สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Rush To Build Data Centers Leaves OT Security Behind
  "In the rush to get servers on the ground, and new compute up and running, especially to cater to the artificial intelligence boom, data center owners have neglected security and left vulnerable operational technology devices dangerously close to the public internet, according to experts and recent research. Total U.S. capital expenditure on data centers is expected to top $700 billion this year, according to Moody's Investor Services, as tech giants and their smaller rivals race to power ever larger and more complex large language models and meet the predicted mushrooming demand from business. Over the next five years, predicts market intelligence firm Industrial Info Resources, data center developers and big tech firms plan to start construction on 2,913 data centers at a cost of about $2.4 trillion by 2030."
  https://www.bankinfosecurity.com/rush-to-build-data-centers-leaves-ot-security-behind-a-32538
• ICS Patch Tuesday: Vulnerabilities Fixed By Siemens, Schneider, Phoenix Contact
  "Industrial giants Siemens, Schneider Electric, and Phoenix Contact have published August 2026 Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS products. Siemens has published 10 new advisories. One covers a maximum-severity missing-authentication vulnerability in Simatic IoT2050 Advanced devices. A remote, unauthenticated attacker can exploit it to execute arbitrary code on the underlying server with elevated privileges. A critical code execution vulnerability has also been fixed by Siemens in the Siveillance Video Management Servers."
  https://www.securityweek.com/ics-patch-tuesday-vulnerabilities-fixed-by-siemens-schneider-phoenix-contact-2/
• Rockwell Automation/Allen-Bradley MicroLogix PLCs Attack
  "Cyber threat actors are targeting Internet-facing programmable logic controllers (PLCs) used by water and wastewater organizations, with successful compromises resulting in operational disruptions. Attackers have gained access to exposed PLCs and manipulated their operation, demonstrating the potential for Internet-accessible OT systems to be directly abused to disrupt physical processes. While the reported activity specifically references Rockwell Automation/Allen-Bradley MicroLogix PLCs, the targeting is not necessarily limited to these products, and other internet-facing PLCs may also be at risk."
  https://fortiguard.fortinet.com/threat-signal-report/6498

Vulnerabilities

• Adobe Patches Critical Magento Account Takeover (APSB26-92)
  "Adobe has released isolated security patches for APSB26-92 for Adobe Commerce and Magento Open Source. The update fixes seven vulnerabilities. Five are rated Critical, including CVE-2026-71362, an unauthenticated customer account takeover with a CVSS score of 9.1. Exploitation needs no existing account, administrator privileges or user interaction."
  https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92
  https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/
• Ivanti EPM Update Patches Remotely Exploitable Flaws
  "Enterprise software company Ivanti on Tuesday announced patches for four vulnerabilities in Endpoint Manager (EPM) and Neurons for MDM. The EPM update addresses three high-severity bugs, including two that could be exploited by remote, unauthenticated attackers. Tracked as CVE-2026-18129, the first is described as a cleartext transmission of sensitive information issue that can be exploited by an attacker in a man-in-the-middle (MitM) position to leak credentials for external SQL connections."
  https://www.securityweek.com/ivanti-epm-update-patches-remotely-exploitable-flaws/
• SonicWall Patches Critical Vulnerabilities In Discontinued GMS Platform
  "SonicWall on Tuesday announced patches for eight vulnerabilities across two products, including critical-severity remote code execution (RCE) bugs. The cybersecurity firm rolled out fixes for six security defects in Global Management System (GMS), its centralized management, monitoring, and reporting platform that was retired in October 2025. Per SonicWall’s advisory, two of the flaws, namely CVE-2026-66147 (CVSS score of 9.4) and CVE-2026-66145 (CVSS score of 9.1), deserve special attention, as both could allw remote, unauthenticated attackers to execute arbitrary code."
  https://www.securityweek.com/sonicwall-patches-critical-vulnerabilities-in-discontinued-gms-platform/
• New Microsoft Defender 'ShieldBreak' Zero-Day Grants SYSTEM Privileges
  "A security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldBreak" after Microsoft released the August 2026 Patch Tuesday security updates. The new vulnerability is described as a bypass for RoguePlanet, another Defender privilege escalation flaw disclosed in June and patched by Microsoft one month later. However, cybersecurity expert Kevin Beaumont, who also published ShieldBreak exploitation detection queries for Microsoft Defender for Endpoint, said that the two exploits work very differently."
  https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldbreak-zero-day-grants-system-privileges/
  https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html
  https://securityaffairs.com/197063/hacking/shieldbreak-new-windows-zero-day-bypasses-microsofts-rogueplanet-patch.html
• Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined
  "Intel and AMD on Tuesday announced patches for a total of more than 80 vulnerabilities across their products. Intel has published 42 new advisories covering 72 vulnerabilities. The company patched several high-severity flaws in PROSet/Wireless WiFi software that could allow an attacker to escalate privileges or conduct a denial-of-service (DoS) attack."
  https://www.securityweek.com/chipmaker-patch-tuesday-intel-amd-fix-over-80-vulnerabilities-combined/
• OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning
  "A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. The weakness affected encrypted reasoning objects used by the providers' reasoning APIs, where a block created in one session could be replayed into another and, during testing, even handed to a weaker model in the same provider family to make it reveal the hidden content."
  https://thehackernews.com/2026/08/openai-anthropic-google-api-flaw-let.html
  https://arxiv.org/abs/2608.09867

