โพสต์ถูกสร้างโดย NCSA_THAICERT

เมื่อวันที่ 5 สิงหาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 1 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/08/05/cisa-adds-one-known-exploited-vulnerability-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Water Sector Cyberattacks Reportedly Hit At Least 12 States
  "The number of US states affected by the recent hacking campaign targeting water and wastewater facilities continues to grow. At least 12 states have been hit, according to ABC News, but the names of only a handful of the affected states are currently known."
  https://www.securityweek.com/water-sector-cyberattacks-reportedly-hit-at-least-12-states/
  https://therecord.media/iran-cyberattacks-water-treatment

Telecom Sector

• Chinese Telcos Maintain Deep US Presence Despite Salt Typhoon Links, House Committee Says
  "Three Chinese telecommunications giants continue to have footholds in the U.S. internet ecosystem despite their alleged role in previous Chinese hacking campaigns, lawmakers said Tuesday. Congress’s bipartisan Select Committee on China published a 49-page investigation into China Mobile, China Unicom, and China Telecom — three companies that had their telecommunications licenses denied or revoked by regulators between 2019 and 2022 due to cybersecurity concerns."
  https://therecord.media/chinese-hackers-telecoms-house
  https://files.constantcontact.com/f0eecb46901/f655c442-2d93-45ea-8cab-9d58a3a04052.pdf

Vulnerabilities

• Veeam, Terraform MCP, Django Patch Critical Flaws, Led By CVSS 10.0 Cross-Tenant Bug
  "HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django."
  https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html
• Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files Via Org-Mode Markup
  "An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1. The file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its formal advisory on August 2. Gitea 1.27.1 also patches CVE-2026-60004, a separate remote code execution bug covered in a prior THN report."
  https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/08/05/cisa-adds-one-known-exploited-vulnerability-catalog
• AI Browsers Vulnerable To 'PleaseFix' Zero-Click Agent Hijacking
  "Browsers such as Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge are vulnerable to a new class of zero-click exploits that can allow attackers to hijack their artificial intelligence agents and turn them against users. The problem stems from how the AI agents pull information from multiple sources, such as emails and webpages, while working on a task without reliably distinguishing between trusted and untrusted content. An adversary who can slip malicious instructions into that content can weaponize the agent and use its access to act on the user's behalf, potentially reaching sensitive data, accounts, and other connected services."
  https://www.darkreading.com/cyber-risk/ai-browsers-zero-click-agent-hijacking
• No Perfect Fix For AI Browser Prompt Injection Flaws
  "While AI-powered web browsers are getting more guardrails against prompt injections, it seems unlikely that the prevalent threat is going anywhere anytime soon. At Black Hat USA 2026, Brave Software security engineer Artem Chaikin hosted a session titled "Attacking and Defending AI Browsers." The session aimed to illuminate the security reality behind modern web browsers, which increasingly integrate AI assistants that can navigate and interact with web applications on users' behalf."
  https://www.darkreading.com/application-security/no-perfect-fix-ai-browser-prompt-injection-flaws
  Breaking The Paperclip: When Agent Configuration Becomes a Vulnerability
• "Oasis Security researchers discovered three critical vulnerabilities spanning Paperclip's authenticated and local-development modes. Together, they illustrate a pattern that extends beyond this open-source project to any system where configuration and executable code are the same thing. An unauthenticated attacker browses to a Paperclip deployment, creates an account, and within moments, executes arbitrary commands on the server. A developer imports a malicious agent configuration bundle into their local Paperclip instance, and the specified command executes as the Paperclip process. Neither requires a phishing email, stolen credential, or user interaction, just three distinct authorization failures in how Paperclip treats agent configuration."
  https://www.oasis.security/blog/paperclip-agent-vulnerabilities
  https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html
  https://www.infosecurity-magazine.com/news/paperclip-ai-vulnerabilities-rce/
• OVSwrap: Another Linux Local Root Vulnerability
  "In CIFSwitch, we gave models the tools to build and navigate semantic graphs – and got a nice multihop logical vulnerability chain in return. I like deterministic logic bugs: they are elegant and reliable. Memory bugs, OTOH, almost always involve grooming, indeterminism, and the chance to crash the host if you don’t place things right. It also doesn’t help that (open) LLMs, in my experience, are just not that good at reasoning about memory issues (finding an overflow is one thing, but thinking ‘geometrically’ to groom the memory for an exploit is another). My taste preferences aside, I figured – why not try and solve LLMs’ blindspots’ with tools once again? I settled on something extremely basic: forcing the hunter agents to keep a persistent state of the relevant geometric structures via ASCII diagrams, at each state of iteration."
  https://heyitsas.im/posts/ovswrap/
  https://thehackernews.com/2026/08/new-ovswrap-linux-kernel-flaw-lets.html
  https://securityaffairs.com/196657/hacking/ovswrap-13-year-old-linux-kernel-flaw-lets-local-users-become-root.html
• How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones
  "Two security researchers found a way to exploit vulnerabilities in Samsung software, including the virtual assistant Bixby, to hack mobile devices. The research was conducted by Dimitrios Valsamaras, senior security researcher at Microsoft, and Ken Gannon, head of mobile research at Mobile Hacking Lab. Gannon and Valsamaras demonstrated the vulnerabilities at the Pwn2Own Ireland hacking competition in October 2025, where they earned $50,000 after exploiting them to hack a Samsung Galaxy S25 device."
  https://www.securityweek.com/how-a-50000-exploit-chain-turned-bixby-against-samsung-phones/
• Pre-Auth RCE In Enterprise Java Hits Bonita And OFBiz Servers
  "An attacker sends a single web request to a Bonita server and lands inside an internal API that assumed nobody could reach it. The request arrives unauthenticated. From there the attacker runs code on the host. Bonita BPM handles loan approvals, insurance claims, and employee onboarding for banks, insurers, and government agencies, and its internal surface answers to strangers."
  https://www.helpnetsecurity.com/2026/08/05/pre-auth-rce-java-bonita-ofbiz-cve-2026-31986/

Malware

• Toolkit Installation Via SQL Injection Shows The Classics Still Hit
  "Huntress recently observed an incident that started with a "simple" SQL injection bug in an organization's vulnerable public-facing web app, and ended with OS-level remote code execution. Notably, after gaining initial access the threat actor dropped a post-exploitation toolkit (khunt) via a Java Source within an Oracle database, which is a novel aspect of this attack. A Java Source (a code-object that's stored directly in Oracle's database engine) allows developers to store and run Java code in the database as schema objects, but the threat actor abused this as a way to upload the toolkit directly into the database."
  https://www.huntress.com/blog/khunt-malware-sql-injection-oracle
  https://www.bleepingcomputer.com/news/security/hackers-run-khunt-post-exploitation-toolkit-from-oracle-database/
• Open-Source Software’s Archenemy TeamPCP Goes Back Further Than Anyone Thought
  "TeamPCP, the threat actor behind an unrelenting flurry of attacks on open-source software this year, has been active much longer than previously thought, according to research Oligo Security shared exclusively with CyberScoop. The threat actor, which gained notoriety and has captivated threat hunters as it compromised and injected malicious code into more than 1,000 software packages in less than four months earlier this year, was also responsible for attacks dating back to 2020, Oligo Security found."
  https://cyberscoop.com/teampcp-long-active-history-2020-oligo-security/
• From Stolen Credentials To Full Breach: The 72-Hour Timeline
  "A single compromised credential is often all it takes to turn an ordinary workday into a full-scale cybersecurity incident. Despite investments in firewalls, endpoint security, and identity controls, attackers continue to exploit one of the simplest yet most effective entry points—stolen usernames and passwords. Whether exposed through phishing campaigns, malware infections, credential-stealing infostealers, or data breaches, compromised credentials are readily traded across underground forums and dark web marketplaces. Once obtained, threat actors waste little time putting them to use. What begins as an unauthorized login can quickly escalate into privilege abuse, lateral movement, data exfiltration, and ransomware deployment—all within a matter of hours."
  https://cyble.com/blog/72-hour-timeline-credential-based-cyberattack/
• One Adversary: The Moment Nobody Sees
  "Try a short exercise with your last serious fraud case. Draw the attack as the attacker ran it, stage by stage, and next to each stage write which of your teams could have seen it. Not which team caught it — which team’s telemetry contained it at all. For a typical phishing-to-fraud campaign, the answers come easily at first. The attacker registers a look-alike domain, sets up hosting and a certificate: your cyber team can see this — domain monitoring, certificate transparency, brand protection. Mass SMS and email lures go out to customers: cyber again, at least partially, through abuse reports and detection feeds. Skip ahead: the attacker logs in with stolen credentials and works around 2FA — your fraud team can see this, a new device, an unusual session. Funds move: fraud sees the damage."
  https://www.group-ib.com/blog/moment-nobody-sees/
• Kali365 Exploits Microsoft Device Login To Access US Corporate Data
  "Kali365, a Phishing-as-a-Service (PaaS) platform, is targeting US companies with device code phishing that abuses Microsoft’s legitimate authentication process. The attack comes just a few months after the FBI warned that Kali365 was targeting Microsoft 365 accounts. By obtaining OAuth (Open Authorization) access and refresh tokens, attackers may gain continued access to corporate email, documents, and cloud services without directly stealing a password. For businesses, a single successful authorization can lead to data exposure, financial fraud, operational disruption, and higher incident response costs."
  https://hackread.com/kali365-exploit-microsoft-device-login-access-us-data/
  https://thehackernews.com/2026/08/kali365-weaponizes-microsoft.html
• Fake Bank Of America "Action Needed" Phishing Email Deposits ScreenConnect Instead
  "We recently came across a fake Bank of America message that closely imitates the targeted bank's visual style, layout, and branding – from the initial phishing email, to the eventual webpage that victims are redirected to. The subsequent phishing page delivers an AccountGuard.zip with a .vbs file that contains a large chunk of base64-encoded data. The next phase of the attack then involves a complex chain of decoding scripts, and ends in the execution of arbitrary commands (with escalated privileges) in PowerShell."
  https://www.huntress.com/blog/bank-spam-rmm
  https://www.infosecurity-magazine.com/news/fake-bank-of-america-phishing-scam/
  https://www.helpnetsecurity.com/2026/08/05/fake-bank-of-america-email-account-guard/
• From Open Lures To Cloaked Gates: How a MacOS ClickFix Campaign Learned To Hide
  "Microsoft Threat Intelligence observed a macOS ClickFix campaign distributing infostealers, including MacSync and Atomic Stealer (AMOS), through a large cluster of look-alike domains. The campaign evolved from broadly serving ClickFix lures to using a server-side browser-fingerprinting gate that shows the lure primarily to visitors whose environment appears consistent with a genuine macOS browser. This cloaking limits visibility for crawlers, sandboxes, and some automated analysis workflows. The blog details the domain pattern, fingerprinting checks, infection chain, detection coverage, and hunting pivots that defenders can use to identify related activity."
  https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/
  https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser.html
• NullReceiver's Blank Crypto Transfers Solves The Challenges Of EtherHiding
  "We just identified a new blockchain-based command-and-control technique hiding inside two trojanized npm packages, bianira-ui and fluid-type-ui. Both are DPRK-linked clones of legitimate Tailwind CSS plugins, and both use the same trick to find their command server: they read it out of the destination address of a completely blank cryptocurrency transfer. We’re calling it NullReceiver, and we think it’s a deliberate improvement on EtherHiding."
  https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique
  https://thehackernews.com/2026/08/trojanized-npm-packages-decode-c2-ip.html
• COLDCARD Security Audit Phishing Attack Installs Remote Access Tool
  "A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick users into installing ScreenConnect remote access software. Proofpoint, which discovered the campaign, says it uses emails impersonating COLDCARD that claim a security audit is underway across its hardware cold storage wallet devices. The phishing campaign comes after attackers recently stole approximately 1,367 Bitcoin, worth an estimated $88.6 million, from 4,585 addresses using what is believed to be a random number generation flaw affecting multiple COLDCARD models and firmware versions."
  https://www.bleepingcomputer.com/news/security/coldcard-security-audit-phishing-attack-installs-remote-access-tool/
• AI Has Enhanced Iran’s Asymmetric Playbook During The 2026 Conflict
  "Between January and June 2026, Tehran survived unprecedented military, economic, and political pressure by relying on its longstanding hybrid warfare model: blending asymmetric military operations, cyber operations, information warfare, proxy attacks, and coercive state control. Artificial intelligence (AI) enhanced these capabilities, acting as a force multiplier and almost certainly increasing the speed, scale, and effectiveness of Iranian operations. Ultimately, Iran demonstrated that its strategic resilience does not depend on possessing the most advanced AI capabilities; rather, the source of Iranian power remains the asymmetric playbook itself."
  https://www.recordedfuture.com/research/iran-ai-asymmetric-playbook
  https://assets.recordedfuture.com/insikt-report-pdfs/2026/ta-ir-2026-0716.pdf

