52.0, the only defense was a weak User-Agent header check (testing for "Mozilla"), which is trivially bypassed. Organizations running Ray in development or production AI infrastructure should upgrade to 2.52.0 immediately — no mitigating configuration exists in older versions. CISA KEV · CVEmon · OSV
Unisoc VoLTE exploit chain — full Android kernel access via incoming video call; no vendor patch availableHighSSD Secure Disclosure published the second stage of its Unisoc modem exploit chain on August 17, completing a full kernel-level compromise chain on devices using T606, T612, and T7250 chipsets. The chain: Stage 1 (March 2026) gained remote code execution in the modem context via a malformed SIP video call; Stage 2 (August 17) exploits the lack of memory isolation between modem and Android kernel — by zeroing protections on MPU memory region 0, the attacker can read and write physical kernel memory, achieving local privilege escalation to full kernel access. Attack requirements: attacker must control a private 4G cellular network and the victim must answer an incoming video call. SSD attempted disclosure via email and LinkedIn; Unisoc has not responded. No patch or firmware update is available; device owners should await updates from their device OEM. Affected chipsets are common in low- and mid-range Android handsets sold across Africa, Asia, and Eastern Europe. The Hacker News · Dark Reading · Infosecurity Magazine
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
CISA KEV update August 17 — CVE-2025-62593 (Ray) added; FCEB agencies must remediateHighSee Critical Vulnerabilities above. FCEB agencies have the standard 21-day remediation deadline. Standing KEV priorities still active: Lazarus/CVE-2026-68820 deadline ~August 25; SonicWall SMA 1000 CVE-2026-15409/15410 (patch and assume compromise); GeoServer GHSA-mqjf-5f49-2fjh (apply 3.0.1/2.28.5/2.27.6); SAP Commerce CVE-2026-58231 CVSS 10.0 (active exploitation). CISA KEV
No new CISA/FBI/NSA/NCSC-UK cybersecurity advisories published August 17–18.MediumUkraine Independence Day threat window (August 24) remains an elevated-alert period; CERT-UA and Five Eyes partners are expected to communicate ahead of and during August 24 if Russia executes coordinated cyber-kinetic action against Ukrainian energy infrastructure. See Geopolitics below.
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
INC Ransom — Otter Tail County, MN listed August 17; SonicWall exploitation campaign continues; 893+ total victimsHighINC Ransom added a Minnesota county government to its DLS on August 17 (see Breaches). The group has been the most active US-targeting ransomware operator since mid-July, exploiting the SonicWall SMA 1000 zero-day chain (CVE-2026-15409/15410) and stealing TOTP seed configurations for persistent post-password-reset access. Primary sectors: Professional Services (21%), Healthcare (15%), Manufacturing (14%). Operator overlap with Lynx (confirmed by FortiBleed forensics) means both banners track the same core infrastructure. ransomware.live · Resecurity
Clop Windchill/FlexPLM campaign — 44+ victims, FIS Global and Philips investigations ongoingHighNo new named victims added in the Aug 17–18 window. Philips confirmed it is investigating; FIS Global has not confirmed breach. GE has not issued a statement. The campaign exploiting CVE-2026-12569 (CVSS 9.3) remains the single largest concurrent industrial/enterprise data-theft operation of 2026. BleepingComputer
The_Gentlemen — sustained elevated tempo; remains highest-volume DLS poster for AugustHighNo new large-scale actor emergence in the 48-hour window. The_Gentlemen continues to post the highest weekly volume globally. 🟥 All DLS postings are unverified claims. ransomware.live
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
Ukraine's August 24 Independence Day is now six days away; US and German intelligence have publicly assessed Russia is preparing a mass missile strike on Kyiv energy infrastructure — the first such assessment to name specific infrastructure targets and a specific date window.CriticalGermany's Federal Foreign Office updated its Ukraine travel advisory this week, warning citizens of "a high probability of intensified attacks on critical infrastructure" targeting power substations, thermal power plants, and railway hubs. Russia's doctrine: pair the largest kinetic strike windows with coordinated cyber disruption of energy SCADA/ICS systems (consistent with the Sandworm playbook documented in every major Ukrainian grid attack 2015–2026). Organizations with OT exposure to Ukrainian energy operators or NATO-adjacent grid interconnects should treat August 22–26 as elevated risk for SCADA intrusion attempts and disruption of energy management software. Visit Ukraine · Critical Threats / AEI
The TaxAct breach claim illustrates a structural shift in US financial-services targeting: tax preparation platforms are a more valuable target than banks because they hold verified income data, SSN linkages, and credit identifiers across a non-transactional customer base that does not monitor for unusual activity.HighBanks have real-time fraud detection; tax platforms process once a year and sit quiet the other eleven months. A breach of 2 million TaxAct accounts delivers the same identity data required for IRS refund fraud, synthetic-identity credit applications, and high-net-worth phishing that the French DGFiP breach provides for physical wrench attacks. The structural issue: US tax-prep APIs are rarely treated as critical financial infrastructure from a security posture standpoint, despite holding data identical in value to bank records. If confirmed, TaxAct's unauthenticated API exposure suggests the vulnerability class here is basic API security hygiene, not sophisticated nation-state tradecraft. DataBreaches.net · Accounting Today
The Unisoc VoLTE exploit chain published August 17 has a concrete geopolitical dimension: the affected chipsets (T606/T612/T7250) are dominant in low- and mid-range Android handsets across Africa, Central Asia, and Eastern Europe — exactly the target populations for signals intelligence collection by state actors who control private 4G infrastructure.HighThe attack requirements — control of a private cellular network and an incoming call answered by the victim — map precisely to the operational environment of state intelligence agencies in authoritarian states that operate private APNs for targeted surveillance. This is not a commodity ransomware vector; the practical attack surface is intelligence collection, not mass exploitation. The absence of a vendor response from Unisoc after months of outreach by SSD mirrors the Qualcomm/MediaTek modem disclosure pattern: chipset vendors for the budget device market treat security disclosure as a reputational cost to be absorbed, not a compliance obligation. The Hacker News · Dark Reading
Iran's cyberattack tempo against Israeli and US targets continues to track to the state-conflict rhythm: as ceasefire negotiations for the kinetic campaign show intermittent movement, Iranian cyber operations are being used to maintain strategic pressure without triggering escalation clauses.HighThe tripling of hostile cyber incidents against Israel (1,600/month in June 2025 to 4,800/month in June 2026) and the shift to LOLBins tradecraft means Iranian actors are hardening their evasion posture ahead of what they assess will be continued infrastructure targeting. The water-utility campaign across 12 US states — attributed by multiple sources to Iranian-linked actors — is a separate parallel effort using PLCs rather than IT-network intrusion, positioning Iran to demonstrate disruptive capability against US civilian infrastructure without triggering the same escalation threshold as a destructive cyberattack. Times of Israel · Axios · CBS News
M&A activity
Socure → Fravity—
Brinqa → PlexTrac—
Munich Re (via HSB) → $575M—
Fortinet → Virtue AI—