Malware

• Active Exploitation Of CVE-2026–59310: 361 Victim IPs Across 47 Countries
  "QUIRSO’s Threat Research team is tracking an active exploitation campaign targeting internet-accessible VMware vCenter systems. Based on evidence collected during a recent incident response engagement, we assess that a suspected advanced persistent threat (APT) actor is exploiting CVE-2026–59310 and using reverse SSH to maintain access to compromised systems. CVE-2026–59310 is a critical directory-traversal vulnerability in the VMware vCenter Syslog server. According to Broadcom, an attacker with network access to vCenter may exploit the vulnerability to execute arbitrary code."
  https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff
  https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html
• The “City-Forum” Campaign - An Advanced Attacker Is Targeting Salesforce And ServiceNow Instances Worldwide
  "Reco is tracking an ongoing campaign we've named the City-Forum Campaign, after a domain tied to the threat actor's IP (more on that below). A single server is pulling records out of Salesforce Experience Cloud sites and ServiceNow (SNOW) Service Portals, from infrastructure that has been standing since March 2025. In the last year, we've seen many threat actors that use Aura enumeration against over-permissioned Salesforce guest users, for example ShinyHunters. This actor is different. Except for Aura, the attacker reaches Salesforce Lightning Web Runtime (LWR) sites through the UI-API, a data layer we have not seen any public tool or write-up about, and it hammers a native ServiceNow Service Portal search endpoint that has almost no online documentation or well-known open source tools."
  https://www.reco.ai/blog/city-forum-campaign-salesforce-servicenow
  https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/
  https://www.darkreading.com/cyberattacks-data-breaches/long-running-data-theft-campaign-salesforce-servicenow
  https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/
  https://www.helpnetsecurity.com/2026/08/12/salesforce-servicenow-guest-user-exposure/
• 737 Chrome VPN Extensions Linked To Brand Impersonation And Browser Traffic Redirection
  "Socket's Threat Research Team identified a campaign of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts, 274 of which impersonate 66 established VPN and privacy brands, that route the user's entire browser session through SOCKS5 proxies operated by a single provider. Socket analyzed the code of 525 of them, 522 from bulk retrieval and 3 more found during store enumeration; the remaining 212 had been removed from the store before collection and were recovered at listing level only. 520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure."
  https://socket.dev/blog/chrome-vpn-extension-impersonation
  https://thehackernews.com/2026/08/737-chrome-vpn-extensions-caught.html
  https://www.bleepingcomputer.com/news/security/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy/
• FBI: Hackers Target Online Accounts To Steal Nude Photos
  "The FBI warns that cybercriminals are targeting adults' and children's social media and other online accounts to steal sexually explicit images or videos. As the law enforcement agency explained in a public service announcement published this week, the attackers may use the stolen content to blackmail the victims or try to sell it on criminal marketplaces. They may also share the victims' personal information (including names, dates of birth, emails, phone numbers, and social media usernames) with other criminals, who can use it to pressure them into providing additional private images and videos through sextortion."
  https://www.bleepingcomputer.com/news/security/fbi-warns-of-hackers-targeting-online-accounts-to-steal-explicit-photos/
  https://www.ic3.gov/PSA/2026/PSA260810
  https://therecord.media/social-engineering-hackers-explicit-photos-fbi-alert
• Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
  "On July 14, 2026, Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass vulnerability affecting Microsoft SharePoint. Today we are publishing a technical analysis of the vulnerability along with an accompanying proof-of-concept (PoC) script. A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server, and perform operations as a SharePoint site user or administrator. The vulnerability is due to several issues in the JWT token validation pipeline."
  https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
  https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/
  https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/
• You're Invited To Get Phished! Why Invitation-Themed Emails Remain Effective
  "Threat actors are weaponizing party invitation-themed emails to steal credentials and install malware on victims’ machines. Cofense Intelligence has observed a sustained rise in phishing campaigns disguised as event invitations, spoofing trusted platforms such as Punchbowl, Greenvelope, Paperless Post, and Evite. Behind the familiar branding, these emails deliver credential-harvesting login pages and remote access tools that give threat actors persistent control of a victim’s machine. The same link can fingerprint the recipient’s device and deliver different payloads to desktop and mobile users simultaneously, expanding the reach of each campaign without additional effort. The technology behind these campaigns has evolved, but the underlying lure has not. People are naturally curious about invitations, and attackers continue to exploit that instinct."
  https://cofense.com/blog/you-re-invited-to-get-phished!-why-invitation-themed-emails-remain-effective
• Inside a Multi-Agent AI Framework Used To Compromise Government Entities In Asia
  "What follows is but one concrete example of what appears to be a near-autonomous attack, running off readily available harnesses and models and aimed at a nation state. Details on the attack were initially shared with the Financial Times. In roughly four days, the agentic attacker produced 1,395 files, 85 cracked credentials, thousands of exfiltrated personnel records, and gained a persistent foothold inside state infrastructure. It spells out one thing loudly - the cost of running a competent attack has collapsed, but the cost of defending against one has not."
  https://www.dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia
  https://cyberscoop.com/near-autonomous-ai-attack-government-target-taiwan/
  https://securityaffairs.com/197079/apt/china-linked-hackers-use-ai-agents-in-autonomous-attack-on-taiwan.html
• Gone With The WindRelay: A New Malware Combo Behind a Growing Fraud Scheme
  "Contactless payment fraud has moved from a theoretical risk to an operational one, and the scale is now visible in both industry and regulatory reporting. The European Payments Council’s 2025 Payment Threats and Fraud Trends report identifies NFC relay fraud — and the related “Ghost Tap” technique — as a rising category, noting it frequently overlaps with remote access scams and results in unauthorized transactions and a complete loss of control over funds, with victims sometimes unknowingly drawn into money laundering as a result. The scale behind that assessment shows up clearly in independent telemetry: NFC-based attacks on Android devices rose 188% in the first four months of 2026 compared to the same period in 2025, with 35,600 attacks blocked in that window alone, up from over 12,300 a year earlier (Kaspersky); this followed a more than 35-fold increase in NFC-related attacks recorded in the first half of 2025 compared to the second half of 2024 (ESET)."
  https://www.group-ib.com/blog/windrelay-nfc-spynote-rat-combo-fraud/
  https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/
  https://www.infosecurity-magazine.com/news/windrelay-nfc-relay-spynote-rat/
• CopyEscape: Taking Over Docker Hosts With Docker Cp
  "Imperva Red Team uncovered CVE-2026-17106, a container-to-host arbitrary file-write vulnerability in Docker’s docker cp command. Docker later confirmed that the same CVE also affected sbx cp when copying files out of Docker Sandboxes. A malicious container or sandbox could exploit the copy process to create or overwrite files outside the destination selected by the user, potentially enabling code execution on the machine running the Docker CLI."
  https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/
• Dragon Breath (APT-Q-27): RONINGLOADER And Gh0st RAT Explained
  "Dragon Breath, also known as APT-Q-27and Golden Eye Dog, is a Chinese cybercrime APT first observed in 2020, targeting Chinese-speaking users and organizations across the Asia-Pacific region, including China, Hong Kong, Taiwan, Singapore, Japan, and the Philippines, with a focus on online gambling and financial services. Dragon Breath stands out for layered execution and defense evasion, combining trojanized installers with double-clean-app DLL side-loading, signed kernel drivers, Protected Process Light abuse, thread-pool process injection, and malicious code-signing. Its recent RONINGLOADER chain also deploys a modified Gh0st RAT over WebSocket-based C2 while actively disabling Windows Defender and regional endpoint security tools."
  https://www.picussecurity.com/resource/blog/dragon-breath-apt-q-27-roningloader-and-gh0st-rat-explained
• ClickFix Campaign Abuses Deno Runtime For Infostealer Delivery
  "Counter Threat Unit (CTU) researchers investigated a June 2026 campaign in which threat actors used the Deno JavaScript runtime as a core execution mechanism within a ClickFix-driven intrusion chain. On June 3 and June 4, compromised WordPress sites served Cloudflare-themed ClickFix lures that prompted users to execute a clipboard-delivered PowerShell command. This command initiated an MSI-based staging process that installed Deno and enabled retrieval and execution of remote JavaScript. CTU analysis indicates that Deno functioned as a key element supporting payload delivery, follow-on tasking, and persistence."
  https://www.sophos.com/en-us/blog/clickfix-campaign-abuses-deno-runtime-for-infostealer-delivery
• Inside a Russian-Speaking Operator's Toolkit For Compromising Ukrainian IP Cameras
  "In late May 2026, Hunt.io Attack Capture identified an open directory on 89.208.97[.]165 containing files pointing to the compromise of a Ukrainian e-commerce site. The intrusion itself, through credential theft and SQL injection, is only the starting point. Bash history and custom scripts recovered from the directory show the operator turned that access into a proxy server, and then used password spray attacks and attempted web shell deployment against Ukrainian government and military sites. During our investigation, we identified a custom platform built to find, exploit, and catalog internet-exposed IP cameras."
  https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit

Breaches/Hacks/Leaks

• Ransomware Attack Disables Canadian Hospital's Doors, HVAC
  "A Canadian hospital is dealing with a ransomware attack on its facility management systems that has affected the building's doors and heating, ventilation and air conditioning equipment. Some experts said the incident underscores growing cyberthreats involving operational technology in healthcare. The attack this week on Manitoba, Ontario's largest hospital - Winnipeg's Health Sciences Centre, which is a facility operated by Shared Health, is under investigation, a Shared Health spokesperson told ISMG."
  https://www.bankinfosecurity.com/ransomware-attack-disables-canadian-hospitals-doors-hvac-a-32535
• Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition
  "Colombia's Ministry of Justice confirmed that a ransomware attack struck part of its technology infrastructure and degraded several public-facing services on Aug. 2, just five days before the nation's presidential handover. The attack, which disrupted some services around illicit-drug monitoring and legal processes, came a day after Colombia's national CERT (ColCERT) published a threat intelligence warning that ransomware groups had increased their focus on the country. While some media reports suggested that data had leaked during the Ministry of Justice compromise, then acting Minister of Justice Cielo Rusinque denied that any information had been stolen, during a Spanish-language news interview."
  https://www.darkreading.com/cyberattacks-data-breaches/ransomware-hits-colombian-justice-ministry-presidential-transition
• 2,500+ Companies And 434,000 CI/CD Pipelines Exposed In The Largest AI Supply Chain Breach Of 2026
  "In March 2026, the threat actor group TeamPCP orchestrated what is believed to be the largest supply chain attack targeting AI infrastructure by compromising LiteLLM. CloudSEK Threat Intelligence was able to get access to the victim information and is disclosing the details of all the impacted victims . We are sharing this openly so that every affected organization can act proactively The threat is still live: the FBI's July 2026 FLASH advisory (FLASH-20260702-01) warns that affiliated actors are likely to weaponize the harvested credentials long after the original intrusion, which means further supply chain attacks remain a real possibility. Early awareness is the strongest defense; knowing you were impacted lets you rotate credentials, close the exposure, and harden before the next campaign hits."
  https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines
  https://exposure.cloudsek.com/ai-supply-chain-incident
  https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html
  https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/
• Three Intrusions At UK Criminal Records Office Went Undetected For Two Years
  "Britain's criminal records office has been reprimanded by the country’s data protection regulator after being repeatedly breached over nearly two years, exposing the personal data of thousands of people including victims of domestic violence. The Information Commissioner’s Office (ICO) announced in the reprimand notice Wednesday that it was censuring ACRO Criminal Records Office over a range of security shortcomings, among them alerts from antivirus software going unread and a critical system left unpatched for nearly four years."
  https://therecord.media/uk-criminal-records-office-acro-data-breaches