Breaches/Hacks/Leaks

• Leaked n8n API Tokens Exposed Live Instances To Credential Theft
  "GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to access sensitive data and downstream credentials without exploiting a software vulnerability. We scanned public GitHub commits for exposed n8n API tokens and identified 4,576 unique credentials associated with 1,255 hostnames. Of the 896 instances reachable at the time of testing, 321 accepted at least one leaked token. That means leaked credentials provided authenticated access to 36% of the reachable instances we tested, or roughly 26% of all hostnames identified in the commits."
  https://thehackernews.com/2026/08/leaked-n8n-api-tokens-exposed-live.html
• 311,000 Impacted By Brown Health Medical Group-MA Data Breach
  "Lifespan Physician Group of Massachusetts, doing business as Brown Health Medical Group-MA, is notifying over 311,000 individuals that their personal, medical, and financial information was stolen in a data breach. The incident occurred in December 2025 at its Hawthorn location. It involved a historic file server, the healthcare organization says in a sample notification letter filed with the Massachusetts Office of Consumer Affairs and Business Regulation."
  https://www.securityweek.com/311000-impacted-by-brown-health-medical-group-ma-data-breach/
  https://securityaffairs.com/196681/uncategorized/brown-health-medical-group-ma-data-breach-exposes-information-of-311000-individuals.html
• Dutch Retailer De Bijenkorf Warns Customer Data May Be Exposed After Cyber Incident
  "A cyberattack on one of the logistics providers serving Dutch luxury department store chain De Bijenkorf has delayed customer orders, returns, and refunds while potentially exposing customer data. The incident is one of several in recent months that has disrupted retail and food companies through third-party contractors. The Amsterdam-based retailer said Wednesday that the incident affected only the systems of an external logistics partner and that there is currently no indication its own infrastructure was compromised."
  https://therecord.media/de-bijenkorf-luxury-retailer-third-party-cyber-incident
• Brazilian Government Health Surveillance Platform Exposed 79GB Of Sensitive Data Online
  "Cybersecurity Researcher Jeremiah Fowler uncovered a data leak involving what appears to be a Brazilian government application and licensing portal containing personally identifiable information (PII) and shared his findings with ExpressVPN. We are publishing his report to help keep the public informed and protected as part of our ongoing effort to make the web a safer place."
  https://www.expressvpn.com/blog/brazil-sisvisa-data-exposed/
  https://hackread.com/brazil-health-surveillance-database-exposed-records/
• Beacon CRM, Widely Used By Charities, Suffers Data Breach
  "Cloud-based customer relationship management software provider Beacon CRM said it's suffered a security breach that likely led to the theft of customer data. London-based Beacon said it first learned on July 29 that its systems may have been breached. Beacon says its CRM system is used by over 1,000 charities and non-profit organizations, ranging from Special Olympics Ireland and Great Lakes Outreach to Heart Research UK, to handle everything from collecting online donations, to managing memberships and selling tickets to events."
  https://www.bankinfosecurity.com/beacon-crm-widely-used-by-charities-suffers-data-breach-a-32420