General News

• July 2026 Cyber Threats Surge: Ransomware Attacks Double Year Over Year As GenAI Data Exposure Widens
  "July’s cyber threat landscape was shaped by pressure across multiple fronts. Global cyber attacks continued to rise, ransomware activity broke from the more stable pattern seen earlier in the year, and GenAI exposure became a clearer operational risk as employees used more tools and generated more prompts across the enterprise."
  https://blog.checkpoint.com/security/july-2026-cyber-threats-surge-ransomware-attacks-double-year-over-year-as-genai-data-exposure-widens/
• Walmart Leaders Transform Security Operations Without Going Bananas
  "As the world's largest retailer, Walmart knows a thing or two about scale. It sells more bananas than any grocer, employs more than 2 million people across 19 countries, and generates more than $700 billion in annual revenue. And like all large companies, it's also in the crosshairs of cyber adversaries, so it's imperative that its leadership team understands the risks and buys into a mitigation plan."
  https://www.darkreading.com/cybersecurity-operations/walmart-leaders-transform-security-operations-without-going-bananas
• Split-Second Deepfake Glitch Blows Digital Certificate Fraudster’s Cover
  "Spanish police have arrested a man in Murcia accused of using deepfake software to trick a certificate provider’s video identity checks in an attempt to obtain digital signatures he could use for financial fraud. According to the police, the man made 38 attempts using this method on more than 30 citizens. Police haven’t said how many of those attempts succeeded before the scheme was uncovered. The National Police said the investigation started after a company that issues electronic certificates flagged a string of suspicious verification requests."
  https://www.helpnetsecurity.com/2026/08/12/deepfake-video-identity-verification-fraud-arrest-spain/
• Post-Quantum Migration Gets Harder When Every User Holds a Key
  "In this Help Net Security interview, Christopher Smith, CEO of Quantus, discusses what cryptographic inventories turn up in banks and hospitals, including default passwords and admin keys still held by former employees. He explains where post-quantum key sizes break old size assumptions in IPsec, SSH, TLS and libp2p, why migrating user keys makes blockchains hard to upgrade, and what a silent quantum break would look like from outside. He also gives the argument for funding work whose payoff stays invisible."
  https://www.helpnetsecurity.com/2026/08/12/christopher-smith-quantus-post-quantum-migration/
• 338 Million Attack Simulations Reveal The State Of Enterprise Defense
  "First, a bit of good news: Enterprise defenses are recovering. However, it’s a narrow recovery, with a twist. Today, organizations are better at stopping loud attacks but have barely moved the needle at all against the quiet ones. This data, and a lot more, comes straight from the newly published Blue Report 2026, the fourth annual comprehensive study from Picus Labs. Based on more than 338 million attack simulations run in real production environments in the first half of 2026, the report measures how enterprise prevention and detection actually performed against real attacks, from what controls stopped at the perimeter to what attackers can achieve once they’re inside."
  https://www.helpnetsecurity.com/2026/08/12/picus-security-blue-report-2026/
  https://thehackernews.com/2026/08/enterprise-defenses-recovered-at-edge.html
• AI Deployments Are Stretching Enterprise Security To Its Limits
  "CISOs and CTOs expect AI deployments to increase their organizations’ attack surface by an average of 14% over the next year. Nearly all lack visibility into AI deployments, and 90% are concerned about employees using unapproved AI tools outside formal oversight, according to NetFoundry’s 2026 State of Secure AI Access survey. Organizations are under pressure to secure AI deployments, particularly in the retail and travel, healthcare and pharmaceuticals, and technology sectors. AI-related risks are now a top concern for security leaders. Only 15% of respondents said they were very confident their existing security tools could adequately protect AI deployments. Confidence was lower for CISOs."
  https://www.helpnetsecurity.com/2026/08/12/netfoundry-securing-ai-deployments-report/
• NIST Seeks Public Input On AI-Ready NVD Modernization
  "The US National Institute for Standards and Technology (NIST) is looking to modernize its National Vulnerability Database (NVD) to address challenges posed by AI and incorporate more automation and AI workflows. In a request for information (RFI) published on August 12 in the Federal Register, NIST encouraged stakeholder input on opportunities, challenges and priorities for modernizing the NVD in “an evolving cybersecurity landscape increasingly shaped by AI and machine-consumable security data.” The Institute is particularly interested in receiving “forward-looking perspectives, practical recommendations and innovative models” that will improve the NVD’s scalability, automation, interoperability, transparency and utility."
  https://www.infosecurity-magazine.com/news/nist-seeks-public-input-ai-nvd/
  https://www.federalregister.gov/documents/2026/08/12/2026-16371/request-for-information-rfi-on-modernizing-the-national-vulnerability-database-in-the-age-of
• AI-Related Software Vulnerabilities: 2025–2026
  "AI and machine learning (ML) software has generated a steady stream of Common Vulnerabilities and Exposures (CVEs) in deep-learning frameworks, model-serving stacks, large language model (LLM) application platforms, agent frameworks and enterprise AI assistants. This article examines that body of AI-related software as a whole and compares it to the rest of the vulnerability corpus across 2025 and the first months of 2026: how severe its vulnerabilities are, how likely they are to be exploited, which weaknesses dominate, and who builds the affected software."
  https://blog.barracuda.com/2026/08/12/ai-related-software-vulnerabilities--2025-2026

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Healthcare Sector

• Mira Hormone Monitor, Mira Android App
  "Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information, and obtain control of user accounts."
  https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01
• Pulsetto Vagus Nerve Stimulator
  "Successful exploitation of this vulnerability could allow an attacker to use hidden commands to disable electrical safety mechanisms or modify other stimulation output settings."
  https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-02

Industrial Sector

• Industrial Ransomware Analysis For Q2 2026
  "In the second quarter (Q2) of 2026, analysis of publicly disclosed victim data and ransomware groups’ postings on Data Leak Sites (DLS) identified 1,140 ransomware incidents affecting industrial organizations worldwide, a 12% increase over the 1,020 incidents recorded in Q1. Ransomware remained the most persistent and disruptive cyber threat to industrial organizations in Q2 2026, sustaining the elevated pace established throughout 2025 and continuing to impact operational environments via the loss of enterprise IT systems, Enterprise Resource Planning (ERP) platforms, and virtualization infrastructure, versus direct manipulation of control systems."
  https://www.dragos.com/blog/dragos-industrial-ransomware-analysis-q2-2026
  https://www.helpnetsecurity.com/2026/08/11/industrial-ransomware-attacks-q2-2026/

Telecom Sector

• An AI Tool Found 84 Flaws In 5G Network Software And 23 Of Them Still Have No Fix
  "Researchers at Nanyang Technological University turned a set of AI agents loose on the software that runs 4G and 5G phone networks, and the agents came back with 84 security flaws nobody had reported before. Developers have confirmed 83 of them, and 81 now carry CVE numbers. The most serious one lets an attacker take over a subscriber’s data session, so the network delivers that subscriber’s traffic to
  https://www.helpnetsecurity.com/2026/08/11/5g-core-network-vulnerabilities-research/
  https://arxiv.org/pdf/2607.10315
• Researchers Show How Malicious SIM Cards Can Hijack Smartphones, EV Chargers And Connected Devices
  "Subscriber Identity Modules (SIMs), the secure element used to connect devices to a mobile network, can pose severe security risks when compromised. A malicious SIM could allow attackers to gather information about a device, interfere with its connectivity, and serve as an entry point for further cyberattacks. Presenting their findings at the 2026 USENIX WOOT Conference on Offensive Technologies, in Baltimore, University of Birmingham researchers reveal a new attack surface exposed to malicious and compromised SIMs."
  https://www.birmingham.ac.uk/news/2026/researchers-show-how-malicious-sim-cards-can-hijack-smartphones-ev-chargers-and-connected-devices
  https://www.usenix.org/system/files/woot26-lisowski.pdf
  https://thehackernews.com/2026/08/a-malicious-sim-card-can-run-attacker.html
  https://www.helpnetsecurity.com/2026/08/11/malicious-sim-cards-hijack-phones-ev-chargers/

Vulnerabilities

• Adobe Urges Immediate Patching Of Critical ColdFusion, Campaign Classic Flaws
  "Adobe on Tuesday rolled out patches for over 50 vulnerabilities across its products, including critical-severity bugs in ColdFusion, Campaign Classic, and Commerce. With a priority 1 rating, the ColdFusion update fixes 15 security defects, including three flagged as critical that could lead to arbitrary code execution and application denial-of-service (DoS). These include an OS command injection tracked as CVE-2026-48362 (CVSS score of 10/10), an eval injection tracked as CVE-2026-48273 (CVSS score of 9.9/10), and an incorrect authorization tracked as CVE-2026-71384 (CVSS score of 9.6/10)."
  https://www.securityweek.com/adobe-urges-immediate-patching-of-critical-coldfusion-campaign-classic-flaws/
• SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities
  "Enterprise software maker SAP on Tuesday announced the release of 28 new security notes, two updates to previous notes, and a GitHub advisory. Four of the notes published on SAP’s August 2026 Security Patch Day resolve critical vulnerabilities, the most severe of which is CVE-2026-58231 (CVSS score of 10/10), an improper authorization issue in SAP Commerce Cloud (Data Hub Adapter). The bug could allow remote attackers to bypass authentication, likely leading to code execution and unauthorized access to internal components. Successful exploitation would impact the confidentiality, integrity, and availability of the application."
  https://www.securityweek.com/sap-patches-critical-code-injection-memory-corruption-vulnerabilities/
• Cisco Warns Of ASA And FTD VPN Flaw Exploited To Crash Devices
  "Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices. The flaw, tracked as CVE-2026-20349, has a severity score of 8.6 and impacts devices running Cisco Secure Firewall Adaptive Security Appliance (ASA) or Secure Firewall Threat Defense (FTD) software with certain remote access services enabled. In a security advisory published today, Cisco said the vulnerability is caused by insufficient error checking while processing HTTP requests."
  https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices/
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF
• Microsoft August 2026 Patch Tuesday Fixes 400 Flaws, 3 Zero-Days
  "Today is Microsoft's August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. Patch Tuesday addresses 42 "Critical" vulnerabilities, 37 of which are remote code execution and 5 are elevation of privilege."
  https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/
  https://blog.talosintelligence.com/microsoft-patch-tuesday-for-august-2026/
  https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html
  https://www.darkreading.com/application-security/microsofts-patch-tuesday-deluge-continues
  https://www.securityweek.com/august-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day/
• ZOOMSDAY
  "A critical vulnerability in Zoom, a platform used by 70% of the Fortune 100, discovered by publicly available frontier models, allows an attacker participating in a meeting a zero-click remote code execution on all meeting participants across all native clients. This research emphasizes the risk of weaponized AI and how vulnerable we are as an industry."
  https://a.security/blog/asecurity-zoomsday
  https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html
  https://www.securityweek.com/zoom-patches-zero-click-code-execution-vulnerability/
  https://securityaffairs.com/197042/hacking/zoom-patches-zoomsday-zero-click-flaw-enabling-remote-code-execution.html
• CISA Adds Three Known Exploited Vulnerabilities To Catalog
  "CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) Heap Inspection Vulnerability
  CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
  CVE-2026-72898 Metabase SQL Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog
• CISA: Microsoft SharePoint Flaw Now Exploited In Ransomware Attacks
  "CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July. Tracked as CVE-2026-45659, this security flaw stems from a deserialization of untrusted data weakness and allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers. It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) "an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.""
  https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/
  https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html
• Cursor Security Bug Allowed Repositories To Execute Commands Before Trust Verification
  "A flaw in Cursor's command-line coding agent has been found to allow a cloned repository to run any command it chose on a developer's machine before they were asked whether they trusted it, and outside the sandbox even when the sandbox had been explicitly switched on. Manifold Security said it reported the issue to Cursor on July 20 and published its findings on August 10. Cursor shipped a fix for the pre-trust behavior three days after the report, then closed the submission as informative, meaning no security impact, and published no advisory. Francisco Rosales, offensive security engineer at Manifold, found the issue in the agent's isolated worktree feature, which exists to keep an AI agent away from a developer's working tree."
  https://www.infosecurity-magazine.com/news/cursor-security-bug-command/
• Malicious MCP Servers Can Split Instructions To Make AI Coding Agents Exfiltrate Secrets
  "A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer data without ever sending one obviously harmful instruction. The trick can work even after a blunt version of the same theft is refused: split the request into fragments that each look routine, place them in channels the assistant already uses, and let the agent stitch them together and send the data back. The attack targets coding tools that connect to outside servers over the Model Context Protocol (MCP), the open standard that lets AI assistants call external tools."
  https://thehackernews.com/2026/08/malicious-mcp-servers-can-split.html
  https://github.com/asset-group/ghostsplice