General News

• Ransom Cartel Ransomware Creator Sentenced To 16 Years In Prison
  "Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for his role in ransomware attacks against at least 18 companies worldwide. The U.S. Department of Justice announced today that the 40-year-old Belarusian national was sentenced for conspiracy to commit offenses against the United States, conspiracy to commit wire fraud, and aggravated identity theft. The DOJ says Silnikau had been active on Russian-speaking cybercrime forums since at least 2005 and used the aliases "J.P. Morgan," "xxx," and "lansky.""
  https://www.bleepingcomputer.com/news/security/ransom-cartel-ransomware-creator-sentenced-to-16-years-in-prison/
• Canadian Pleads Guilty To Snowflake Cloud Data-Theft Attacks
  "A Canadian man pleaded guilty today to his role in accessing company accounts at cloud storage provider Snowflake and stealing data from at least 165 organizations in a scheme to extort millions of dollars from victims. ​26-year-old Connor Riley Moucka, also known as Alexander Moucka and Waifu, was arrested on October 30, 2024, for stealing data of hundreds of millions of individuals from companies using Snowflake’s storage service."
  https://www.bleepingcomputer.com/news/security/canadian-pleads-guilty-to-snowflake-cloud-data-theft-attacks/
  https://therecord.media/guilty-plea-snowflake-hack-connor-riley-moucka
  https://cyberscoop.com/connor-moucka-guilty-snowflake-attack-spree/
• Google Blogger Locks Hundreds Of Blogs In Malware False Positive
  "Google has locked hundreds of Blogger websites after a false positive claimed they violated its "Malware and Similar Malicious Content" policy, with some sites actually deleted from the platform. The issue began on August 4, and it appears to affect many legitimate blogs that do not host malware or have malicious scripts. As seen by BleepingComputer, hundreds of web admins have reached out to Google on the company's official forum for help in restoring access to their blogs."
  https://www.bleepingcomputer.com/news/google/google-blogger-locks-hundreds-of-blogs-in-malware-false-positive/
• AI Sends Global Crime Syndicates Into Fraud Nirvana
  "In bad news for financial institutions, online retailers, cryptocurrency exchanges, and people in the dating pool who rely on identity verification to make sure they're not getting taken for a ride, global fraud gangs are aggressively industrializing their scam efforts. That's according to Eric Huber, senior manager for adversary intelligence and disruption at TD Bank, who said that major centers for organized crime specializing in financial fraud (notably in Southeast Asia and West Africa) are bypassing "know your customer (KYC)" rules and other identity-verification methods with an updated AI tool set that offers the ability to build completely believable synthetic identities capable of fooling even advanced AI-enabled behavioral defenses."
  https://www.darkreading.com/threat-intelligence/ai-global-crime-syndicates-fraud-nirvana
• CSS: The Hidden Threat Lurking In Your Inbox
  "Using email platforms to target users is nothing new in the world of threat actors. Nor is it revolutionary for defenders who've shored up guardrails when it comes to suspicious attachments, malicious JavaScript, and more. But as these well-known threats take command of everyone's attention, another vector remains hidden in plain sight. While HTML is the structure that powers web pages, Cascading Style Sheets (CSS) address design and presentation of the page. From the text to colors and tags to images, CSS manages how a page is displayed. And according to Gareth Heyes, Web security researcher at PortSwigger, it can be weaponized because of its multiple capabilities."
  https://www.darkreading.com/cyberattacks-data-breaches/css-hidden-threat-lurking-inbox
• Cybersecurity Skills Gap: More Than Just a Workforce Challenge
  "The cybersecurity skills gap is no longer just about filling open positions. Now, the challenge is how organizations can defend against an increasingly sophisticated, AI-powered threat landscape. The recently released Fortinet 2026 Cybersecurity Skills Gap Report reveals data that underscores how critical this challenge has become: 71% of organizations surveyed say the cybersecurity skills gap creates additional risk for their organization, and 86% experienced at least one breach in the past year. Regarding the breaches, more than half (56%) of the organizations attributed them in part to a lack of cybersecurity skills and trained IT security staff."
  https://www.fortinet.com/blog/industry-trends/cybersecurity-skills-gap-more-than-just-a-workforce-challenge
  https://www.fortinet.com/content/dam/fortinet/assets/reports/2026-cybersecurity-skills-gap-report.pdf
• New Research: The Confidence Gap Between CISOs And Their Boards Is Real, And It’s Measurable
  "Boards of directors believe they understand their company’s security posture and what it means for the business. The security leaders presenting to them are far less sure. Only 12.5% of security leaders are very confident their board walks away understanding the true state of the program, and 55% of boards have never formally defined what cyber risk the company is willing to accept. Pulse Security AI unveiled these findings today in The CISO-Board Communication Gap, a research report drawing on more than 80 senior practitioners, examining how security leaders report to their boards and what gets lost between the two."
  https://hackread.com/new-research-the-confidence-gap-between-cisos-and-their-boards-is-real-and-its-measurable/
  https://pulsesecurity.ai/newsroom/ciso-board-communication-gap/
• Your Enterprise AI Footprint Is About Three Times Bigger Than Your Model List
  "Organizations are building AI systems that combine models, agents and external tools instead of relying on standalone AI, according to Snyk’s latest State of Agentic AI Adoption report. The study analyzed 3,044 enterprise environments and 1.39 million code repositories to examine how enterprises are deploying AI. Of organizations using AI, 46.9% have adopted agentic architectures built on AI agents, model context protocol (MCP) servers, or both. More than half have deployed the full stack, combining AI agents with MCP infrastructure that enables access to enterprise data, applications, services and external tools."
  https://www.helpnetsecurity.com/2026/08/05/snyk-growing-agentic-ai-adoption-report/
• Prompt Injection Remains Biggest LLM Risk, Despite Limited Incidents
  "Prompt injection attacks continue to present the most dangerous threat from large language models (LLMs), despite the relatively low number of recorded incidents relating to this vector, according to an updated analysis from the Open Worldwide Application Security Project (OWASP). The non-profit foundation published the third version of its community-driven Top 10 for LLM Applications list, on August 4, 2026. For the third year in a row, practitioners listed prompt injection as the number one security challenge emanating from the use of GenAI tools."
  https://www.infosecurity-magazine.com/news/prompt-injection-llm-risk/
  https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
• Cyberspace Is Now The Fourth Domain Of Military Conflict.
  "Geopolitics can be summarized as the behavior of a country or region influenced by its location in time (history and current events), and space (geographical proximity to other countries or regions). Those geopolitical actions are also influenced by the state of the economy and the psychology of its leaders. Geopolitical disagreements between countries are usually settled by diplomacy but sometimes by physical force of arms. The latter is usually a kinetic war involving, as necessary and available, land (an Army), air (an Air Force) and the sea (a Navy)."
  https://www.securityweek.com/the-fourth-battlefield-the-growing-role-of-cyber-operations-in-global-conflict/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 2 รายการ เมื่อวันที่ 4 สิงหาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-216-01 Acrisure Karr Anti-theft
• ICSMA-26-216-01 Thermo Fisher Applied Biosystems 3100 and 3500 Series Genetic Analyzers

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง

https://www.cisa.gov/news-events/ics-advisories

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 4 สิงหาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 3 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-9198 IBM Langflow Code Injection Vulnerability
• CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Healthcare Sector

• Thermo Fisher Applied Biosystems Genetic Analyzers
  "Successful exploitation of this vulnerability could allow an attacker to modify .fsa/.hid output files, tampering with DNA data and resulting in inaccurate test results."
  https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-216-01

Industrial Sector

• Acrisure KARR BT And DR-100
  "Successful exploitation of this vulnerability could allow an attacker to perform unauthorized vehicle control operations."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-216-01

New Tooling

• OWASP’s Subtractive Security Project Measures The Attack Paths You Erased
  "An attacker who talks a user into opening an attachment gets whatever that machine still permits: a service account with rights across the domain, an outbound route to anywhere, a scripting engine sitting there for the taking. Christopher Frenz wants those capabilities deleted before anyone writes a detection rule for them. Frenz leads the OWASP Subtractive Security Top 10, a set of nine lists published alongside an engineering standard called Path Erasure Rate. Organizations that answered the last decade by stacking EDR, SIEM, and NDR now pay for alerts on paths they could have removed. The lists name which paths to remove, by platform."
  https://www.helpnetsecurity.com/2026/08/04/owasp-subtractive-security/
  https://github.com/OWASP/OWASP-Subtractive-Hardening-Top-10

Vulnerabilities

• New cPanel Critical Flaw Could Let Hosting Customers Run SQL As Database Root
  "cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries. The database bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and affects all supported versions of cPanel & WHM, along with WP Squared. Reaching it requires a valid cPanel account and access to the MySQL/MariaDB feature. From there, the vendor says the account holder could execute arbitrary database commands with full administrative privileges."
  https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html
  https://securityaffairs.com/196595/security/cve-2026-58048-cpanel-bug-enables-full-database-administrator-access.html
• CISA Adds Three Known Exploited Vulnerabilities To Catalog
  "CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-9198 IBM Langflow Code Injection Vulnerability
  CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
  CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog
• New TP-Link Router Vulnerabilities: Exploiting Zero Touch Provisioning
  "For more than three years, Forescout Research – Vedere Labs has reported on the increasing exploitation of network infrastructure devices, such as routers and firewalls. Previous research, including Sierra:21 and Dray:Break, and observed threat actor activity by the larger research community targeting these devices, focused on individual vulnerabilities that enable remote code execution. However, the growing use of Zero-Touch Provisioning (ZTP) by IT teams creates opportunities for attacks at a much larger scale. Network vendors offer ZTP ecosystems in which provisioning servers push configurations and updates to client devices, including routers, switches, gateways, and wireless access points. This enables devices to be configured with little or no manual intervention."
  https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-exploiting-zero-touch-provisioning/
  https://support.omadanetworks.com/us/document/130627/
  https://www.bleepingcomputer.com/news/security/tp-link-patches-omada-ztp-flaws-allowing-hackers-to-breach-networks/
  https://www.securityweek.com/tp-link-omada-ztp-vulnerabilities-chain-into-full-network-takeover/
• Tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
  "tl;dv (Too Long; Didn't View) is an AI meeting recording platform. It drops a bot into your Google Meet, Zoom, or Teams call, records everything, transcribes it, and generates summaries with AI. Over 2 million users. Backed by investors. Endorsed by half of LinkedIn's sales influencer community. They store your sales calls, job interviews, performance reviews, internal strategy sessions. The kind of content where someone says "this call is being recorded" and everyone nervously laughs and then shares trade secrets for 45 minutes."
  https://bobdahacker.com/blog/tldv-hack
  https://www.darkreading.com/application-security/ai-notetaker-spy-government-corporate-video-calls
• I'll Just Call You: Agent-To-Agent Privilege Boundary Failures In CI/CD On Google's ADK Repository
  "Pillar Security researchers have identified the first practical, real-world case of agent-to-agent exploitation in a multi-agent system in a real production environment, a class of attack not seen in real production systems until now. A case where one AI agent can be used to attack another, turning a benign automation into a path that ends in a potential software supply chain compromise. We found the exploit in google/adk-python, the repository behind Google's Agent Development Kit for Python, an SDK many teams use to build their own agents."
  https://www.pillar.security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository
  https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html
  https://www.securityweek.com/gemini-agent-to-agent-attack-exposed-secrets-enabled-pull-request-tampering/
  https://www.theregister.com/security/2026/08/03/google-dev-kit-spurs-first-ever-agent-on-agent-violence/5282496