Malware

• Fake Popular Sites Offer a Free App, Instead Take Over PCs
  "A website built to look almost exactly like CNN’s homepage is telling visitors to download “the new CNN app.” But it’s not CNN’s app, and has nothing to do with the news company. The campaign doesn’t stop at CNN. It also uses fake Stremio and Avast installers hosted on similarly convincing lookalike sites, all targeting Windows users. The installers are part of the same campaign to trick people into installing legitimate remote-management software that’s already linked to the attacker’s account."
  https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-popular-sites-offer-a-free-app-instead-take-over-pcs
• DeadLock Ransomware: Breaking Down a Rust-Based Encryptor With Decentralized Recovery Infrastructure
  "Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process. This architecture likely increases the resilience of portions of its communication, leak-hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims. Microsoft has observed DeadLock ransomware being deployed by multiple groups including an affiliate of the Lynx and INC ransomware ecosystems."
  https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/
  https://www.bleepingcomputer.com/news/security/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown/
  https://thehackernews.com/2026/08/deadlock-ransomware-uses-polygon-smart.html
• Delta Probes Wi-Fi Deauth Attack On Flight Carrying DEF CON Attendees
  "Delta Air Lines is investigating an unauthorized Wi-Fi network that appeared aboard a flight from Las Vegas to Atlanta carrying passengers who had attended the DEF CON hacker convention. ​The company told BleepingComputer that the incident occurred yesterday on Flight 591 and did not affect the safety of the passengers or aircraft operating systems. “We will partner with federal law enforcement and aviation regulators to ensure the incident is thoroughly investigated,” a company spokesperson said."
  https://www.bleepingcomputer.com/news/security/delta-probes-wi-fi-deauth-attack-on-flight-carrying-def-con-attendees/
  https://cyberscoop.com/delta-flight-rogue-wifi-investigation-def-con-las-vegas/
• State Sponsored Hackers Use Fake Job Offers To Deliver New Zero Day Exploit
  "It typically begins the same way it has for years, with an approach from a recruiter offering a role at a company the target would recognize, accompanied by a PDF describing the position in convincing detail. That approach remains one of the most effective entry points used by state sponsored threat actors today, and Check Point Research has spent recent months tracking a new wave of it. Operation Dream Job, the long running campaign attributed to the North Korea affiliated Lazarus group, has resurfaced with a previously undisclosed Windows vulnerability (CVE-2026-68820), a newly identified backdoor, and a command and control architecture built almost entirely on infrastructure the group does not own."
  https://blog.checkpoint.com/research/state-sponsored-hackers-use-fake-job-offers-to-deliver-new-zero-day-exploit/
  https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
• Six Npm Packages Use Ethereum Transactions To Retrieve Malicious Payloads
  "On August 10, 2026, Sonatype Research Labs identified six npm packages containing the same malicious payload, including three compromised legitimate packages and three packages published with the malware already present. The payload uses Ethereum blockchain transactions to locate infrastructure hosting additional JavaScript malware. Sonatype researchers confirmed the six packages use the same Ethereum wallet address in recent activity attributed to the DPRK-linked Contagious Interview campaign. OpenSourceMalware dubbed the specific blockchain-based command-and-control technique "NullReceiver," while Contagious Interview refers to the broader campaign associated with the Lazarus APT group."
  https://www.sonatype.com/blog/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads
  https://www.infosecurity-magazine.com/news/npm-packages-ethereum-wallet-c2/
• Fake CCleaner Installs GhostDesk Chrome Spyware
  "A fake version of the popular PC cleaning tool CCleaner is being used to infect Windows users with a malicious Chrome extension called GhostDesk, which acts as spyware inside the browser. With more than 2 billion downloads worldwide, CCleaner is one of the best-known Windows utilities, making it an attractive target for cybercriminals looking to distribute malware. The attack starts with a website that is a convincing imitation of the CCleaner download page. Once installed, the fake application launches an attack that modifies Chrome, installs malicious extension components, and gives attackers the ability to steal credentials, capture screenshots, and log keystrokes."
  https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware
• Kimwolf v7: An Evolution Of The Kimwolf Botnet
  "We identified a new version (v7) of the Kimwolf Android/internet-of-things (IoT) botnet. This version upgrades its distributed denial-of-service (DDoS) attack capabilities and the resilience of its command-and-control (C2) infrastructure. Kimwolf primarily affects Android TV boxes and set-top boxes. Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints. This makes attack traffic more difficult to distinguish from legitimate browsing. The threat’s binary includes five hard-coded public Ethereum-based endpoints for resolving Ethereum Name Service (ENS) domains. ENS is a blockchain-based naming system used to obtain C2 addresses."
  https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/
  https://thehackernews.com/2026/08/kimwolf-v7-android-botnet-makes-http2.html
  https://cyberscoop.com/kimwolf-botnet-palo-alto-unit-42-android-tv-boxes/
• Project CAV3RN Continues: Google Apps Script As C2 Relay And DNS-Based C2 Channel Selection
  "Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first was published in June 2026 as part of our Kaspersky Threat Intelligence Reporting service, and the second was published on Securelist the following month, further documenting the framework’s evolving architecture and C2 capabilities. Continued tracking of this cluster in early August 2026 uncovered several previously undocumented components that expanded the framework’s communication and orchestration capabilities. The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction. The same DNS infrastructure can validate and replace the relay deployment ID, allowing the operator to rotate the Google channel."
  https://securelist.com/project-cav3rn-continues/120991/
• ExfilSquad Targets New Victims, Shares Data Via Torrents
  "ExfilSquad is an emerging cybercriminal hacking group identified in mid-2026 as responsible for high-profile data breaches. Notably, the group does not typically deploy ransomware or destructive malware; instead, they threaten to leak stolen data on a dedicated onion-based Data Leak Site (DLS) unless a ransom is paid. ExfilSquad announced new victims this week and set a firm deadline - August 5, 2026 - to complete all required negotiations. Otherwise, the stolen data will be released. This time, the list of victims includes 13 organizations from the U.S., the UK, and Sweden. Notably, in July, the group was also targeting a major financial institution in Nigeria."
  https://www.resecurity.com/blog/article/exfilsquad-targets-new-victims-shares-data-via-torrents
  https://securityaffairs.com/197025/security/exfilsquad-targets-new-victims-shares-data-via-torrents.html
• AI Sidebar Extension Monetizes Its Own Updates
  "The Chrome extension “AI Sidebar with DeepSeek AI” that Google removed from the Chrome Web Store in January 2026 for stealing AI conversation content resumed shipping code to enterprise endpoints in July 2026. The extension released a benign update removing the data theft code and acknowledged its wrongdoing. After 2 weeks it pulled the rug again with a new update. Netskope Threat Labs analyzed the new build. While it no longer contains the conversation-exfiltration code, it now contains a monetization payload that opens an affiliate link in a foreground browser tab every single time the extension updates and uninstalls. Additionally, it suppresses the redirection of DeepSeek users to ChatGPT."
  https://www.netskope.com/blog/ai-sidebar-extension-monetizes-its-own-updates
  https://www.securityweek.com/extension-banned-for-stealing-ai-chats-returns-to-chrome-store-resumes-malicious-activities/
• Phantom Project: A Cybercrime Toolkit Bundle
  "Phantom Project is a commercial cybercrime toolkit that bundles a stealer, a crypter and a remote access tool (RAT). It follows the standard Malware-as-a-Service (MaaS) model with tiered subscriptions for basic and advanced access. Researchers have observed the toolkit in Russian- and English-language phishing campaigns targeting users in more than 100 countries. Phantom Project activity was first observed in June 2025, though researchers found its distribution site had been registered in February of that year. Phantom Project activity accelerated through the second half of 2025, with multiple independent research teams documenting separate global campaigns within the same several-month window."
  https://blog.barracuda.com/2026/08/10/phantom-project--a-cybercrime-toolkit-bundle-
• Researchers Built a Fake Crypto Startup And Hired Three Suspected North Korean IT Workers
  "Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean operatives. Every virtual machine the company issued was recording. The onboarding paperwork is the part hiring teams can use. The first hire claimed to live in Pasadena, Texas, then sent a California driver's license and a New York bank account. The researchers said the image metadata showed it had been processed with Google Gemini. They also reported a SynthID watermark, the invisible marker Google embeds in images its AI tools create or edit."
  https://thehackernews.com/2026/08/researchers-built-fake-crypto-startup.html
• Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover On Windows 11
  "Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components that researchers chained to SYSTEM access on a fully updated Windows 11 machine. The same PnP path can be triggered over Remote Desktop without physical hardware when supported Plug and Play or low-level USB redirection is enabled; Microsoft says that redirection is not allowed by default. Security researchers Alejandro Hernando and Borja Martinez described the technique in "Plug And Pwn: Weaponizing Windows PnP Auto-Install," research prepared for DEF CON 34."
  https://thehackernews.com/2026/08/researchers-turn-usb-auto-install-into.html
  https://plugandpwn.com/
• The Multi-Layered Defenses That Harden Chrome Against Abusive Notifications
  "Push notifications are a longstanding part of the open web, allowing developers to engage with users in real-time. However, bad actors have increasingly abused this system, bombarding people with deceptive and unwanted notifications. To combat this, Chrome Security has been on a multi-year journey, in collaboration with Firebase Cloud Messaging (FCM) and Safe Browsing, to significantly reduce notification abuse and improve the security and quality of the web ecosystem for everyone. After achieving a significant reduction in unwanted notification volume, reducing notifications on Android by over 7 billion a day in Q1 alone, today we’re pulling back the curtain on the multi-layered toolkit that secured this critical feature for billions of users."
  https://blog.google/security/the-multi-layered-defenses-that-harden-chrome-against-abusive-notifications/
  https://www.bleepingcomputer.com/news/security/google-says-chrome-cuts-7-billion-unwanted-android-notifications-a-day-to-fight-abuse/

Breaches/Hacks/Leaks

• Mozilla Issues New Firefox GPG Key Following Exposure
  "Mozilla announced on Monday that it has issued a new GPG signing subkey used for some Firefox and Thunderbird artifacts after the previous key was accidentally exposed in a GitHub repository. In general, if a GPG private signing key used for software releases is exposed, an attacker who obtains it could create valid signatures on malicious files. This creates a supply chain attack risk: the attacker could distribute modified or malicious versions of the software that appear authentic. Successful exploitation would still require a way to deliver the signed files to users, for instance via a compromised mirror, an alternate download path, or social engineering."
  https://www.securityweek.com/mozilla-issues-new-firefox-gpg-key-following-exposure/
  https://thehackernews.com/2026/08/mozilla-revokes-firefox-and-thunderbird.html
  https://www.bleepingcomputer.com/news/security/mozilla-updates-gpg-key-for-signing-firefox-thunderbird-releases-after-exposure/
• Wesco Confirms Security Incident After ExfilSquad Claims Data Theft
  "Global supply chain and distribution giant Wesco has confirmed in a statement to BleepingComputer that it is investigating a cybersecurity incident. The company's statement comes after data extortion group ExfilSquad claimed to have stolen sensitive information from Wesco and leaked it on their data leak site. Jennifer Sniderman, Vice President of Corporate Communications at Wesco, said that the incident involves the company's cloud CRM environment."
  https://www.bleepingcomputer.com/news/security/wesco-confirms-security-incident-after-exfilsquad-claims-data-theft/
• Ransomware Group Hijacks Hospital System’s Facebook Page Amid Ongoing Cyberattack Fallout
  "Two weeks after a cyberattack knocked out its IT systems, the nonprofit medical system AnMed is still facing closures and the apparent hack of its Facebook page, which on Tuesday began showing ransom demands from the purported hackers. The social media page for the medical chain, which has four hospitals and other clinics in Georgia and South Carolina, was removed from Facebook shortly after a series of messages claiming to be from “The Gentlemen” ransomware group appeared."
  https://therecord.media/ransomware-group-hijacks-hospital-facebook-amid-cyberattack-response
• Local Governments In Four States Dealing With Cyberattacks That Have Shut Down Services
  "The 911 system of a city in California was taken down by hackers during a cyberattack on Friday — one of several cyber incidents nationwide impacting government services. Suisun City, a town of 30,000 people in the Bay Area about 30 miles from Napa Valley, said on Friday that malicious software infected and compromised the city’s IT systems. The attack “hit critical public safety operations, including 911 routing, police and fire dispatch, records and City services,” according to a government notice. The city shut down the entire IT network and contacted federal and state officials for assistance. Emergency services are still available and public safety offices are routing calls through the county’s dispatch center."
  https://therecord.media/cyberattacks-ransomware-local-governments
  https://www.infosecurity-magazine.com/news/suisan-cyber-incident-government/