Malware

• Inside Greatness: Telegram-Distributed M365 AiTM PhaaS
  "ZeroBEC threat research on the Greatness phishing-as-a-service (PhaaS) platform, a commercially distributed kit sold via Telegram that combines adversary-in-the-middle (AiTM) credential and token theft with device code phishing in a single operator product. This investigation began with a live campaign that exploited spoofed RingCentral emails and customer-side safe sender exclusions to bypass email gateway controls and deliver phishing lures targeting Microsoft 365 accounts. Panel access, infrastructure testing, and cross-domain analysis revealed the full operator ecosystem, shared backend, and post-compromise tradecraft."
  https://zerobec.com/blog/greatness-phaas-aitm-and-device-code-phishing
  https://www.bleepingcomputer.com/news/security/phishing-service-spoofs-ringcentral-to-steal-microsoft-365-accounts/
  https://thehackernews.com/2026/08/greatness-phaas-adds-device-code.html
• 77 "evil Twin" Open VSX Extensions: 19 Copy Private Repo And CI Data To a New Domain
  "Between July 26 and August 1, 2026, our monitoring systems identified 77 Open VSX extensions that beacon to the same newly registered domain. Each one republishes the name, namespace and description of a real, unrelated extension at a low version number, almost always 0.0.1, under an account that does not own the namespace and does not belong to the original author [example 1, example 2, example 3]. The bundled extension.js is swapped for a beacon. In most of the packages it sends little more than the machine's hostname. In nineteen of them it sends a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside. The Open VSX listings described this under a section headed “Telemetry.”"
  https://www.manifold.security/blog/open-vsx-evil-twin-extensions
  https://www.bleepingcomputer.com/news/security/77-open-vsx-extensions-found-harvesting-developer-info/
• Keyv And Friends Compromised In Active Shai-Hulud Supply Chain Attack
  "On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv, a key-value storage library with roughly 127 million weekly npm downloads, and used that access to inject a credential-stealing worm across the entire package family. The same maintainer owns cacheable (29M downloads/month), flat-cache (565M downloads/month), file-entry-cache (557M downloads/month), and several other widely-used caching utilities, all of which were swept up in the same attack. The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions."
  https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
  https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
  https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/
  https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html
  https://www.bankinfosecurity.com/worm-targets-more-than-2000-npm-package-versions-a-32412
  https://cyberscoop.com/supply-chain-attack-malware-mini-shai-hulud-teampcp/
  https://hackread.com/shai-hulud-npm-worm-poisoning-1280-packages/
• “Keep Going, Bro. You’ve Got This!” A Data-Driven Look At How Adversaries Are Weaponizing AI
  "Artificial intelligence (AI) and associated language models are now ubiquitous and heavily used in both personal and professional contexts to streamline tasks and expand capabilities. With AI being used everywhere and by almost everyone, one of the biggest questions is how malicious actors are taking advantage. Fortunately, actors make mistakes and chatbots leave artifacts. Leveraging cloud-based AI models leaves behind a variety of artifacts, most notably a prompt log. These logs can take on a variety of shapes and sizes, but they are left on endpoints that are running various applications, such as Claude Code, CodeX, Cursor, or Gemini."
  https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/
  https://www.infosecurity-magazine.com/news/talos-attackers-split-tasks-evade/
  https://www.theregister.com/security/2026/08/04/bypassing-ai-guardrails-is-so-easy-a-script-kiddie-can-do-it/5282973
• Incident Report: Unsanctioned Agent Behaviour During Cyber Testing
  "AISI’s role is to evaluate and understand the capabilities of frontier AI models, surfacing potential risks before they reach the public. To assess what these models can do, including whether they could be misused for cyberattacks, we test them under deliberately permissive conditions: with access to the open internet, and with some safety filters disabled. On 28th July 2026, AISI's Security Team detected unusual data transfers leaving our research systems during a routine cyber evaluation. On investigation, we found that some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organisations. We declared a security incident and, within roughly one hour of discovery, had contained it and begun a full investigation."
  https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
  https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security Incident INC-2026-07-28-01.pdf
  https://cyberscoop.com/aisi-openai-report-unsanctioned-ai-model-hacks/
• Analyzing SMOKE#SCREEN: ScreenConnect RMM Abuse, Cloudflare Tunnels, And Trusted Software Lures
  "Securonix Threat Research has been tracking an active, multi-wave campaign we are calling SMOKE#SCREEN, in which threat actors use a rotating collection of social engineering lures themed around Zoom software updates, business document reviews, and system maintenance utilities to deliver silent ScreenConnect Remote Monitoring and Management (RMM) agent installations. The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and a HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0.143:8080. Victims who execute any of the initial access files end up with a fully functional ScreenConnect agent silently installed and beaconing to one of three attacker-controlled relay servers, providing the threat actor with persistent, legitimate-looking remote access to compromised hosts."
  https://www.securonix.com/blog/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels/
  https://www.darkreading.com/cyberattacks-data-breaches/latest-rmm-fueled-phishing-attack-exposes-threat-actor-playbook
  https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html
• QuickFox Supply Chain Attack Used To Deploy FDMTP Implant
  "FortiGuard Labs is tracking a campaign associated with a long-standing supply chain attack on the QuickFox application. QuickFox is a VPN proxy and game accelerator typically employed by Chinese users to speed up access to Chinese-based resources, often to improve video game user experience. Active since at least August 2025, the supply chain attack involves a trojanized version of the QuickFox application. The attack is delivered via a modified Electron renderer HTML file used to download and execute a JavaScript-based loader. Upon execution, the JavaScript loader fingerprints the victim endpoint to determine if it’s a valid target before downloading and installing an FDMTP implant. Analysis of infrastructure related to this campaign indicates active development, and infrastructure continues to be active at the time of publishing."
  https://www.fortinet.com/blog/threat-research/quickfox-supply-chain-attack-used-to-deploy-fdmtp-implant
• Consumer Protection Tuesday: A Fake IRS "Digital Asset Compliance Portal" Letter Is Targeting Crypto Holders
  "Scammers are mailing physical letters in subtle, unmarked envelopes that look like they come from the IRS, telling crypto holders they must "enroll" in a so-called Digital Asset Compliance Portal (DACP) before a deadline. The letter includes a QR code that leads to a convincing fake IRS website."
  https://www.coinbase.com/en-gb/blog/consumer-protection-tuesday-fake-irs-scam
  https://www.helpnetsecurity.com/2026/08/04/fake-irs-crypto-letters-compliance-portal-scam/
• WhatsApp Account Takeover Scam Asks You To “vote For My Friend”
  "A scam is spreading through WhatsApp with the goal of taking over victims’ accounts entirely. It starts with a message that feels harmless and familiar. Someone—often a contact whose account has already been compromised—asks you to support a friend or relative of theirs by voting in an online contest. The theme varies: a ballet performance, a dog competition, a school event. The wording is casual, sometimes urgent, and designed to get a quick click."
  https://www.malwarebytes.com/blog/scams/2026/08/whatsapp-account-takeover-scam-asks-you-to-vote-for-my-friend
  https://www.infosecurity-magazine.com/news/whatsapp-voting-scam-linked/
• How Legitimate Cloud Platforms Enable Phishers To Bypass MFA
  "Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks have become primary platforms for hosting phishing pages and sites. Throughout 2025 and 2026, we have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This post analyzes the mechanics of a real-life adversary-in-the-middle (AitM) attack in a cloud environment and presents detailed statistics on the platforms and domains phishers abuse most frequently."
  https://securelist.com/cloud-platforms-in-phishing/120832/
• AI-Enabled Email Accounts Could Become The Ultimate Insider Threat
  "In June, Barracuda’s Red Team detailed a multilayered controlled attack that showed how attackers gain access to a victim’s account. Once an attacker has access, the next steps depend on their objectives. In most cases, however, attackers first seek to establish persistence, escalate privileges and extend their access within the environment. Attackers increasingly try to achieve this by abusing legitimate tools already present in the environment, a technique known as “living off the land.” This commonly takes the form of PowerShell scripts or the misuse of remote access software. Our controlled attack focused instead on the growing threat of attackers leveraging the victim’s AI assistant to perform reconnaissance, identify targets and accelerate attack progression."
  https://blog.barracuda.com/2026/08/04/ai-enabled-email-accounts-insider-threat
  https://www.securityweek.com/weaponized-email-ai-assistants-could-help-attackers-hijack-accounts/
• Almost Half Of Malware Samples Communicate Direct To IP
  "Malware samples often bypass DNS entirely, communicating directly to IP addresses instead. Our analysis of 4 million dynamic analysis reports indicates that almost half (45.32%) of malware samples with any command-and-control (C2) activity made at least one direct-to-IP (D2IP) address connection. Measured as a fraction of all C2 connection attempts, D2IP traffic accounts for 23.17% of the total. A wide variety of threats — including ransomware droppers, peer-to-peer (P2P) botnets and supply chain risks — communicate directly with hard-coded IP addresses, bypassing DNS entirely and evading DNS-based defenses altogether."
  https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/
• Developers In The Crosshairs: Fake AI Tools Deliver Infostealer
  "In April 2026, Netskope Threat Labs exposed a Malware-as-a-Service (MaaS) NodeJS infostealer delivered through the ClickFix social engineering technique. As we tracked this infostealer, we uncovered ongoing campaigns in which attackers shifted delivery vectors, cloning and impersonating known GitHub repositories and redirecting download links at their payloads. These GitHub repositories are part of the broader campaign previously tracked as TroyDen’s lure factory.The campaign’s target victims were mainly in North America, Asia, and Southern Europe, across different segments, with the financial services, banking, and technology sectors leading."
  https://www.netskope.com/blog/developers-in-the-crosshairs-fake-ai-tools-deliver-infostealer
  https://www.helpnetsecurity.com/2026/08/04/developers-github-fake-ai-tools-infostealer/
• Npm Stealer Reads Its C2 From An Ethereum Contract
  "Netskope Threat Labs identified and analyzed 28 malicious npm package versions published across four unrelated enterprise namespaces (@servicetitan, @or-sdk, @onereach, and @umacloud) on 2026-08-04. The packages arrived in two rapid bursts: the @or-sdk and @onereach packages at 10:39 UTC, the @servicetitan packages two minutes later at 10:41 UTC, and @umacloud/knowledge nearly three hours after that at 13:18 UTC. All 28 carry an identical or functionally equivalent payload, confirmed by hash match for @umacloud/[email protected], the one tarball still live when we retrieved it. The operator behind the campaign calls it Shai-Hulud, consistent naming with similar attacks we have tracked over the past year [1], [2], [3]. At install time, the packages fetch a signed Bun runtime release from GitHub, execute an obfuscated JavaScript stealer under it, and delete the runtime."
  https://www.netskope.com/blog/npm-stealer-reads-its-c2-from-an-ethereum-contract
• Malware Signing: When Trust Becomes An Attack Surface
  "Digital code-signing certificates play a critical role in the software ecosystem. When a software publisher signs an application, the certificate serves two important purposes: It identifies the publisher and verifies that the software has not been modified since it was signed. Operating systems, browsers, endpoint protection tools, and users all rely on these signals to determine whether software should be trusted. This trust model benefits everyone. Developers can prove that their software is authentic, users can install applications with greater confidence and security tools can use certificate information as one factor when evaluating risk. In a world where millions of software packages are downloaded every day, digital signatures help establish a foundation of trust. Unfortunately, attackers have learned how to exploit that foundation."
  https://blog.barracuda.com/2026/08/04/malware-signing--when-trust-becomes-an-attack-surface

Breaches/Hacks/Leaks

• 150,000 Impacted By Madera Community Hospital Data Breach
  "Madera Community Hospital in California is notifying just over 150,000 individuals that their personal, financial, and medical information was compromised in a data breach. A not-for-profit community healthcare provider serving Madera County and surrounding areas, Madera Community Hospital provides emergency services, surgical services, acute care, diagnostic imaging, and specialized medical programs. The incident, the hospital says in an incident notice, occurred in May 2025, when hackers accessed its network for two days and likely exfiltrated certain files."
  https://www.securityweek.com/150000-impacted-by-madera-community-hospital-data-breach/
• Swiss IT Agency Hacked, 200 Accounts Compromised, SharePoint Vulns Suspected
  "Switzerland’s Federal Office for Information Technology and Communications (BIT) disclosed Tuesday that hackers had compromised approximately 200 accounts on its on-premises SharePoint servers. The agency made the announcement a week after security specialists first detected anomalies on the on-premises Microsoft servers. It did not confirm how the hackers got in but acknowledged several vulnerabilities affecting SharePoint had been identified in July’s Patch Tuesday release. “The cyberattack was carried out by previously unknown actors, presumably by exploiting these vulnerabilities in the SharePoint software,” the Swiss agency said."
  https://therecord.media/swiss-bit-foitt-hacked-possibly-sharepoint-vulnerabilities
  https://securityaffairs.com/196625/hacking/sharepoint-flaws-used-to-hack-switzerlands-federal-it-agency.html

General News

• Third-Party Cyber Evaluations Involving OpenAI Models
  "Independent testing plays an important role in helping us validate and further understand risks before deployment. Some cyber evaluations intentionally use custom configurations, including lowered safeguards to measure underlying capability—not how models ordinarily behave in publicly available deployments. During recent evaluations, two external testing partners identified incidents in which testing configurations and controls combined with the advancing capabilities of the recent models allowed for model activity to extend beyond their intended testing boundaries."
  https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/
  https://www.bleepingcomputer.com/news/security/openai-anthropic-ai-agents-targeted-real-people-and-systems-in-cyber-tests/
• When Data Becomes Instructions: AI Agents Need a Chain Of Custody For Context
  "A few weeks ago, an AI cyber evaluation produced an unexpectedly efficient strategy for solving a benchmark: the agents went looking for the answers. According to OpenAI’s preliminary disclosure, models being tested for advanced cyber capabilities found ways to obtain secret information that could help them complete a benchmark. They chained vulnerabilities, stolen credentials, internet access, and inferences about where benchmark material might be hosted. The route eventually reached Hugging Face infrastructure, where the activity was detected and contained."
  https://blog.checkpoint.com/ai-security/ai-agent-context-chain-of-custody/
• How Companies Could Share Cyber Risks Without Exposing Their Secrets
  "Zero-knowledge proofs could let infrastructure operators answer key security questions without handing over the sensitive data behind their answers. Imagine a major software flaw is discovered in equipment used across pipelines, power plants and telecom networks. The government needs to know as fast as possible which companies are exposed. But answering that question may require firms to share software inventories, network diagrams and vulnerability scans, which could become attack roadmaps for attackers if compromised. A lesser-known cryptographic concept could help solve this problem. The method, known as zero-knowledge proofs, allows companies prove a vulnerability exists without disclosing how their systems work or other proprietary information."
  https://cyberscoop.com/zero-knowledge-proofs-cyber-risk-sharing-op-ed/
• Digital Executive Protection Is a Strategic Imperative For CEOs
  "In this interview with Help Net Security, Brian Hill, Field CISO, Client Advisory for BlackCloak, explains how attackers reach companies through the personal lives of executives. He describes a case where a draft report sat in an executive’s personal email with no multifactor authentication, and traders acted on it before the news went public. He also covers a home network left open after an AV technician swapped cables, malware planted through hotel Wi-Fi, and why he thinks deepfake defense should verify the person, not the message. Companies lack the tools to close this gap."
  https://www.helpnetsecurity.com/2026/08/04/brian-hill-blackcloak-digital-executive-protection/
• Why Trust Is The New Attack Surface: Darktrace’s Mid-Year Threat Update 2026
  "Darktrace’s analysis of the first half of 2026 shows attackers increasingly exploiting trust rather than bypassing security controls. Identity compromise, supply-chain attacks, SaaS abuse, AI-enabled operations, and state-aligned activity demonstrate how trusted users, services, and infrastructure have become key attack paths. For defenders, context and behavioral analysis remain essential foundations of security."
  https://www.darktrace.com/blog/why-trust-is-the-new-attack-surface-darktraces-mid-year-threat-update-2026
  https://www.infosecurity-magazine.com/news/cloud-saas-targets-attackers/
• AI Accounts For Over Half Of Cybercrime In Africa, Says Interpol
  "AI-driven cybercrime now accounts for 55% of all reported digital crime in Africa, Interpol has warned. The policing group made the claim in a new African Cyberthreat Assessment Report 2026, which draws on data provided by its 36 member countries on the continent. AI-powered scams, social engineering and credential harvesting have helped to drive cybercrime losses from $192m in 2024 to $484m last year, the report claimed."
  https://www.infosecurity-magazine.com/news/ai-accounts-over-half-cybercrime/
• CISO Conversations: Russ Kirby – Passion Is The Antidote To Burnout
  "Passion for the job is the secret of a successful career. Russ Kirby has been CISO at Ping Identity since the summer of 2023. Before then he was CISO at Creditsafe, and then CISO at ForgeRock. Prior to that he had been global head and director of enterprise services information security directorate at Hewlett Packard."
  https://www.securityweek.com/ciso-conversation-russ-kirby-passion-is-the-antidote-to-burnout/
• SQLite Critical CVEs Or LLM Slop?
  "Over the past few days, a newly created GitHub repo (programmervuln/cveadvisory-) published a batch of SQLite vulnerability advisories (as part of other 50+ CVEs which we believe are also LLM slop except from one). NVD quickly flagged these as critical, and CISA's ADP agreed. But when JFrog security researchers dug in to verify, the claims fell apart:
  The cited code didn't even exist in those versions or referenced unrelated logic.
  When testing the PoC payloads they didn’t work (not triggering any crash).
  None of these CVEs are listed on SQLite’s official advisory page (which is a gold standard for tracking actual vulnerabilities).
  All advisories in this repo seem AI generated when testing them with Gptzero
  https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/
  https://www.theregister.com/security/2026/08/03/ai-slop-pollutes-the-cve-pipeline-with-fake-vulns/5282462

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 3 สิงหาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 1 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/08/03/cisa-adds-one-known-exploited-vulnerability-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

ndustrial Sector

• APT And Financial Attacks On Industrial Organizations In Q2 2026
  "This summary provides an overview of reports on APT and financial attacks on industrial enterprises disclosed in Q2 2026, as well as the related activities of groups observed attacking industrial organizations. For each topic, we summarize the key facts, findings and conclusions of researchers that we believe may be useful to professionals addressing practical issues of cybersecurity in industrial enterprises."
  https://ics-cert.kaspersky.com/publications/reports/2026/08/03/apt-and-financial-attacks-on-industrial-organizations-in-q2-2026/
• A Leaked Memo Ties Cyberattacks On Minnesota Water Utilities To Iran
  "Since the US launched its war against Iran in late February, the country’s hackers have struck back with retaliatory intrusions that have ranged from paralyzing medical supplies company Stryker to breaching the personal email of FBI director Kash Patel. Now, after an unprecedented wave of disruptive cyberattacks hit water utilities in Minnesota, a memo circulated within the water industry ties those attacks to Iran, too, in the widest and most disruptive strike yet inflicted by the country’s hackers against the US since the war began. A communication obtained by WIRED on Thursday and sent to members of the Water Information Sharing and Analysis Center, or WaterISAC, an industry group for water utilities to share cybersecurity information, links to Iran a series of cyberattacks that targeted dozens of Minnesota water and wastewater utilities."
  https://www.wired.com/story/a-leaked-memo-ties-cyberattacks-on-minnesota-water-utilities-to-iran/
  https://www.securityweek.com/us-water-cyberattacks-extend-beyond-minnesota-to-at-least-6-other-states/

Vulnerabilities

• N-Able Warns Of N-Central Auth Bypass Flaw Exploited In Attacks
  "N-able is warning customers that hackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) affecting both hosted and on-premises N-central servers. The company on Sunday released hotfix 2026.3.1.7 to address the security issue, which affects all versions of N-central before 2026.3. On August 1st, the vendor disclosed that it detected active exploitation and launched an investigation that uncovered additional security concerns affecting all versions of N-central, its flagship Remote Monitoring and Management (RMM) platform."
  https://www.bleepingcomputer.com/news/security/n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks/
  https://uptime.n-able.com/event/201456/
  https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html
  https://www.darkreading.com/vulnerabilities-threats/attackers-exploit-n-able-patch-bypass-flaw
  https://www.bankinfosecurity.com/n-able-flaw-exposes-msps-to-worst-case-scenario-a-32397
  https://hackread.com/hackers-exploit-n-able-n-central-flaw-initial-fix/
  https://www.securityweek.com/n-able-patches-vulnerability-exploited-to-hack-n-central-servers/
  https://www.helpnetsecurity.com/2026/08/03/cve-2026-18577-n-able-n-central-vulnerability/
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/08/03/cisa-adds-one-known-exploited-vulnerability-catalog
• Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable
  "Thermo Fisher Scientific has patched a flaw in select Applied Biosystems human identification software that could allow data files to be altered before analysis software loads them. The vendor's July 31 security bulletin says nearly undetectable changes to .fsa and .hid outputs could occur if laboratory controls are circumvented. Thermo Fisher tracks the issue as CVE-2026-17583 and rates it High with a CVSS v4.0 score of 8.2. Five supported product lines have received updates that add digital signatures, while three end-of-life data collection products will receive no vendor update."
  https://thehackernews.com/2026/08/thermo-fisher-patches-flaw-that-could.html

Malware

• Analysis Of a Phishing Email Attack Case By The Larva-24009 Threat Actor
  "The Larva-24009 threat actor has been active since at least 2023, carrying out phishing email attacks targeting users both in Korea and globally to install malware. ASEC (AhnLab SEcurity intelligence Center (ASEC) has previously disclosed attack cases by this threat actor in 2024, and [1] [2] [3] Subsequently, Cyble also identified this same attack campaign and named it “HeptaX.” [4] The Larva-24009 threat actor continues to carry out attacks in 2026, and this report summarizes the attacks and malware identified in 2026."
  https://asec.ahnlab.com/en/94786/
• Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader And DeviceManager RATs
  "SOCRadar’s Threat Research Unit (STRU) identified and analyzed DOUBLECUP, a Russian Loader-as-a-Service (LaaS) for ClickFix campaigns. Operating in a client-server architecture, each client can configure campaigns that host the DOUBLECUP logic on specific URLs. The DOUBLECUP panel provides multiple utilities to load an operator’s final payload. The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage. This second stage decrypts the final payload in memory via a custom SHA-256 stream cipher in Counter (CTR) mode along with bitwise XOR using the victim’s public IP address as the cryptographic key."
  https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/
  https://www.bleepingcomputer.com/news/security/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images/
• Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord And Forums
  "A malware campaign disguised as an “undetected” version of the Xeno Roblox script executor is directly affecting players looking to download a legitimate tool. Promoted through various gaming forums and Discord communities, the fake cheat launches a multi-stage Java infection chain built to stay hidden in plain sight. Its components imitate real Xeno files, use Windows-style names and hide inside trusted-looking directories, which includes a folder associated with Xbox Game Bar, formerly Microsoft GameDVR. The final payload goes far beyond conventional credential theft. It can steal browser cookies, Discord, Roblox and Minecraft accounts, cryptocurrency-wallet data and payment information."
  https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor
  https://www.bleepingcomputer.com/news/security/fake-roblox-xeno-script-launcher-pushes-infostealer-rat-malware/
• Inside The Underground Business Of The Android BTMOB RAT Malware
  "BTMOB has been covered by several cybersecurity publications, primarily through technical analyses of the malware and its capabilities, but much less has been reported about the ecosystem that has developed around it. Activity observed by Flare researchers in underground forums and chat platforms reveals another story: a criminal software business that appears to have become increasingly difficult for its original operator to control. Posts reviewed by Flare show the channel presenting itself as BTMOB’s official outlet continuing to release new versions and sell access, private infrastructure, and source code."
  https://www.bleepingcomputer.com/news/security/inside-the-underground-business-of-btmob-rat/
• DarkReasoning: A Chinese LLM Attacked Our Lab, So We Made It Work For Us
  "5 days. That's how long the first live, LLM-managed cyber attack campaign we've detected hit our lab at Jesta Security. And for what? To set up proxyjacking and generate more attacks. From what we uncovered, over 1,000 victims had already been hit the same way, most likely also being used to generate fresh attacks every second. And if this is only what we stumbled onto, we believe the real number is far higher."
  https://jesta.ai/blog/darkreasoning
  https://www.darkreading.com/cyberattacks-data-breaches/chinese-actor-deepseek-ai-agent-attack-security-firm
• Disrupting a Criminal Scam Operation
  "Earlier this year, we disrupted a Cambodia-based scam operation that used ChatGPT to support investment, romance, gambling, and law enforcement impersonation schemes. We began investigating this activity following a lead from our peers at WhatsApp and have since shared additional threat signals with industry partners and relevant authorities. The operation illustrates an important reality about modern scam networks: organized criminal groups rarely restrict themselves to a single type of scam. Instead, they opportunistically employ whatever narratives, personas, and tactics they think will be most effective to deceive victims."
  https://openai.com/index/disrupting-malicious-uses-of-ai-criminal-scam-operation/
  https://www.helpnetsecurity.com/2026/08/03/openai-disrupts-chatgpt-scam-operation/
• Buying TikTok Views Or Followers? Here’s What You’re Really Getting
  "A whole industry has sprung up around selling TikTok “growth.” Cheap views by the hundred, pre-made ad accounts, and polished sales pages promising a repeatable path to serious revenue. None of it is officially sanctioned by TikTok, and depending on what you’re buying, you could end up wasting money, losing your account, or handing your login details to scammers."
  https://www.malwarebytes.com/blog/threat-intel/2026/07/buying-tiktok-views-or-followers-heres-what-youre-really-getting
  https://www.helpnetsecurity.com/2026/08/03/malwarebytes-tiktok-followers-scam-risks-report/
• An Analysis Of Incidents At Brazilian Educational Institutions
  "Because of the amount of data that can be obtained and the high impact that successful attacks may have, educational institutions are frequent targets of cybercriminals. Both public and private schools and universities rely on software for managing personally identifiable information (PII) that is often insecure or insufficiently tested against known vulnerabilities. In addition, machines used by multiple people without accountability can be vulnerable to insider threats."
  https://securelist.com/incidents-at-brazilian-educational-institutions/120803/
• Targeted Attack On Government Entities In The Middle East | Part 2
  "This is Part 2 of our two-part technical analysis on new tools used by an East Asia-linked threat actor targeting government entities in the Middle East. After ThreatLabz published Part 1 on the TELESHIM backdoor and MIXEDKEY loader, Kaspersky highlighted a related campaign in recent reporting. Building upon our initial findings, Part 2 dives into a detailed technical analysis of BINDCLOAK, a new modular stage 3 backdoor uncovered during our investigation. As detailed later in our threat attribution section, key code similarities between BINDCLOAK and OctLurk as well as shared command-and-control (C2) infrastructure directly connect the threat actor behind OctLurk to the campaign we describe in this two-part blog series."
  https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-2
• From WSProxy To Root: INC Ransomware And SonicWall SMA Exploit Chain
  "Virtual private network (VPN) appliances occupy one of the most sensitive positions in modern enterprise architecture: the boundary between the untrusted public internet and the internal corporate network. Unlike general-purpose web servers, VPN concentrators are intentionally exposed to inbound connections, designed to authenticate remote users, and granted privileged access to directory services, file shares, intranet applications, and management interfaces. They terminate encrypted tunnels, process credentials, and maintain session state at the network edge. A critical vulnerability in a VPN appliance is therefore not a peripheral remote-access issue—it is a direct network-compromise issue with cascading consequences for every downstream system the appliance was built to protect."
  https://www.resecurity.com/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain
  https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html
  https://www.securityweek.com/recent-sonicwall-vulnerabilities-exploited-in-ransomware-attacks/
• Pass The Passkey: A Novel Attack Surface In Passwordless Authentication
  "This article analyzes new attack classes against passwordless authentication, focusing on Google’s synced passkey ecosystem and the Cloud Authenticator used by desktop clients. The attacks demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts. We show how an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys. After decades of breaches and billions in losses, the attack vectors that defined the era of passwords and shared secrets are finally starting to fade. Passkeys replace passwords and traditional multi-factor authentication (MFA) with public-key cryptography, decreasing entire classes of attacks that have dominated the threat landscape for years."
  https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/
  https://thehackernews.com/2026/08/google-password-manager-attacks-could.html
  https://www.bleepingcomputer.com/news/security/new-pass-ta-key-attacks-let-malware-hijack-google-synced-passkeys/
• DarkSword's Panel Sprawl: How One Body Hash Unravels a Six-Panel, Two-Codebase Operator Cluster
  "DarkSword is a commercial iOS exploit chain, six chained vulnerabilities spanning iOS 18.4 through 18.7, that leaked publicly via a GitHub repository (ghh-jb/DarkSword) and now runs in the hands of at least seven, and probably eight, unrelated operators. The most recently identified operator is a Chinese-speaking actor running well over a hundred web properties, most of them fronted by a fake AWS sign-in page on a domain that also hosts DarkSword. The hosting concentrates in Hong Kong but reaches into Japan, the United States, and Europe. We re-scanned the cluster’s infrastructure to see how far it extended. Here is what we found."
  https://censys.com/blog/darkswords-panel-sprawl/
  https://thehackernews.com/2026/08/chinese-threat-actor-uses-leaked.html

Breaches/Hacks/Leaks

• ExfilSquad Hackers Leak Info Of Over 100,000 UK Police Officers, Staff
  "A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals. The intrusion was detected on Sunday, July 26, and was later claimed by the ExfilSquad data extortion group, which alleges it stole 135,000 contact records. PNLD is an online legal resource service that has been used for more than 30 years by the 43 Home Office police forces in England and Wales, as well as the British Transport Police."
  https://www.bleepingcomputer.com/news/security/exfilsquad-hackers-leak-info-of-over-100-000-uk-police-officers-staff/
  https://thehackernews.com/2026/08/pnld-breach-exposes-uk-police-and.html
  https://securityaffairs.com/196525/data-breach/pnld-confirms-data-breach-affecting-uk-police-and-justice-staff.html
• Żabka Alleged Data Leak: 541k Jira Tickets, 89 Repos
  "A data-leak forum account registered on 2 August 2026 advertised an alleged Żabka Polska dataset the same afternoon, asking €5,000. The listing claims roughly 541,000 Jira issues, 229,734 IT service-desk tickets and source code from 89 GitLab repositories. Ransomnews reviewed the sample archive attached to the post. The headline counts are internally consistent, and a single GitLab access token appears in all 89 repository dumps. Żabka Group has not confirmed any breach."
  https://ransomnews.com/zabka-data-leak-2026/
  https://securityaffairs.com/196510/data-breach/alleged-zabka-breach-exposes-jira-data-source-code-and-api-keys.html
• Hackers Steal 31,000 Records Identifying People Behind Liechtenstein Companies, Foundations
  "A cyberattack compromised tens of thousands of records related to companies, foundations and trusts in Liechtenstein, prompting the government to to form a “crisis unit” to address the breach. The unknown attackers gained access to the Register of Beneficial Owners for two days beginning on July 29, the government announced over the weekend. The register, which contains information on who owns legal entities in the country, was created in 2021 in accordance with European Union rules around money laundering and financial transparency."
  https://therecord.media/hackers-steal-records-liechtenstein-companies-foundations
• River Bank Says Hackers Deleted Data Stolen In Ransomware Attack
  "River Financial Corporation, the bank holding company behind River Bank & Trust, says it received confirmation that data stolen in a ransomware attack was deleted. The attack occurred on June 16 and was identified three days later. River’s investigation into the incident determined that ransomware was deployed across portions of its server environment. In response, the company took the affected systems offline and disabled administrative accounts that had been compromised."
  https://www.securityweek.com/river-bank-says-hackers-deleted-data-stolen-in-ransomware-attack/
  https://securityaffairs.com/196537/cyber-crime/river-bank-obtained-assurances-from-the-attackers-that-the-stolen-data-in-the-june-attack-was-deleted.html

General News

• The Assets You Don’t Know You Own: Attack Surface Sprawl Is a Discovery Problem, Not a Tooling Problem
  "Modern organizations no longer operate within a fixed network perimeter. Cloud services, remote work, third-party integrations, and rapid digital expansion have made the boundary between “inside” and “outside” for the enterprise increasingly difficult to define. Attackers exploit this ambiguity by scanning continuously for weaknesses across an organization’s hardware, software, cloud, and internet-facing assets. The uncomfortable truth security leaders must confront is simple: an organization cannot secure what it does not know it has."
  https://cyble.com/blog/attack-surface-discovery-asset-visibility/
• Anthropic: Claude Attacks Result Of Security Gaps, Not Model Issues
  "Three recent incidents in which Anthropic's AI models autonomously compromised real-world systems were less a failure of model alignment than a failure of the systems designed to keep them contained, according to the company. The compromises happened while Anthropic was testing the ability of its Claude AI models to autonomously find and exploit novel vulnerabilities in simulated cybersecurity environments. Typically, the company conducts these capture-the-flag-style exercises in environments that aren't connected to the Internet and often works with external partners to conduct the tests."
  https://www.darkreading.com/cyber-risk/anthropic-ai-issues-result-security-gaps
• Is There Really a Fix For CISO Fatigue?
  "Only 2% of cybersecurity professionals report feeling no stress about their job, according to Omdia and ISSA's eighth annual Life and Times of Cybersecurity Professionals study. In addition, 68% say the work has become measurably harder over the past two years. The difference between those two figures is screaming that stress in this profession has moved from an occupational hazard to the default condition, and that shift changes what conclusions security leaders should draw from the gap."
  https://www.darkreading.com/cybersecurity-operations/fix-for-ciso-fatigue
• Mapping The Malware Blast Radius a Single Alert Won’t Show You
  "In this interview with Help Net Security, Mike Wiacek, founder and CTO of Stairwell, explains Backstory, an AI agent that takes a single alert and works outward to map how far a malware campaign spread. He walks through the research behind the claim that each published sample hides an average of 2.4 undocumented variants, describes what counts as a related variant, and explains why Stairwell keeps every executable that runs on customer endpoints."
  https://www.helpnetsecurity.com/2026/08/03/mike-wiacek-stairwell-backstory-malware-blast-radius/
• CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes As AI Use Accelerates
  "The CrowdStrike 2026 Threat Hunting Report illustrates the next evolution in trust abuse. Adversaries are targeting trusted users and tools across identity systems, cloud environments, SaaS applications, AI services, software supply chains, and developer workflows to blend into legitimate business activity and reach critical assets before defenders can detect them."
  https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-threat-hunting-report/
  https://www.infosecurity-magazine.com/news/chinalinked-threat-actors/
  https://cyberscoop.com/crowdstrike-annual-threat-hunting-report-2026/
• Google Warns Open-Source Attacks Will Reach New Heights
  "Compromising the open-source supply chain is easier to execute and spreads more quickly than traditional supply-chain attacks, making it a lucrative tactic that will continue to expand, warned computing giant Google. Attacks on open-source code repositories, software dependencies and developer tools flourished in 2025 and the first months of 2026: TeamPCP's two waves of Shai-Hulud malware late last year affected 20 million weekly downloads of open-source software, while its months-long campaign this year poisoned packages accounting for 100 million weekly downloads."
  https://www.bankinfosecurity.com/google-warns-open-source-attacks-will-reach-new-heights-a-32404

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Telecom Sector

• Researchers Report 84 Flaws In 4G And 5G Cores, Including a Session Hijacking Flaw
  "An academic study has disclosed a "widespread class" of security vulnerabilities impacting 4G and 5G core networks that, if successfully exploited, could trigger denial-of-service (DoS) attacks and even session hijacking, allowing an attacker to seize control of a user's network session. The findings have been released by a group of researchers from Singapore's Nanyang Technological University in a paper titled "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis.""
  https://thehackernews.com/2026/07/researchers-report-84-flaws-in-4g-and.html
  https://arxiv.org/abs/2607.10315

Vulnerabilities

• Advanced Responsive Video Embedder For Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass Via Hardcoded Backdoor In '_wplogin' Parameter
  "The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the _arve_uc_init() function — registered on WordPress's init hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the _wplogin (or _wpm) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account."
  https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-responsive-video-embedder/advanced-responsive-video-embedder-for-rumble-odysee-youtube-vimeo-kick-1087-unauthenticated-authentication-bypass-via-hardcoded-backdoor-in-wplogin-parameter
  https://hackread.com/wordfence-critical-backdoor-arve-wordpress-plugin/
• Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
  "Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect authorization that could result in arbitrary code execution in the context of the current user without requiring any user interaction."
  https://thehackernews.com/2026/08/adobe-campaign-classic-cvss-100-flaw.html
  https://securityaffairs.com/196429/security/adobe-fixed-a-maximum-severity-vulnerability-flaw-in-campaign-classic.html

Malware

• Adform Compromised To Serve Crypto Stealer Via Supply Chain Attack
  "Adform are an advertising company used by around 14k companies, owning around a 30% share of the demand-side category. They operate by offering a Javascript embed for websites, via this URL: hxxps://s2.adform.net/banners/scripts/st/trackpoint-async.js This script was compromised to serve a crypto stealer. Adform have been hacked. As far as I can tell Adform haven’t told people."
  https://doublepulsar.com/adform-compromised-to-serve-crypto-stealer-via-supply-chain-attack-2f1ec024f33e
  https://www.bleepingcomputer.com/news/security/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/
  https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html
• The Fuyao Enterprise: Building An Ad-Fraud Empire With AI And Kids’ Coding Blocks
  "In this post, we will uncover the “Fuyao Enterprise,” a previously unknown, sophisticated and highly modular botnet operating within Android TV boxes. This operation marks a shift in modern ad-fraud, where automated bots fake both clicks and views to defraud advertisers and ad-networks. While deploying novel tactics and techniques, Fuyao managed to escape public research for several years. Now, its operators openly advertise their network of over 120,000 “AI digital humans.""
  https://www.bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks
  https://thehackernews.com/2026/07/cheap-android-tv-boxes-pose-as-phones.html
  https://www.helpnetsecurity.com/2026/07/31/fuyao-ad-fraud-botnet-android-tv-boxes/
• Network Anomaly Detection In KATA
  "Once the attacker has breached the corporate network, subsequent stages of the attack often involve leveraging standard domain infrastructure protocols: using Kerberos, running DNS queries, accessing internal services, opening network shares, and other common networking actions. Because this activity is virtually indistinguishable from legitimate network traffic, it is extremely difficult to detect it with traditional network attack detection tools. Kerberoasting and DNS tunneling have long ceased to be exotic techniques. They are becoming standard methods in modern attacks because they allow attackers to execute critical compromise stages while remaining undetected by traditional security tools. A clear example of this trend is seen in latest campaigns, employing both Kerberoasting and DNS tunneling."
  https://securelist.com/tr/network-anomaly-detection-in-kata/120892/
• Nested Trust: HollowFrame’s Layered Loader And Matryoshka Backdoors
  "Blackpoint Cyber’s Adversary Pursuit Group (APG) identified a previously undocumented, multi-stage intrusion affecting two endpoints at a law firm. The activity began with a spear phishing lure and progressed through several layers of obfuscated scripts, encrypted payloads, and trusted software components before establishing persistent remote access. The intrusion relied on a modular Go based loader tracked as HollowFrame and a Rust based malware family tracked as Matryoshka. HollowFrame provided the actor with multiple execution and persistence options. The Matryoshka family was represented by two distinct backdoor variants, one that communicated directly over HTTP and another that used GitHub for tasking and payload delivery. Together, these variants supported command execution, reconnaissance, file transfer, and follow on malware deployment."
  https://blackpointcyber.com/blog/hollowframes-layered-loader-and-matryoshka-backdoors/
  https://thehackernews.com/2026/07/hollowframe-loader-deploys-matryoshka.html
• The Xcode Assassin Returns: A Deep Dive Into The Latest XCSSET Version
  "After months of dormancy, the attackers behind the XCSSET malware released version 40 (v40), targeting the macOS ecosystem. This version’s advanced architecture hides its core logic in memory space, reducing its digital footprint. V40 further enhances its detection evasion capabilities by combining polymorphic payload generation with fileless persistence and dynamic in-memory execution, while weakening a number of security mechanisms on the affected machine. Since early April 2026, the malware has spread through supply chain attacks by hiding itself in the Xcode projects of dozens of legitimate applications with thousands of active users. Xcode is Apple’s integrated development environment (IDE) for building apps for its various operating systems."
  https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/
• When ScreenConnect Works For Cybercriminals
  "Leveraging legitimate software is one of cybercriminals’ tactics of choice, with remote management tools ranking among their top tools. A recent example involves the remote administration utility ScreenConnect. It’s designed for IT support teams to troubleshoot systems and configure software seamlessly in the background. However, when weaponized by threat actors, ScreenConnect becomes a versatile attack vehicle used to harvest data, deploy malware, and move laterally across corporate networks."
  https://www.kaspersky.com/blog/screenconnect-fake-software-campaign/56197/
• CaptiveCrunch: Midnight Blizzard Targets Travelers Worldwide For Malware Delivery And Credential Theft
  "Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite some tactic, technique, and procedure (TTP) similarities to the Forest Blizzard DNS hijacking operation that we publicly disclosed in April 2026, we attribute this campaign, which we call CaptiveCrunch, to Storm-2945. As reported by ReliaQuest on July 23, a portion of this activity leverages doppelganger domains mimicking Microsoft online services to conduct follow-on adversary-in-the-middle (AitM) phishing operations that abuse the device code authentication flow in Microsoft Entra ID."
  https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
  https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html
  https://securityaffairs.com/196441/apt/russian-hackers-hijack-hotel-wi-fi-to-steal-microsoft-365-tokens.html
• COLDCARD Wallet RNG Flaw Likely Linked To $88 Million Bitcoin Theft
  "Researchers suspect that a vulnerability in COLDCARD hardware wallet firmware was exploited to steal an estimated $88.6 million in Bitcoin from thousands of wallets whose seeds were generated using a flawed random number generator. Digital asset research firm Galaxy Research says it identified an initial wave of transactions that it believes was likely linked to the vulnerability, draining approximately 1,083 BTC, worth $70.2 million, from 1,196 addresses on July 30. The 41-minute attack occurred approximately 30 hours before Coinkite publicly disclosed the flaw."
  https://www.bleepingcomputer.com/news/security/coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft/

Breaches/Hacks/Leaks

• Amgen Says Cloud Data Breach Exposed Patient Health, Proprietary Info
  "Pharmaceutical company Amgen says it suffered a data breach after threat actors stole corporate data and patient information stored in multiple cloud systems operated by third-party service providers. Amgen is a California-based biotechnology company that develops and manufactures medicines for serious illnesses, including cancer, cardiovascular disease, inflammation, and rare diseases. The company said it detected the unauthorized activity in July 2026 and responded by activating its cybersecurity response plan, implementing containment measures, and hiring independent forensic experts to investigate the incident."
  https://www.bleepingcomputer.com/news/security/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info/
• CareCloud Data Breach Impacts Over 350,000
  "Healthcare information technology company CareCloud is notifying at least 350,000 people that their information was stolen in a data breach. The incident involved an electronic health record environment within the CareCloud Health division, which was disrupted on March 16, 2026. CareCloud’s investigation determined that hackers accessed one of its AWS environments between March 10 and March 16, and likely exfiltrated data from it."
  https://www.securityweek.com/carecloud-data-breach-impacts-over-350000/
  https://securityaffairs.com/196480/cyber-crime/carecloud-breach-exposes-medical-and-financial-data-of-345000.html

General News

• The Morning After We Pull a Root Of Trust, Nobody Owns It
  "In June 2024, Google's Chrome Root Program said it would stop trusting new Transport Layer Security (TLS) certificates from Entrust. Behind the decision, years of compliance failures and a clear technical call. The decision was right. The fallout became someone else's responsibility. That is the part we keep getting wrong. We are good at the technical decision to remove a trust anchor. Root programs at Chrome, Mozilla, Microsoft, and Apple make that call well. What we lack is a way to coordinate what happens the morning after. Trust continuity is a national readiness problem hiding inside a browser setting."
  https://www.darkreading.com/cyber-risk/morning-after-we-pull-root-of-trust-nobody-owns-it
• Interpol Leverages Global System To Curtail Fraud Payments
  "Earlier this month, Interpol revealed that authorities in Singapore and Oman used a worldwide network of law enforcement agencies and financial organizations to halt a $6.6 million payoff from a business email compromise (BEC) scam, part of Operation First Light 2026, which — among other milestones — blocked more than 31,000 bank accounts linked to fraud. When companies and individuals report fraud and cybercrime, it's often too late to recover transferred funds. The coalition of law enforcement agencies and financial firms, known as the Interpol Global Rapid Intervention of Payments (I-GRIP) mechanism, has been working together to cut down the time to halt transfers and recover funds."
  https://www.darkreading.com/cybersecurity-operations/interpol-leverages-global-system-curtail-fraud-payments
• Cybercrime Goes Subscription: AI, Malware And Infrastructure On Demand
  "Cybercrime has become a commercialized ecosystem where criminals can buy or rent nearly every capability needed to launch sophisticated attacks. These services provide anonymity, plausible deniability, and access to short-lived infrastructure that is difficult to detect, attribute, and disrupt, enabling low-skilled actors to operate at scale, according to the Infoblox 2026 Threat Landscape Report. “Cybercrime is becoming more efficient, automated, and harder to stop. Driven by economics and fueled in part by frontier AI, it has reached an unprecedented scale. The line between financially motivated and state actors has blurred in a complex economy that allows criminals to evade disruption through segmentation and the adoption of commodity services,” said Dr. Renee Burton, Head of Infoblox Threat Intel."
  https://www.helpnetsecurity.com/2026/07/31/infoblox-domain-abuse-campaigns-report/
• Aviation Cyber Risk Sits On The Ground, The Blindness Sits In The Air
  "In this interview with Help Net Security, Eliran Almog, CEO of Cyviation, explains why airline cyber losses happen on the ground while the aircraft stays unmonitored. He walks through GNSS jamming that leaves no trace in a SIEM, and a PX4 Autopilot flaw his team disclosed where drone command channels accept unsigned messages. He argues the Electronic Flight Bag matters less than the data loading chain behind it, makes the case for digital twins, and sets out what a 30 aircraft carrier with two security staff should do first."
  https://www.helpnetsecurity.com/2026/07/31/eliran-almong-cyviation-aviation-cyber-risk/
• AI Agents Are Changing Where Cybersecurity Seed Funding Lands
  "Founders pitching a cybersecurity seed round this summer are joining a line that keeps getting longer. Product Hunt launches hit their highest level since late 2023 last quarter, and the Census Bureau’s count of high-propensity business applications kept climbing. Seed deal volume in cyber ticked down. Those figures come from the Q2 2026 Insights report published by DataTribe, an early-stage cybersecurity investor. The money went up the stack. Nine-figure rounds took 81% of every venture dollar invested in the second quarter, more than double the share they held at the start of 2018. Cyber Series A volume fell from Q1 and stayed inside the band it has occupied for three years."
  https://www.helpnetsecurity.com/2026/07/31/ai-agents-cybersecurity-seed-funding/
• What An LLM Can Find: A Practical, Cheap Path To Code-Level Threat Discovery
  "GlobaLeaks, a mature whistleblowing platform that had already undergone six independent professional audits over the past thirteen years, was subjected to an LLM-assisted security review that cost roughly USD 3,140 in API calls. The review identified 29 confirmed vulnerabilities, 12 denial-of-service issues, and 42 hardening recommendations, with an average cost of about USD 77 per confirmed finding before human validation. The most important point is probably the cost. Reading an entire codebase systematically, line by line and against major known weakness classes, traditionally required weeks of specialist work and a serious budget. That assumption no longer holds in the same way: the report argues that this kind of analysis is now far more accessible than it used to be."
  https://securityaffairs.com/196395/ai/what-an-llm-can-find-a-practical-cheap-path-to-code-level-threat-discovery.html
• AiTM Phishing Becomes Top Initial Access Threat To Law Firms
  "Adversary-in-the-middle (AiTM) phishing has become the single most common way attackers break into law firms, overtaking conventional credential theft in a sector where multifactor authentication (MFA) is now widely deployed but routinely bypassed. According to a new legal sector threat intelligence report from eSentire shared with Infosecurity, AiTM attacks accounted for 28.57% of all initial access events in the legal sector. The company's Threat Response Unit (TRU) also recorded a 20% year-over-year (YoY) increase in incidents targeting legal organizations."
  https://www.infosecurity-magazine.com/news/aitm-phishing-top-entry-point-law/
  https://esentire-dot-com-assets.s3.amazonaws.com/assets/resourcefiles/eSentire_Legal-Services-Threat-Intelligence-Spotlight.pdf
• What The Hugging Face Breach Reveals About Defense In The Age Of Agentic AI
  "We almost never get both sides of an intrusion. This time we did. Last month, Hugging Face disclosed a breach into part of its production infrastructure, saying an autonomous AI agent system ran the attack from start to finish. Five days later, OpenAI revealed that its own models, including GPT-5.6 Sol along with an unreleased one, were responsible for the breach. OpenAI called it an unprecedented cyber incident."
  https://cyberscoop.com/hugging-face-breach-agentic-ai-security-op-ed/

อ้างอิง
Electronic Transactions Development Agency (ETDA)