General News

• July 2026 Dark Web Breach Incident Trend Report
  "The July 2026 Dark Web Breach Incident Trend Report was compiled based on data breach cases posted on deep web and dark web forums. Due to the nature of some posts, it is difficult to fully verify their accuracy; some posts related to South Korea included AI-generated false data or cases where it could not be definitively determined whether an actual breach had occurred."
  https://asec.ahnlab.com/en/94912/
• July 2026 Dark Web Threat Actor Trend Report
  "The July 2026 Dark Web Threat Actor Trend Report focuses on trends among threat actors—including hacktivists—active on the deep web and dark web. It is explicitly noted that the factual accuracy of some content could not be verified."
  https://asec.ahnlab.com/en/94917/
• July 2026 Dark Web Issue Trend Report
  "The July 2026 Dark Web Issue Trend Report summarizes major issues that occurred on the deep web and dark web. Due to the nature of some sources, it may be difficult to fully verify the accuracy of certain information; therefore, it is necessary to cross-check these details against official announcements."
  https://asec.ahnlab.com/en/94918/
• Who Will Be The Stanislav Petrov In Your Organization?
  "The recent news coverage of “rogue AI” systems hacking innocent companies reminded me of one of the world’s most unsung heroes and genuinely someone who may well have saved the world. In 1983, the USSR’s early warning systems reported that the United States had launched nuclear missiles towards the Soviet Union. The officer on duty, Stanislav Petrov, did something computers still struggle to do. He applied context, experience, and human judgement to determine the warning was probably false. Thankfully, he was right. Had an automated response been allowed to proceed without meaningful human intervention, the result could have been a full blown nuclear war."
  https://www.helpnetsecurity.com/2026/08/11/governing-autonomous-ai-risks/
• Cyber Security In Manufacturing
  "Cyber attacks are no longer just an IT issue for manufacturers. They are disrupting production lines, increasing costs and putting customer deliveries at risk. Make UK’s latest report, Cyber Security in Manufacturing, reveals the scale of cyber risk facing UK manufacturers and sets out the practical steps businesses can take to strengthen resilience."
  https://www.makeuk.org/insights/reports/cyber-security-manufacturing
  https://www.infosecurity-magazine.com/news/half-uk-manufacturers-cyber/
• Cloudflare DDoS Threat Report H1 2026: 1 Tbps Attacks Soar As DNS Floods And Geopolitical Tensions Drive a New Wave
  "Welcome to the 25th edition of Cloudflare's DDoS Threat Report. This is the first half-year edition in the series: rather than publishing separate reports for the first and second quarters of 2026, we have combined our coverage of Q1 and Q2 into a single volume covering January through June 2026. The analysis is produced by Cloudforce One, Cloudflare’s Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network."
  https://blog.cloudflare.com/ddos-threat-report-2026-h1/
  https://www.bleepingcomputer.com/news/security/ddos-attacks-over-1-tbps-surged-fivefold-in-the-second-quarter/
• The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It
  "AI governance, once the purview of the legal department, is now knocking on the CEO’s door. But many C-Suite executives are still treating it as something to delay addressing until after AI regulations are set in stone. This can be a shortsighted strategy. Consider that 46% of organizations say AI governance and compliance issues are the reason why their AI underperforms, according to the GrantThornton, 2026 AI Impact Survey Report (PDF). These figures lend credence to why leadership should not wait for AI regulations to settle but should apply governance proactively."
  https://www.securityweek.com/the-ai-governance-gap-is-a-leadership-problem-waiting-wont-close-it/
  https://www.grantthornton.com/content/dam/grantthornton/website/assets/content-page-files/advisory/ai-lp/infographic/ai-impact-survey-2026/pdf/grant-thornton-2026-ai-impact-survey.pdf
• Hacker Conversations: Marcus Hutchins And The Journey From The Gray Zone To Redemption
  "Marcus Hutchins doesn’t personally consider himself a hacker – but he accepts the epithet because it’s a widely used term for what he once did. Born in Ascot, England, he was working as a cyber threat analyst for an LA-based cybersecurity company in 2017 (aged 22), when he became the world’s hero for finding a kill switch for the particularly virulent and destructive cryptoworm (ransomware spread by a worm) known as WannaCry. The ransomware decryption didn’t work, so there was no way to decrypt files once encrypted (it was effectively a wiper). But the worm worked very well, and more than 200,000 computers were affected in around 150 countries in just a few days."
  https://www.securityweek.com/hacker-conversations-marcus-hutchins/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

เมื่อวันที่ 11 สิงหาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 1 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) Heap Inspection Vulnerability
• CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
• CVE-2026-72898 Metabase SQL Injection Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 3 รายการ เมื่อวันที่ 11 สิงหาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSMA-26-223-01 Mira Hormone Monitor, Mira Android App
• ICSMA-26-223-02 Pulsetto Vagus Nerve Stimulator
• ICSA-26-204-01 Johnson Controls C-CURE 9000 and Victor application server (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand