โพสต์ถูกสร้างโดย NCSA_THAICERT

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 7 รายการ เมื่อวันที่ 27 สิงหาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-25-128-03 Mitsubishi Electric Multiple FA Products (Update D)
• ICSA-26-078-05 Mitsubishi Electric CNC Series (Update A)
• ICSA-26-239-01 Xiiaozet LK100W
• ICSA-26-239-02 All-Line Equipment Company Fuel-Boss
• ICSA-26-239-03 Rockwell Automation OTTO Fleet Manager
• ICSA-26-239-04 Applied Systems Engineering ASE2000 V2 Communications Test Set
• ICSA-26-239-05 Ebyte NA111-M

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 9 รายการ เมื่อวันที่ 25 สิงหาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-25-070-02 - Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool (Update A)
• ICSA-26-069-02 - Lantronix EDS3000PS and EDS5000 (Update A)
• ICSA-26-237-01 - Rently Smart Home
• ICSA-26-237-02 - Zoneminder
• ICSA-26-237-03 - Siemens SIMATIC IoT2050 Advanced
• ICSA-26-237-04 - PayRange API
• ICSA-26-237-05 - Bendix EC80 Brake ECU
• ICSA-26-237-06 - Ebyte NE2-D11
• ICSA-26-237-07 - Furuno FA-50 Class B AIS Transponder

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 1 รายการ เมื่อวันที่ 20 สิงหาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-232-01 Johnson Controls Simplex Incident Manager

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Xiiaozet LK100W
  "Successful exploitation of these vulnerabilities could allow an attacker to take control over the device."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01
• Applied Systems Engineering ASE2000 V2 Communications Test Set
  "Successful exploitation of these vulnerabilities could allow an attacker to read or write arbitrary local files, cause the application to issue outbound network requests, or intercept the connection to impersonate the trusted peer, complete the TLS handshake, and read or modify the protected communications."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-04
• Ebyte NA111-M
  "Successful exploitation of these vulnerabilities could allow an attacker to fully compromise the device."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-05
• All-Line Equipment Company Fuel-Boss
  "Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-02
• Rockwell Automation OTTO Fleet Manager
  "Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-03

Vulnerabilities

• PaperCut Warns Of NG, MF Flaw Exploited In Zero-Day Attacks
  "PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company says it is aware of confirmed attacks on customers and is urging organizations with Internet-exposed PaperCut Application Servers to immediately restrict access to the web interfaces to trusted IP addresses. "PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF," reads an urgent security advisory published Thursday."
  https://www.bleepingcomputer.com/news/security/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/
  https://www.helpnetsecurity.com/2026/08/27/papercut-ng-mf-vulnerability-attack/
• Next.js Patches Critical AVIF And Windows Flaws Enabling Unauthenticated RCE
  "Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem. The Windows path traversal, tracked as CVE-2026-75604 (CVSS score: 9.0), affects Next.js applications that use both the Pages Router and App Router without Cache Components when the server uses a Windows filesystem."
  https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html
• CISA Adds Three Known Exploited Vulnerabilities To Catalog
  "CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2023-49105 ownCloud Improper Authentication Vulnerability
  CVE-2026-53362 Linux Kernel Unspecified Vulnerability
  CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/08/27/cisa-adds-three-known-exploited-vulnerabilities-catalog
• Power Leak: Amazon Kiro IDE Prompt Injection Enables Data Exfiltration
  "Mindgard discovered a data-exfiltration vulnerability in Amazon Kiro IDE , an AI-assisted development environment that can interact with project content and invoke tools as part of developer workflows. The issue allowed attacker-controlled repository content to influence the Kiro agent and ultimately cause sensitive local information to be transmitted to an external endpoint. Testing was performed against Kiro IDE version 0.7.45 on Windows, and the behavior was reproduced in both trusted and untrusted workspaces."
  https://mindgard.ai/blog/amazon-kiro-data-exfiltration
  https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html

Malware

• Carry-On Compromise: TA4922 Packs PackClient
  "Proofpoint researchers recently discovered a RAT framework we named PackClient. PackClient is being used by at least one threat actor, Chinese-speaking TA4922, and appears to be actively sold on Telegram. PackClient is a full featured, modular command and control (C2) framework that supports data theft, surveillance, and downloading of additional plugins and payloads."
  https://www.proofpoint.com/us/blog/threat-insight/carry-compromise-ta4922-packs-packclient
  https://www.bankinfosecurity.com/chinese-speaking-ta4922-bought-new-rat-from-commodity-marketplaces-a-32670
• JavaScript Obfuscation: From Party Trick To Phishing Kit
  "We open a JavaScript artifact hoping for code, and instead get string arrays, strangely named functions, encoded URLs, runtime decoders, and eval statements. That is the point where “reading the script” stops being enough. Obfuscated JavaScript is still code, but it is code with the useful context stripped out, the names ruined, the strings hidden, and the real behavior pushed into runtime. It shows up in phishing pages, malware loaders, sketchy browser scripts, and occasionally in legitimate software protection that has wandered into suspicious-looking territory. Over the last few years, I’ve spent a fair amount of time pulling apart suspicious JavaScript from phishing kits, malware packages, compromised sites, and other places where the readable source has been deliberately buried. I might not be a world-class JavaScript reverser, but I’ve learned enough useful tricks to make the mess explain itself."
  https://blog.talosintelligence.com/javascript-obfuscation-from-party-trick-to-phishing-kit/
• One Adversary, Two Outcomes: The 0.027% Proof
  "Strip away the architecture debates and one question remains: does Cyber-Fraud Fusion change outcomes by enough to matter? The fairest way to answer is a natural experiment: one live criminal campaign, hitting many institutions at once, some running a fused defence and some not. Between July 2025 and January 2026, exactly that experiment ran across Indonesia. The campaign, operated by a Chinese-speaking threat cluster tracked as GoldFactory, targeted taxpayers by impersonating the national tax platform: a service with 67 million registered users and, crucially, no official mobile app, so citizens had no reference point for spotting fakes."
  https://www.group-ib.com/blog/one-adversary-two-outcomes-0027-proof/
• Chinese Hacker Group QTFY Uses Custom-Built Platforms To Target US Infrastructure, FBI Warns
  "A sophisticated Chinese hacking group known as QTFY is actively targeting US government and critical infrastructure systems via an ecosystem of custom-built malicious platforms, the FBI has warned. The group has focused on critical infrastructure sectors including defense industrial base (DIB), communications, government and higher education for close to a decade since being established in 2018. In 2024, QTFY successfully exfiltrated data from over 300 organizations in the US and globally after leveraging an exploit for a Check Point Quantum Gateway vulnerability. Victims included US defense contractors, financial institutions and universities."
  https://www.infosecurity-magazine.com/news/chinese-qtfy-us-infrastructure-fbi/
  https://www.ic3.gov/CSA/2026/260826.pdf
• Fake Listings Can Turn Trusted Platforms Into Scam Springboards
  "Recently, we found a listing on BuzzFeed from someone pretending to be Malwarebytes Support. It reminded us why we need to be cautious about content on platforms where anyone can create an entry. Based on the phone number, we suspect the people behind this listing are trying to draw callers into a tech support scam. The scammer may use social engineering to persuade victims to grant remote access to their devices."
  https://www.malwarebytes.com/blog/scams/2026/08/fake-listings-can-turn-trusted-platforms-into-scam-springboards
• Fake Apple Pay Charge Brings The Classic Tech Support Scam To Your Phone
  "iPhone users are being targeted in a new tech support scam, using a fake Apple Pay notification to trick users. Tech support scams that use fake warnings to push victims into calling a phone number have been around for years, but this page has been designed specifically for phones. Instead of a desktop warning claiming your computer has a virus, the scam imitates familiar iPhone features including Apple Pay, Face ID, and App Store payments. It even uses the phone’s own text-to-speech capabilities and attempts to interfere with mobile navigation."
  https://www.malwarebytes.com/blog/scams/2026/08/fake-apple-pay-charge-brings-the-classic-tech-support-scam-to-your-phone
• Cambodia-Focused Cluster Uses Multistage Infection Chain With Localized Lures
  "Acronis’ Threat Research Unit (TRU) identified a recent campaign focused on Cambodia. The analyzed archives, discovered while hunting for related activity, use several lure themes, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers. Cambodia has become an increasingly significant regional security and geopolitical focal point, with deepening China–Cambodia security cooperation and continued reporting of China-linked cyber activity targeting Cambodian organizations."
  https://www.acronis.com/en/tru/posts/cambodia-focused-cluster-uses-multi-stage-infection-chain-with-localized-lures/
  https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html

Breaches/Hacks/Leaks

• ATF Confirms “major Incident” After Recent Qilin Breach Claims
  "ATF, the regulatory agency that enforces federal laws governing firearms and explosives in the United States, has confirmed that one of its systems was compromised after breach claims made by the Qilin ransomware gang. This follows Qilin adding the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives to its dark web data leak portal on Wednesday, without saying whether it had stolen files from ATF's systems or demanded a ransom. The same day, the ATF published a press release saying that a standalone system was breached in what it described as a "major incident," which is now being investigated in collaboration with the Department of Justice."
  https://www.bleepingcomputer.com/news/security/atf-confirms-major-incident-after-recent-qilin-breach-claims/
  https://therecord.media/doj-atf-cyberattack-qilin-ransomware
• Manchester Airports Group Says Hackers Stole Travelers' Data
  "The Manchester Airports Group (MAG) disclosed that hackers breached its systems and stole customer data, including Wi-Fi sign-ups from Manchester, Stansted, and East Midlands airports. The intruder did not access customer payment details, and the attack had no impact on airport operations, the company said. A statement from the company today notes that the exfiltrated data also "relates to car park, lounge and Fast Track bookings." The list of compromised details includes customers' email addresses, phone numbers, vehicle registration numbers, and postcodes."
  https://www.bleepingcomputer.com/news/security/manchester-airports-group-says-hackers-stole-travelers-data/
  https://therecord.media/cyberattack-on-manchester-airports-group-exposes-millions-customer-info
  https://www.infosecurity-magazine.com/news/manchester-airports-data-breach/
• Carhartt Data Breach Exposes Information Of 12.9 Million Accounts
  "The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retailer giant Carhartt earlier this month, according to data breach notification service Have I Been Pwned. Founded in 1889, Carhartt is an American apparel company with workwear and streetwear manufacturing facilities in Kentucky and Tennessee and more than 3,000 employees in the United States and Europe."
  https://www.bleepingcomputer.com/news/security/carhartt-data-breach-exposes-information-of-129-million-accounts/
  https://haveibeenpwned.com/Breach/Carhartt
• Kidney Transplant Registry Hack Raises Safety Concerns
  "A Connecticut-based organization that helps facilitate organ transplants across the United States is latest healthcare victim of a cybercrime group. Experts say it's a prime example of how hackers don't care about the potential disruption to critical suppliers and ultimately the patients who depend on the services."
  https://www.bankinfosecurity.com/kidney-transplant-registry-hack-raises-safety-concerns-a-32672

General News

• AI Will Not Fix a Governance Problem In Your Camera Estate
  "Camera systems often outlive the companies that install them. In this Help Net Security interview, Rob Janssens, EMEA Cyber Security Director at Hikvision Europe, discusses what happens when the integrator is gone, the documentation is lost, and nobody holds the admin credentials. He explains why products should let customers recover control on their own, and how secure-by-default settings reduce the damage of predictable installation mistakes. He also weighs source code escrow, country-of-origin rules, and what evidence vendors can and cannot offer critical infrastructure operators."
  https://www.helpnetsecurity.com/2026/08/27/rob-janssens-hikvision-europe-surveillance-camera-security/
• The Best Human Hacking Team Still Out-Solved The Best AI Team
  "Bring an AI agent to a hacking competition and you would expect to find it propping up the teams who were struggling. In the 2026 Global Cyber Skills Benchmark, agents showed up in 17 of the Top 25 finishers. The people who least needed help were the ones who brought it. The people who might have used a hand mostly did not, and they did not close the gap. “Our data shows that AI is appearing most often alongside some of the strongest practitioners, not instead of them. As agents become more capable, human judgment, validation and hands-on technical skill become more important, not less,” said Haris Pylarinos, CEO of Hack The Box."
  https://www.helpnetsecurity.com/2026/08/27/ai-ctf-security-teams/
• The Hugging Face Incident And The Road Ahead
  "In July 2026, during internal cybersecurity evaluations, OpenAI models circumvented controls designed to isolate them from the internet and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems⁠. The incident occurred during cybersecurity evaluations of several OpenAI models, and was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‑5.6 Sol. The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks—they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems."
  https://openai.com/index/hugging-face-incident-and-the-road-ahead/
  https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face Incident-Technical-Report.pdf
  https://www.bleepingcomputer.com/news/security/nearly-700-rogue-ai-agents-coordinated-in-the-hugging-face-attack/
  https://thehackernews.com/2026/08/openai-says-reward-hacking-drove-ai.html
  https://www.infosecurity-magazine.com/news/openai-hugging-face-warning-shot/
  https://www.securityweek.com/openai-agents-coordinated-via-makeshift-message-board-ahead-of-hugging-face-hack/
• Australia Arrests Alleged TeamPCP Hackers Behind Supply-Chain Attacks
  "Australian authorities have arrested and charged two young men accused of being part of the TeamPCP hacking group linked to a string of far-reaching developer supply chain attacks. TeamPCP is a hacking group known for widespread supply-chain attacks over the past year that targeted open-source software and developer platforms to steal credentials, authentication secrets, and source code. High-profile attacks attributed to TeamPCP have impacted Trivy, LiteLLM, Telnyx, SAP, and TanStack packages, while the group has also breached the European Commission, Mistral AI, OpenAI, and GitHub."
  https://www.bleepingcomputer.com/news/security/australia-arrests-alleged-teampcp-hackers-behind-supply-chain-attacks/
  https://thehackernews.com/2026/08/alleged-teampcp-hackers-charged-in.html
  https://therecord.media/australia-teampcp-hackers-arrested
  https://www.bankinfosecurity.com/two-australian-men-charged-in-teampcp-supply-chain-attacks-a-32675
  https://cyberscoop.com/teampcp-cybercrime-arrests-supply-chain-attacks/
  https://securityaffairs.com/197929/security/two-arrests-one-supply-chain-attack-and-a-lot-of-stolen-credentials.html
  https://www.securityweek.com/australia-arrests-2-alleged-teampcp-hackers/
  https://www.helpnetsecurity.com/2026/08/27/alleged-teampcp-hackers-arrested-australia/
• A Call For Collective Action On Cyber Defense
  "We have a limited window to strengthen cyber defenses. In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable. The companies and public services our communities depend on—from hospitals to water treatment plants to the infrastructure that powers the internet—are at risk. Today’s AI advances are already giving defenders new ways to fix weaknesses that have accumulated for years. If we act decisively, we can use the defenders’ window to make our digital world much more secure."
  https://openai.com/collective-cyberdefense/
  https://cyberscoop.com/ai-cyber-defense-global-surge/
• 'HTTP Terminator' Hunts For Novel Desync Attacks
  "James Kettle wanted to find out if AI tools could go beyond finding new vulnerabilities and actually develop new attack techniques and exploits — so he built a Terminator. An "HTTP Terminator," to be exact. And as scary as the open source tool may sound, it worked — HTTP Terminator autonomously developed novel desync attacks, also known as HTTP request smuggling, that successfully hacked into real enterprise websites, including those of several financial services companies."
  https://www.darkreading.com/application-security/http-terminator-hunts-novel-desync-attacks
• CISO Conversations: Chris Wheeler – Trust Is The Job, From The Navy To The C-Suite
  "Chris Wheeler is the CISO at Resilience. He has a long history in cybersecurity: a threat researcher and analyst at Efflux Systems and then threat analytics manager at Arbor Networks. He joined Resilience as threat intelligence lead but left in 2020 to become VP and SOAR lead at Morgan Stanley. He returned to Resilience four years later, first as VP of information security, and subsequently CISO. It is fair to suggest he has security in his blood. His father was a university IT administrator. “He was always kind of tinkering with these different systems, and I inherited the same kind of curiosity and interest in information technology.”"
  https://www.securityweek.com/ciso-conversations-chris-wheeler-trust-is-the-job-from-the-navy-to-the-c-suite/
• The Future Of AI-Driven Security Depends On Complete Data
  "I’ve always been drawn to investigative documentaries — the kind where detectives reconstruct an entire crime from fragments of evidence. The breakthrough never comes from a single clue. It comes from connecting everything: movements, relationships, timing, and intent. Miss one piece and the case stalls, or worse, you chase the wrong suspect. Cybersecurity works the same way."
  https://www.securityweek.com/the-future-of-ai-driven-security-depends-on-complete-data/
• Russian Hackers Phish EU Officials Over Messaging Apps
  "The European Union (EU) confirmed that state-sponsored hackers have been spear-phishing government officials on popular messaging apps rather than email. Nation-state advanced persistent threats (APTs) commonly socially engineer their nation-state targets over email, impersonating quotidian business to trick targets into opening malicious websites or attachments. Yet email is where most employees expect malicious messages to come from. Messaging apps don't carry the same reputation, and encrypted ones — like WhatsApp and Signal in particular — add an extra sheen of trusted security."
  https://www.darkreading.com/cyberattacks-data-breaches/russian-hackers-phish-eu-officials-messaging-apps

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• CISA: Over 100 Internet-Exposed Water Systems Targeted In July Cyberattacks
  "The Cybersecurity and Infrastructure Security Agency (CISA) says it’s aware of 100 internet-exposed water systems targeted in cyberattacks in July. The information was shared as part of guidance released by CISA to help organizations reduce the internet exposure of systems that could be targeted by threat actors. “In July 2026, CISA observed malicious cyber activity targeting over 100 internet-exposed systems in the Water and Wastewater Systems (WWS) Sector, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem,” CISA noted."
  https://www.securityweek.com/cisa-over-100-internet-exposed-water-systems-targeted-in-july-cyberattacks/
  https://www.cisa.gov/resources-tools/resources/exposure-reduction
  https://www.bankinfosecurity.com/attackers-targeted-over-100-us-water-systems-in-july-hacks-a-32659

Vulnerabilities

• Wordfence Argus Finds Complex 6 Step Critical RCE In Avada Theme With 1 Million Sales
  "A year ago we wrote that we’d put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted reports to our bug bounty program had gone from 16% to about two-thirds of everything we received, and it wasn’t slowing down. As we continue to see AI driven innovation in cybersecurity, the Wordfence team continues to accelerate our own pace of AI enabled innovation. PRISM, our autonomous research agent, is now the most prolific researcher we have, with over 300 vulnerabilities to its name and the top spot on our leaderboard over the last 30 days."
  https://www.wordfence.com/blog/2026/08/wordfence-argus-finds-complex-6-step-critical-rce-in-avada-theme-with-1-million-sales/
  https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/
• Ubiquiti Patches Three Max Severity Security Vulnerabilities
  "Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges. The first (tracked as CVE-2026-77537) lets unauthenticated attackers compromise unpatched devices by exploiting an improper input validation weakness in the UniFi Protect Application video surveillance management platform. Ubiquiti also addressed a CRLF injection flaw (CVE-2026-77550) that remote attackers without privileges can exploit to bypass authentication on UniFi OS devices or instances."
  https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-security-vulnerabilities/
  https://cyberscoop.com/ubiquiti-unifi-critical-vulnerabilities-patched/
• Adobe And Nvidia Patch Dozens Of Vulnerabilities
  "Adobe and Nvidia on Tuesday announced patches for dozens of vulnerabilities affecting their products, including flaws rated critical severity."
  https://www.securityweek.com/adobe-and-nvidia-patch-dozens-of-vulnerabilities/
• Chrome 152 Patches Over 300 Vulnerabilities
  "Google on Tuesday announced the release of Chrome 152, with patches for more than 300 vulnerabilities, the majority of which were discovered internally using AI. Ten vulnerabilities have been assigned a critical severity rating. Most are use-after-free issues in components such as Angle, Aura, Chromecast, Views, and SafeBrowsing. Sixty-one flaws have been rated as high severity, while the rest have medium or low severity."
  https://www.securityweek.com/chrome-152-patches-over-300-vulnerabilities/
  https://www.malwarebytes.com/blog/bugs/2026/08/update-chrome-before-you-browse-again
• Not Another Log4Shell: A Serialized-Event Receiver Boundary
  "An upstream report raised an alarming possibility: a class filter around Log4j2’s Java-serialized event receiver could approve an outer event and still lose control of what was deserialized inside it. The report then disappeared before final vendor guidance was available, leaving two bad options: dismiss an unverified claim, or repeat the phrase “Log4j RCE” without knowing what it actually applied to. We chose a third option. Pruva reconstructed the boundary, exercised the real Apache sample TCP receiver, and ran the same network input against vulnerable and controlled targets. The result was receiver-side command execution in two fresh JVMs. It was also much narrower than the phrase “the next Log4Shell” suggests."
  https://www.pruva.dev/research/log4j2-serialized-event-filter-boundary
  https://www.pruva.dev/reproductions/REPRO-2026-00338
• CISA Adds Six Known Exploited Vulnerabilities To Catalog
  "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability
  CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
  CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability
  CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
  CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability
  CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog
• New GPUThor Attack Defeats NVIDIA ECC Protection For Root Access
  "A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service (DoS) and root-level privilege escalation. In a paper published by the University of Toronto, researchers say that GPUThor achieves far more practical bit-flip rates than past concepts like their own GPUHammer or GPUBreach, which became irrelevant after ECC was introduced. The attack was demonstrated against Ampere-class NVIDIA workstation GPUs with GDDR6 memory, including the RTX A4000, RTX A4500, RTX A5000, and RTX A6000, all widely used in AI and cloud infrastructure."
  https://www.bleepingcomputer.com/news/security/new-gputhor-attack-defeats-nvidia-ecc-protection-for-root-access/
  https://gururaj-s.github.io/assets/pdf/CCS26_GPUThor.pdf
  https://gputhor.com/
• Remote Code Execution And Arbitrary File Read Vulnerabilities In Kaltura Servers
  "The Kaltura HTML5 Player Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable mwEmbedLoader.php endpoint. Until a vendor patch is available, users are advised to restrict access to the affected endpoint or disable it entirely."
  https://www.kb.cert.org/vuls/id/308749
  https://thehackernews.com/2026/08/unpatched-kaltura-mwembed-flaws-could.html
• Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations In Tests
  "Aikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs. The original incident was first reported by ABC News on August 10, based on chat logs and screenshots the user supplied. He had asked an OpenClaw agent running Opus 4.6 to book him into a gym class. The agent booked sessions months beyond the window the site allowed."
  https://thehackernews.com/2026/08/claude-opus-46-bypasses-gym-booking.html

Malware

• Tortoiseshell: New Toolset And Operational Infrastructure Exposed
  "Group-IB Threat Intelligence began investigating Tortoiseshell activity following public reporting by Kaspersky (Securelist). Through enrichment of the reported indicators and our own hunting rules, we identified additional infrastructure, broader targeting, and previously unreported malware samples associated with the group. Tortoiseshell is an Iranian-linked threat actor that has been active since at least 2018, primarily targeting defence, aerospace, IT service providers, and military organisations in the Middle East and the United States. The group is known for its use of supply chain compromises, watering hole attacks, fake recruitment websites, and custom backdoors, and has been linked to operations supporting Iran’s Islamic Revolutionary Guard Corps (IRGC)."
  https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/
  https://thehackernews.com/2026/08/nimbus-manticore-expands-toolset-with.html
  https://therecord.media/iran-linked-hackers-expand-infrastructure-europe-middle-east
  https://www.infosecurity-magazine.com/news/tortoiseshell-new-backdoor-ssh/
• Beware Of Fake Indeed Interview Apps Used To Install Spyware
  "From several independent reports, we’ve seen evidence of scammers using fake Android “interview” apps to target job seekers on the Indeed platform. Indeed is one of the world’s largest employment websites, giving scammers access to a huge pool of potential victims, especially in a competitive job market."
  https://www.malwarebytes.com/blog/scams/2026/08/beware-of-fake-indeed-interview-apps-used-to-install-spyware
• Hackers Target Microsoft SharePoint RCE Chain With PoC Exploit
  "Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused. The first (tracked as CVE-2026-55040) is an authentication bypass flaw in the JWT token validation pipeline that attackers without privileges can exploit to perform operations as a SharePoint site user or administrator. The second (CVE-2026-63520) is a vulnerability in SharePoint's Business Connectivity Services (BCS) that unauthenticated attackers can chain after successfully exploiting CVE-2026-55040 for remote code execution (RCE) on a targeted SharePoint Server."
  https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit/
• Dark Caracal Reloaded: New Malware, Same Hunting Grounds
  "In June 2026, Arctic Wolf Labs investigated a targeted intrusion affecting a communications organization in Venezuela. We assess with medium confidence that this activity is linked to Dark Caracal, a cyberespionage group associated with Lebanon’s General Directorate of General Security (GDGS) that has historically targeted governments, businesses, journalists, and activists. The intrusion used delivery methods consistent with the SVG-based Dark Caracal campaign previously documented by Kaspersky, but the malware deployed after initial access was different. Arctic Wolf Labs identified a previously undocumented, modular Go-based framework that we call GoCaracal, deployed alongside an updated variant of Bandook."
  https://arcticwolf.com/resources/blog/dark-caracal-reloaded-new-malware-same-hunting-grounds/
  https://www.darkreading.com/cyberattacks-data-breaches/dark-caracal-adds-new-malware-cyber-espionage-arsenal
• Insights Into Suspected DPRK Workers: Red Flags To Look Out For
  "North Korean workers (sometimes referred to as FAMOUS CHOLLIMA) have significantly improved and increased their activity over the past few years. These actors will pretend to be legitimate workers, apply for remote positions at companies, and once hired and onboarded funnel wages back to the North Korean regime in an effort to help North Korea generate revenue while evading international sanctions. Some public reports also cite DPRK workers infiltrating companies to exfiltrate data, deploy malware, or extort their employers once discovered."
  https://www.huntress.com/blog/huntress-dprk-remote-worker-investigation
  https://www.darkreading.com/insider-threats/red-flags-expose-fake-north-korean-it-workers
• NovaCookies At Scale: Inside The $320 Phishing Service Targeting Hundreds Of Organizations
  "Advertised at $320 a month, NovaCookies packages real-time Microsoft 365 session theft as a subscription phishing service. Campaign artifacts reviewed across our research sources show hundreds of organizations targeted across multiple regions, while the service’s infrastructure expanded sharply from mid-May and continued appearing through August 2026. Nearly 90% of the organizations in the reviewed set were associated with lures hosted on .vu domains. A companion IOC release documents 755 domains assessed as dedicated malicious infrastructure."
  https://www.island.io/blog/novacookies-at-scale-inside-the-320-phishing-service-targeting-hundreds-of-organizations
  https://thehackernews.com/2026/08/novacookies-campaigns-abuse-genuine.html
  https://www.darkreading.com/endpoint-security/novacookies-steals-microsoft-365-sessions-320-a-month
• ModeloRAT Malware: How The CrashFix Campaign Delivers a Python RAT
  "ModeloRAT is a Python-based Windows Remote Access Trojan first observed in January 2026, delivered only to domain-joined hosts in enterprise environments where a single foothold opens the way to Active Directory and lateral movement. It arrives as the final payload of the CrashFix campaign, which starts with a malicious Chrome extension named NexShield that crashes the victim's browser on purpose, then displays a fake repair prompt that talks the user into running an attacker-supplied command [1]. In this blog, we explain how ModeloRAT works and how to validate your security controls against this malware."
  https://www.picussecurity.com/resource/blog/modelorat-malware-how-the-crashfix-campaign-delivers-a-python-rat
• ‘The Gentlemen’ Profile: Why This Ransomware Group Wants In Before It Locks You Out
  "The Gentlemen is a financially motivated ransomware group that combines data theft with encryption to increase pressure on victims. They first came onto the threat scene in July 2025. Rather than relying on encryption alone, the group exfiltrates sensitive business data before locking files, leaving organizations to deal with both operational disruption and the risk of stolen information being exposed."
  https://www.bitsight.com/blog/the-gentlemen-ransomware-group-threat-actor-deep-dive

Breaches/Hacks/Leaks

• An ID Check Breach Timeline: 2011–2026
  "Every year, more of the internet demands that you prove who you are before you may use it: KYC checks to open an account, a driver’s license to join a dating app, a passport scan to check into a hotel, a face scan to read an adult site in the UK, a government ID to appeal a Discord ban. Every one of those checks creates a copy of the most permanent data you have. This timeline compiles what happened to those copies. We found 88 publicly documented incidents since 2011 in which data collected specifically to verify identity or age – government ID scans, verification selfies, biometric templates, KYC files, national ID registries – was breached, exposed, or put up for sale."
  https://www.mysteriumvpn.com/blog/data-and-research/id-check-breach-timeline
  https://securityaffairs.com/197855/reports/88-id-verification-breaches-show-the-cost-of-collecting-identity-data.html
• Boston Scientific Says Cyberattack Disrupted Operations Globally
  "Medical technology company Boston Scientific has been targeted in a cyberattack that disrupted some of its IT systems, causing operational disruptions globally. The company detected the incident on August 25 and says in an announcement today that it caused a network outage and "impacted access to certain operating systems and business applications, including the ability to process and ship customer orders." After identifying the intrusion, Boston Scientific activated its incident response procedures and contracted external cybersecurity experts to investigate the impact and help with containment efforts."
  https://www.bleepingcomputer.com/news/security/boston-scientific-says-cyberattack-disrupted-operations-globally/
  https://therecord.media/boston-scientific-cyberattack-disrupts-shipment-processes
  https://www.bankinfosecurity.com/cyberattack-disrupts-boston-scientifics-global-operations-a-32660

General News

• SOC Threat Radar — August 2026
  "CVE-2026-0257 is a vulnerability affecting Palo Alto’s OS-agnostic GlobalProtect services. Successful exploitation could allow an attacker to bypass normal authentication controls, establish a VPN session as if they were a legitimate user, gain access to internal resources reachable through the VPN, and create a foothold for further activity such as reconnaissance, credential theft or lateral movement. Barracuda Managed XDR’s SOC team has detected two waves of inbound scanning activity originating from known attacker infrastructure and targeting publicly exposed GlobalProtect services in Belgium. The attackers are likely to be probing for vulnerable or unpatched systems following public disclosure of the CVE."
  https://blog.barracuda.com/2026/08/26/soc-threat-radar-august-2026-remote-access-threats
• Production Data In Testing Is Still Common, And Tricentis’ CISO Wants It Gone
  "In this Help Net Security interview, Erika Dean, CISO at Tricentis, talks about keeping production data out of test environments and why she thinks the alternatives are good enough now. She explains how her team caught a prompt injection gap in red-teaming and held a release for a week until it was fixed. Dean describes what gets an AI vendor rejected, mostly vague answers about where data lives and how long it is kept. She also lists three things a small security team should build first, even with limited headcount."
  https://www.helpnetsecurity.com/2026/08/26/erika-dean-tricentis-production-data-in-testing/
• AI Vulnerability Discovery Scores The Highest Impact Of 20 Emerging Risks
  "Risk managers, auditors and senior executives at 316 companies spent April and May ranking 20 threats they have not yet felt. AI discovery of cyber vulnerabilities came back first, according to Gartner. Three months earlier the same quarterly survey put information integrity risk at the top and left AI vulnerability discovery out of the top five. Two things changed underneath that number. AI systems scan for previously unknown flaws at a volume no patching team can absorb, and the step from finding a flaw to holding working attack code has shrunk to close to nothing. Writing the exploit used to be the part that kept most attackers out. It no longer is. A defender inherits a backlog of unpatched critical vulnerabilities growing faster than it can be cleared, inside systems that AI integration has made harder to see into."
  https://www.helpnetsecurity.com/2026/08/26/ai-vulnerability-discovery-emerging-risks/
• CISA Vulnerability Review
  "Most compromises do not rely on advanced techniques or cutting-edge tools. Cyber threat actors scan the internet looking for exposed, well-known software vulnerabilities to exploit. Basic security failures enable most compromises and organizations can reduce their risk by addressing these underlying weaknesses and prioritizing vulnerabilities for action based on the risk they pose. The CISA Vulnerability Review provides organizations with critical insights into the root causes of insecure software and practical steps they can take to address these flaws to prevent exploitation. Analyzing CISA and open source data from fiscal years 2024 and 2025, the review establishes a baseline of today’s vulnerability landscape before AI-enabled vulnerability discovery becomes more widespread."
  https://www.cisa.gov/resources-tools/resources/cisa-vulnerability-review
  https://www.cisa.gov/sites/default/files/2026-08/cisa-vulnerability-review-fy-2024-2025.pdf
  Justice Department And FBI Seize Platforms Operated And Used By China State-Sponsored Hackers * To Target U.S. Critical Infrastructure
  "The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter. Among the victims of QTFY computer intrusion activity are the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health, and the U.S. Senate."
  https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-platforms-operated-and-used-china-state-sponsored-hackers
  https://www.bleepingcomputer.com/news/security/fbi-disrupts-proxy-network-enabling-chinese-espionage-operations/
  https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html
  https://therecord.media/qscan-qtrouter-us-takedown-alleged-china-hacking-tools
  https://www.bankinfosecurity.com/fbi-doj-seize-chinese-hacker-infrastructure-on-us-soil-a-32658
  https://cyberscoop.com/qtfy-china-espionage-group-infrastructure-seized/
  https://securityaffairs.com/197873/apt/fbi-seizes-china-linked-hacking-platforms-qscan-and-qtrouter-used-against-critical-infrastructure.html
• German Industry Reports Escalating Nation-State Cyberattacks
  "German businesses are increasingly under attack from hackers with links to foreign intelligence services, according to a major new study from digital industry association Bitkom. And that shift is clouding businesses' visibility into their own vulnerability. Bitkom's research arm polled over a thousand companies with 10 or more employees and annual German revenues of at least a million euros, and found that almost all - 96% - had either definitely or likely been affected by data theft, industrial espionage or sabotage in the last year."
  https://www.bankinfosecurity.com/german-industry-reports-escalating-nation-state-cyberattacks-a-32657
• Understanding Browser Trust Abuse: Exploiting Enterprise’s Most Trusted Interface
  "The biggest change in browser-related threats is not a new flaw in browser software. It is a shift in how threat actors operate. Instead of breaking into the browser, they increasingly trick the people using it by exploiting the trust employees place in familiar browser experiences and workflows. By mimicking legitimate login screens, software update prompts, authentication requests, and security checks that people see every day, threat actors persuade users to disclose credentials, grant access to their computers, or install malware. As a result, any browser-enabled device can become a target, making browser patching alone insufficient to prevent these attacks."
  https://cofense.com/blog/understanding-browser-trust-abuse-exploiting-enterprise-s-most-trusted-interface
• Four In Five AI Tools Run With No IT Oversight, New Research Finds
  "Security researchers have warned that major gaps in IT oversight, surging numbers of published vulnerabilities, and MCP security risks are making the AI agent ecosystem increasingly risky. AI security vendor Reco analyzed anonymized platform telemetry from large enterprises, publicly available Model Context Protocol servers, and vulnerability disclosures from the National Vulnerability Database to compile its report, The State of Agent Security 2026. It found that 80% of AI tools operate with no oversight, while in SMBs, there are an estimated 414 unsanctioned tools per 1000 employees."
  https://www.infosecurity-magazine.com/news/four-in-five-ai-tools-no-it/
  https://www.reco.ai/state-of-agent-security-2026-form
• Average Cyber Insurance Losses Increase Despite Fewer Claims
  "The average cost of cybersecurity insurance claims made by large and middle-market companies surged in 2025, despite a significant drop in the volume of claims, according to Chubb’s 2026 Cyber Claims Report. The insurer said the growing severity of claims in the US has been largely driven by the increasing cost of both data breach and privacy-related litigation, alongside rising business interruption expenses. In the US, the average cost of claims rose by 22% for middle-market firms in 2025 compared to 2024, while for large companies, an enormous 100% rise was observed."
  https://www.infosecurity-magazine.com/news/cyber-insurance-losses-increase/
• Exploits And Vulnerabilities In Q2 2026
  "The vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of vulnerabilities emerging, particularly in the Linux networking subsystem. Second, security researchers have been publishing exploits for unpatched vulnerabilities more frequently. Publications like these can generate significant fallout, since they potentially open the door for attackers to target unprotected systems."
  https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/
• The MFA Identity Trap: When Authentication Creates a False Sense Of Security
  "Multi-factor authentication (MFA) has become one of cybersecurity’s most important controls. Roughly 70% of enterprise workforce users are now protected by it. But its success has created an unintended problem. Organizations increasingly treat successful authentication as proof of identity. They assume that because someone passed MFA, they have verified who that person is. They may also assume that the identity itself has not been compromised. Neither is it necessarily true."
  https://www.securityweek.com/the-mfa-identity-trap-when-authentication-creates-a-false-sense-of-security/
• Software Supply Chain Security Requires Decisions Rather Than Defaults
  "A bridge stays in service for fifty years on a fixed inspection schedule, load-tested and maintained the entire time. A jet engine flies the same design for decades under continuous regulatory oversight. In most engineering disciplines, a stable, proven design paired with active maintenance is the goal. Newer designs are treated with far more scrutiny, because they’ve never been truly tested. But for some reason, in software engineering, the opposite is true. The newest release is treated as the safest. And that instinct has backfired badly in the past. A backdoor sat inside two specific releases of xz-utils, versions 5.6.0 and 5.6.1, planted by an infiltrator who’d spent two to three years plotting up release authority."
  https://www.aikido.dev/blog/software-supply-chain-security-decisions-not-defaults
• Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense
  "Mexico faces an increasingly complex cyber threat landscape, including ransomware, state-sponsored espionage, financial malware, data breaches, hacktivism, and cyber-enabled organized crime. Its 2025–2030 National Cybersecurity Plan seeks to address these challenges through stronger governance, new legislation, a national operations center, integrated incident-response teams, cyber exercises, AI-enabled defenses, and expanded regional cooperation. Insikt Group assesses ransomware as the leading threat while highlighting growing risks from foreign threat actors and credential theft. We recommend leveraging threat intelligence, applying international security frameworks, and fostering cyber education. Ultimately, Mexico’s progress will depend on turning an ambitious roadmap into durable institutions, effective regulation, and sustained international cooperation."
  Priority: 3 - Important
  Relevance: General
  https://www.recordedfuture.com/blog/mexico-cybersecurity-plan

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Healthcare Sector

• MyChart Portal Phishing Scams Target Patients Nationwide
  "Dozens of U.S. healthcare systems are warning patients about potential email phishing, text and phone scams involving their MyChart patient portals. Electronic health record vendor Epic, the maker of MyChart, has also issued a public warning about the threats. The phishing campaigns involve fraudsters using the MyChart name and logo to appear legitimate in their scam messages. The communications promise the patients a "2026 MyChart Senior Health Package," Medicare wellness benefits, a free health kit or other gifts when recipients "claim their reward" by clicking a link, confirming an address or providing other personal information."
  https://www.bankinfosecurity.com/mychart-portal-phishing-scams-target-patients-nationwide-a-32651

Industrial Sector

• Siemens SIMATIC IoT2050 Advanced
  "SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges. Siemens has released a new version for SIMATIC IoT2050 Advanced and strongly recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-03
• Ebyte NE2-D11
  "Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized administrative access, disclose sensitive information, modify device configuration, hijack authenticated sessions, and disrupt device operation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06
• Zoneminder
  "Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02
• PayRange API
  "Successful exploitation of this vulnerability could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify the device to cause a denial of service, or alter a devices displayed image."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-04
• FURUNO FA-50 Class B AIS Transponder
  "Successful exploitation of these vulnerabilities could allow an attacker to alter device settings."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-07
• Threat Landscape For Industrial Automation Systems. Q2 2026
  "In this section, we examine the most significant changes to indicators over the quarter, broken down by region and industry. Further diagrams can be found in the relevant chapters of the “Statistics across all threats” section."
  https://ics-cert.kaspersky.com/publications/reports/2026/08/25/threat-landscape-for-industrial-automation-systems-q2-2026/
• Rently Smart Home
  "Successful exploitation of this vulnerability could allow an attacker to access sensitive information and override user permissions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-01
• Bendix EC80 Brake ECU
  "Successful exploitation of these vulnerabilities could allow an attacker to cause the loss of ABS functions, steering assist, speedometer, shifting capabilities, or disable automatic traction control."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05

New Tooling

• HOL Guard: Open-Source Antivirus For AI Agents
  "HOL Guard is a free, open-source tool that sits between an AI assistant and the computer it runs on. When the assistant tries something risky, the tool pauses it and asks you first. It installs in about a minute, runs on your own machine, and a typical check takes under 50 milliseconds. Your files are never uploaded, and the whole thing works with no internet connection. The people exposed here are anyone using Claude Code, Cursor, Codex, Gemini CLI, OpenCode, Hermes, or OpenClaw."
  https://www.helpnetsecurity.com/2026/08/25/hol-guard-open-source-antivirus-ai-agents/
  https://github.com/hashgraph-online/hol-guard

Vulnerabilities

• Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute In Edit Mode
  "Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record. The CNA record says the command can run as a local subprocess when the notebook is opened in edit mode. The vulnerability, tracked as CVE-2026-75149, is a code injection issue affecting versions prior to 0.23.15. VulnCheck's CVE Numbering Authority (CNA) record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required."
  https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-60004 Gitea Code Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/08/25/cisa-adds-one-known-exploited-vulnerability-catalog
• Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning
  "A vulnerability in NVIDIA NemoClaw, a tool that deploys the OpenClaw AI agent, can hand an attacker full, unauthenticated control over the local model server that powers the agent and silently plant instructions inside the model. A single visit to an attacker-controlled webpage is all it takes to give the attacker these capabilities. NemoClaw deploys inside NVIDIA OpenShell sandboxes with local inference via Ollama. Oasis Security discovered the vulnerability as part of ongoing research into non-human identity and AI agent risks."
  https://www.cyera.com/research/nemoclaw-one-website-visit-to-hijack-your-ai-agent
  https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
  https://www.darkreading.com/cyber-risk/nemo-claw-networking-llm-poisoning-openclaw
• Vulnerability In GNU Wget Software
  "CERT Polska has received a report about vulnerability in GNU wget software and participated in coordination of its disclosure. The vulnerability CVE-2026-16599: GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation."
  https://cert.pl/en/posts/2026/08/CVE-2026-16599/

Malware

• ClickFix Phishing Pages Discovered In 24 Npm Packages
  "The OX Research team is tracking a fake Cloudflare campaign being distributed on the npm registry: Our research found a total of 24 packages containing the same HTML page, with each package usually reaching between 50-300 weekly downloads before it gets removed. But downloading and installing such a package to a machine doesn’t do any harm, so why do we bother researching it? While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn’t do harm, the threat actor’s use of npm isn’t to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware."
  https://www.ox.security/blog/research-clickfix-phishing-npm-packages/
  https://thehackernews.com/2026/08/24-npm-packages-abuse-unpkg-mirrors-to.html
  https://www.bleepingcomputer.com/news/security/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages/
• Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain
  "The SOCRadar Threat Research Unit (STRU) has conducted an “inside-out” analysis of AnonyMousKIT, an AI-powered Phishing-as-a-Service (PhaaS) ecosystem specifically engineered to disable Apple’s Activation Lock on stolen devices. Operating as a credit-metered platform, AnonyMousKIT automates credential harvesting through a sophisticated multi-channel pipeline – integrating email, SMS, and WhatsApp with advanced conversational AI agents to conduct AI-driven Automated Social Engineering (voice phishing) calls. By leveraging a critical flaw – the use of bare relative paths – the investigation unraveled a reseller supply chain of 506 domains and 168 storefront brands active since early 2024. Despite leveraging advanced AI to mimic “Apple Support,” basic coding errors exposed production logs and operator rosters."
  https://socradar.io/blog/anonymouskit-ai-phaas-supply-chain/
  https://www.bleepingcomputer.com/news/security/anonymouskit-phaas-uses-voice-ai-agents-to-phish-iphone-passcodes/
• Massive DDoS Attack Disrupts Norway’s Government Digital Services
  "A large distributed denial-of-service (DDoS) attack has disrupted Norway’s shared government digital infrastructure since Monday, affecting services used by the public sector. The attack started at 03.38 CEST on Monday and has targeted the infrastructure supporting services operated by the Norwegian Digitalization Agency, Digitaliseringsdirektoratet (Digdir), and its operations provider, Vivicta. Digdir operates Norway’s shared digital government infrastructure, including public-service logins, electronic IDs and signatures, secure digital mail, government forms, public-record access, and data exchange between agencies."
  https://www.bleepingcomputer.com/news/security/massive-ddos-attack-disrupts-norways-government-digital-services/
  https://therecord.media/norway-cyberattack-ddos-government
  https://securityaffairs.com/197826/cyber-warfare-2/norway-s-digital-government-infrastructure-hit-by-a-new-ddos-attack.html
• Check Point Blocks Large-Scale Debt-Relief Email Phishing Campaign Targeting More Than 9,000 Organizations
  "Check Point has identified and blocked a large-scale email phishing campaign using fraudulent financial hardship and debt-relief offers to manipulate recipients into calling attacker-controlled phone numbers. Over the past 14 days, Check Point observed approximately 24,700 emails associated with the campaign targeting users across more than 9,000 organizations, demonstrating both the scale of the operation and the continued evolution of phishing beyond malicious links and attachments. The campaign underscores a growing enterprise risk: phishing no longer needs an obvious malicious link, attachment, or spoofed sender to be effective. Attackers are turning routine-looking email into the entry point for trusted conversations that take users beyond traditional controls."
  https://blog.checkpoint.com/securing-user-and-access/check-point-blocks-large-scale-debt-relief-email-phishing-campaign-targeting-more-than-9000-organizations/
• An Invisible HTML Payload Silently Hijacked Every Email Summarizer Run
  "Indirect prompt injection has moved from academic exercise to field-deployed threat. Forcepoint X-Labs previously demonstrated how multi-agent email pipelines can be manipulated through PromptSpy and identified real IPI attacks in the wild. This post presents a measured laboratory proof of concept: we isolated a single email summarizer running an unguarded LLM pipeline, embedded a hidden prompt injection payload using common HTML concealment techniques, and ran both benign and injected emails through the system with pre-registered success criteria. The results confirm that indirect prompt injection can silently hijack summarizer output without signaling tampering to the reader."
  https://www.forcepoint.com/blog/x-labs/html-payload-hijacks-email-summarizer
  https://www.darkreading.com/cyber-risk/hidden-prompts-trick-ai-false-email-summaries
• ZeroTokens: Phishing Platform Gives Operators Real-Time Control Of Attack Flow
  "ZeroTokens is a phishing platform built for financial institution impersonation at significant scale, combining reusable infrastructure with institution-specific verification sequences across dozens of financial brands. ZeroTokens operates less like a conventional phishing kit and more like a scam call center running through the target’s browser. A human operator watches each session unfold, sees information as the target enters it, and decides which prompt appears next. In parallel, the operator can use that information in a separate session with the genuine financial institution, coordinating the two interactions in near real time without proxying the bank."
  https://abnormal.ai/blog/zerotokens-real-time-phishing-platform
  https://www.infosecurity-magazine.com/news/zerotokens-phishing-real-time/
• Extended Rapid Response: Zimperium Identifies RecruitTrap Recruit Scams Are Targeting Enterprise Credentials On Mobile
  "The recent research on The Growing Threat of Browser-in-the-Browser (BitB) Recruitment Scams highlights an escalating trend in social engineering: threat actors impersonate real HR personnel across multiple well-known companies to execute highly convincing, interview-themed phishing attacks. By scraping public profile data, attackers craft hyper-realistic scheduling flows designed to bypass traditional user skepticism. While desktop users encounter a simulated popup browser window (BitB), mobile devices present a unique vulnerability. On smaller screens, the attack automatically adapts, replacing the BitB frame with a full-screen counterfeit login page. Without traditional desktop browser chrome or visible URL bars, mobile victims have virtually no visual indicators to distinguish a fake login from a legitimate OAuth prompt."
  https://zimperium.com/blog/extended-rapid-response-zimperium-identifies-recruittrap-recruit-scams-are-targeting-enterprise-credentials-on-mobile
  https://www.infosecurity-magazine.com/news/fake-recruiter-scams-corporate/
• Mirage2FA Surge Hits 4,500 US And EU Companies, Abusing Microsoft 365 Login Flows
  "Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication. According to ANY.RUN research, 48% of targeted email addresses were potentially compromised. Most of the affected companies are US-based."
  https://thehackernews.com/2026/08/mirage2fa-surge-hits-4500-us-and-eu.html
• SLEEPWALKER: A Passive Backdoor With Its Own Command Language
  "Losing access to VirusTotal Intelligence at the start of the year was surprisingly productive. Unable to hunt for interesting new malware, I stopped adding to my “TODO” pile and finally worked through my backlog from last year. That led to a detailed examination of BeheMOF as well as the discovery of this malware. Upon closer inspection, a sample that did not seem too noteworthy at first turned out to have a distinctive design once I looked under the hood: a passive backdoor that opens no obvious listening port and carries no payload inside itself. It waits in memory doing nothing at all until one specifically crafted network packet reaches the machine, which is why I am calling it SLEEPWALKER."
  https://r136a1.dev/2026/08/24/sleepwalker-a-passive-backdoor-with-its-own-command-language/
  https://www.theregister.com/security/2026/08/24/you-dont-want-this-sleepwalker-backdoor-on-your-windows-machine/5292021

Breaches/Hacks/Leaks

• LACMA Data Breach Last Year Exposed Social Security And Medical Data
  "The Los Angeles County Museum of Art (LACMA) has announced that a breach last year exposed customer and employee information. The museum says that on July 11, 2025, it detected suspicious activity on its systems that had started four days earlier. A month later, the investigation confirmed that the network was compromised. At the time, the type of exposed data could not be determined, and the first results of the investigation became available in late February 2026."
  https://www.bleepingcomputer.com/news/security/lacma-data-breach-last-year-exposed-social-security-and-medical-data/
• Hospital Operator Nutex Health Says Data Stolen In Cyberattack
  "Healthcare and services provider Nutex is investigating a data breach incident where an unauthorized third party exfiltrated information from company servers. The organization has disclosed the cyberattack in a filing with the U.S. Securities and Exchange Commission (SEC), noting that the stolen data includes details that may be private or confidential. “Based on preliminary findings from the Company’s ongoing investigation, the Company believes that certain information maintained on the Company’s servers was accessed and exfiltrated by an unauthorized third party, including some information that may be private and/or confidential,” Nutex says."
  https://www.bleepingcomputer.com/news/security/hospital-operator-nutex-health-says-data-stolen-in-cyberattack/
• Hackers Breached Over 270 Zimbra Servers In Ongoing Attacks
  "Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability. The ZCS email and collaboration suite is used by hundreds of millions of people and organizations, including thousands of businesses and hundreds of government agencies worldwide. Synacor patched the security flaw (tracked as CVE-2026-73570), which allows unauthenticated attackers to gain code execution remotely by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled, with the release of ZCS version 10.1.20 on July 20."
  https://www.bleepingcomputer.com/news/security/hackers-breached-over-270-zimbra-servers-in-ongoing-attacks/
  https://www.bankinfosecurity.com/zimbra-exploitation-spreads-as-thousands-stay-unpatched-a-32654
  https://www.helpnetsecurity.com/2026/08/25/zimbra-cve-2026-73570-compromised/
• Employee Benefits Platform Paylogix Says Hackers Stole Financial And Health Data
  "Hackers stole troves of sensitive information on tens of thousands of people from Paylogix, a tech company that provides benefits management tools to employers and insurance firms. The company has notified several state regulators this month and published its own notice of a security incident explaining that it experienced a cyberattack in the fall that disrupted its systems. An investigation revealed that hackers stole files from the company’s network between November 13 and November 18. Paylogix did not identify the hackers, but the company was added to the leak site of the Akira ransomware gang in January."
  https://therecord.media/paylogix-cyberattack-akira-ransomware

General News

• AI Supply Chain Risk Is Showing Up In Developer Workflows First
  "In this Help Net Security interview, Dr. Jaushin Lee, CEO of Zentera Systems, discusses where AI supply chain risk shows up. He says most incidents still hit developer workflows and open-source package repositories, while poisoned model weights and compromised MCP servers stay mostly in research demos. He explains why segmentation buys more risk reduction per dollar than tooling, where self-hosting a model falls short, and which semiconductor isolation practices software teams should copy. He also names the security belief he has since abandoned."
  https://www.helpnetsecurity.com/2026/08/25/jaushin-lee-ai-zentera-systems-supply-chain-risk/
• A Tale Of Two SOCs: Insights From Two Red Team Assessments
  "The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity, but Organization B rapidly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model. This advisory details the red team’s activity and organizations’ defensive actions, offering lessons learned and mitigations to help critical infrastructure organizations strengthen detection, response, and protections in IT, cloud, and operational technology (OT) environments."
  https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a
  https://www.cisa.gov/sites/default/files/2026-08/aa26-237a-tale-of-two-SOCs-insights-two-red-team-assessments-508c.pdf
  https://cyberscoop.com/cisa-red-team-report-government-water-cybersecurity/
• 58 Arrests In Global Effort To Dismantle West African Organized Crime Groups
  "An eight-month operation targeting West African organized crime groups has led to 58 arrests and the identification of 263 suspects. Operation Jackal IV (November 2025 – June 2026) aimed to disrupt money laundering, identify high-value targets, seize assets, and support arrests and prosecution. The operation, which brought together 22 countries from six continents, is a response to the escalating global threat posed by West African criminal networks – such as the Black Axe and other similar groups. These groups are responsible for a significant share of the world's cyber-enabled financial fraud, typically through romance scams, cryptocurrency and investment scams or business email compromise fraud, as well as other serious and violent crimes."
  https://www.interpol.int/News-and-Events/News/2026/58-arrests-in-global-effort-to-dismantle-West-African-organized-crime-groups
  https://www.bleepingcomputer.com/news/security/police-arrests-dozens-of-suspects-in-global-cybercrime-crackdown/
  https://therecord.media/58-arrested-international-cybercrime-crackdown-interpol
  https://cyberscoop.com/interpol-operation-jackal-iv-black-axe-arrests/
  https://www.helpnetsecurity.com/2026/08/25/interpol-jackal-iv-west-african-crime-groups-arrests/
• Most Organizations Declare Victory Over a Breach Too Early
  "That is often the moment an organization wants to believe the worst is over. Services are restored. Customers can transact again. Executives can brief the board that operations have resumed. Communications teams can move from crisis language to recovery language. Operationally, that may be true. But from a security perspective, it's often premature. One of the most persistent weaknesses among incident response teams is their tendency to confuse service restoration with breach recovery. The organization rebuilds servers, restores applications, re-enables user access and resumes business processes. But the deeper questions remain unresolved."
  https://www.bankinfosecurity.com/blogs/most-organizations-declare-victory-over-breach-too-early-p-4179
• The Safety Penalty: Reclaiming Operational Sovereignty In The Age Of AI
  "Cybersecurity has made a big bet on cloud-hosted AI. Building and running frontier-class models in-house isn’t realistic for most security teams — the compute, the talent, and the R&D costs are more than any single SOC can carry. So we’ve effectively outsourced the "brain" of our security operations to a handful of providers. That trade comes with a hidden cost: the safety penalty. The safety penalty is the friction that shows up when guardrails built to protect the general public get in the way of legitimate security work. If your model refuses to deobfuscate that malware or to explain a working exploit because its filters read the request as harmful, you’re paying the safety penalty."
  https://blog.talosintelligence.com/the-safety-penalty-reclaiming-operational-sovereignty-in-the-age-of-ai/
• From ‘High/Medium/Low’ To Dollars: Making Cyber Risk Legible To Your CFO
  "For years, cybersecurity teams have communicated risk through labels such as “High,” “Medium,” and “Low.” Those ratings can help security teams prioritize vulnerabilities, but they often leave CFOs with a more important question unanswered: What does the risk actually mean for the business financially? That question has become harder to ignore as the threat landscape accelerates. Cyble’s 2025 threat predictions, published as the year unfolded, provide a useful illustration. More than 80% of the threats Cyble forecast—including AI-driven ransomware and complex supply-chain attacks—materialized as anticipated."
  https://cyble.com/blog/financial-exposure-cyber-risk-quantification/
• Is Cyber Facing An Affordability Crisis?
  "A chief information security officer—if the company can even afford one— is woken by an urgent phone call in the middle of the night. There's been a breach. Threat actors stole highly sensitive customer data, and now they're demanding a ransom. If the company doesn't pay, they will leak data on the Dark Web. That's when the clock, and the financial fallout, starts ticking. Whether it's a ransomware attack, business email compromise, or a third-party supply chain attack, organizations have unfortunately become increasingly accustomed to suffering data breaches. But they are caught between rising threats they can't ignore and burgeoning defense costs they can't sustain."
  https://www.darkreading.com/cybersecurity-operations/is-cyber-facing-an-affordability-crisis-
• Silent Patches Don’t Stop Attackers – They Blind Defenders
  "Every so often a vendor decides the smart move is to fix a vulnerability quietly. No advisory, no CVE, no explanation, just the vaguest handwave in a changelog. The logic sounds reasonable on its face: if you don’t explain what a patch does, you avoid handing attackers a roadmap to the root cause. Why publicize your bugs? Here’s why: patches aren’t secrets once they ship. A vendor can skip the CVE, skip the advisory, skip the outreach, but the binary still changes on disk, and anyone with a debugger and a disassembler can diff old and new and figure out what moved. That’s not a hypothetical skill, and lately, the barrier to entry into sophisticated exploit dev just got a lot lower thanks to our LLM friends."
  https://www.securityweek.com/silent-patches-dont-stop-attackers-they-blind-defenders/
• Leak Sites: a Field Guide
  "A leak-site listing is a claim, not a confirmation. Ransomware groups use leak sites as part of their extortion strategy, so defenders should seek corroborating evidence before treating a listing as proof of a breach. Leak sites provide useful threat intelligence, but they require context. They can reveal active threat groups, targeted industries and emerging campaigns, but listings may include exaggerated, recycled or unverified claims. Focus on trends and exposure, not raw victim counts. The most valuable insights come from identifying which sectors, vendors and organizations are being targeted and determining whether they present risk to your environment or supply chain."
  https://blog.barracuda.com/2026/08/25/leak-sites-a-field-guide
• The State Of AI-Enabled Malware August 2026: From Brand Abuse To Agentic Execution
  "To assess the impact of AI-enabled malware, we collected and analyzed over 400 malware samples that integrate AI in some capacity, from brand impersonation and large language model (LLM)-generated code to agentic execution loops. Our central finding was that the AI malware space is currently overwhelmingly composed of proof-of-concept code, security validation testing and researcher submissions that have never reached a production environment. Of the 405 samples in our dataset, only 12 appeared in our telemetry on Cortex XDR-protected endpoints, and a small subset was forwarded through Next-Generation Firewalls to WildFire for analysis. Palo Alto Networks products detected and blocked every sample that attempted to reach a customer environment."
  https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/
• New Bitsight Research Shows AI Abuse Is Moving Beyond The Jailbreak Prompt
  "Jailbreak prompts (i.e. prompts designed to remove or bypass the guardrails and rules that govern AI systems, like LLMs) prompts have been circulating for years. At first, a lot of it was pretty simple: copy a prompt, tell the model to ignore its rules, and see what happens. It was also largely noisy, unverified, and often didn’t work. But the noise was still telling us something. Threat actors were beginning to study AI systems the same way defenders were, and over time, the goal started to change. New Bitsight Threat Intelligence research from July 2025 through July 2026 found jailbreak activity across forums, GitHub repositories, Telegram channels, direct messages, and marketplace-style conversations. We also saw users moving past static prompts and experimenting with obfuscation, model routing, retry logic, multi-model testing, and repeatable jailbreak workflows."
  https://www.bitsight.com/blog/ai-jailbreak-prompts-evolving-cyber-threats

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Financial Sector

• Security Issues In The Korean & Global Financial Sector In July 2026
  "In Attack Stage 1, phishing (a technique that tricks users into opening malicious links or attachments) had the highest rate at 1.7, Down from 2.3 The previous month. In Attack Stage 2, Dropper/Downloader (a type that downloads additional malware) was the most prevalent at 1.7, Up from 1.4 The previous month. In Stage 3, Infostealers (malware designed to steal information) were the most prevalent at 0.2, While Ransomware and CoinMiner each accounted for 0.1."
  https://asec.ahnlab.com/en/95109/
• Venezuelan Gets Record Federal Prison Term For ATM Jackpotting
  "A Venezuelan national has been sentenced to 8 years in prison for his role in an ATM jackpotting scheme that caused millions of dollars in losses, the US Justice Department announced on Friday. According to the DOJ, 27-year-old Juan Manuel Gouveia-Aguilera has been sentenced to 96 months in prison, 5 years of supervised release, and ordered to pay restitution after pleading guilty to bank fraud, bank burglary, and cyber-enabled fraud charges. “The Court found Gouveia-Aguilera to be responsible for more than $3.5 million in losses and this sentence is believed to be the longest federal sentence imposed for an individual’s role in ATM jackpotting,” the DOJ said."
  https://www.securityweek.com/venezuelan-gets-record-federal-prison-term-for-atm-jackpotting/

Vulnerabilities

• One Slug, Seven Editions: The MiniOrange SAML SSO Bug That Let Anyone Log In As Your WordPress Admin
  "Most vulnerability write-ups are about the bug. This is primarily about everything around the bug, where the actual risk ended up living. The DigitalOcean security team identified a critical gap the hard way, based on their defense-in-depth controls. The version-level analysis that follows, which no public vulnerability database had, came out of DigitalOcean’s work. Two critical authentication bypasses (CVSS 9.8) were publicly disclosed in July 2026 for the miniOrange SAML 2.0 Single Sign On plugin (opens in new tab). Both allow an unauthenticated attacker to forge a SAML assertion and land in /wp-admin as any existing user, including administrators."
  https://patchstack.com/articles/one-slug-seven-editions-the-miniorange-saml-sso-bug-that-let-anyone-log-in-as-your-wordpress-admin/
  https://www.bleepingcomputer.com/news/security/hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks/
• Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
  "Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as the CVE Numbering Authority (CNA) for the flaw. It has been classified as a weak password recovery mechanism for a forgotten password (CWE-640). Users of upstream Keycloak are advised to update to version 26.7.2, released August 19, 2026, while customers running Red Hat build of Keycloak (RHBK) should apply the updates shipped for 26.4.15 and 26.6.6."
  https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html
• 91 Vulnerabilities Patched In Spring Application Framework
  "The developers of Broadcom’s Spring application development framework last week announced the release of updates that patch 91 vulnerabilities. Spring is an open source application framework for the Java platform that simplifies the creation of enterprise applications through features such as dependency injection, aspect-oriented programming, and modular support for web, data, and messaging architectures. After years under VMware’s stewardship, it transitioned to Broadcom following its acquisition of VMware."
  https://www.securityweek.com/91-vulnerabilities-patched-in-spring-application-framework/
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog
• Calix GS7 XGS GS5239XG Residential Router Contains Missing Authentication Vulnerability
  "The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) WANIPConnection service on the public WAN interface. Calix GS7 XGS GS5239XG is a residential gateway that provides routing, NAT, and firewall functionality for home networks. The device includes the Universal Plug and Play (UPnP) service implemented via MiniUPnPd 2.3.7, a lightweight software program that provides features such as automatic port forwarding for applications and devices on the LAN. By default, the UPnP service is exposed on the device’s WAN interface and does not require authentication."
  https://kb.cert.org/vuls/id/756733
  https://www.bleepingcomputer.com/news/security/unpatched-calix-flaw-lets-hackers-bypass-nat-to-expose-internal-devices/
• Russian Backdoor Found In Slovak Traffic Cameras
  "Efforts to modernize state infrastructure and update traffic surveillance have been stalled by critical security issues the Slovakian government reported in newly acquired high-speed traffic cameras. The National Security Authority - Slovakia's watchdog cybersecurity agency - discovered backdoors embedded in a module in 279 NERO R-ONE high-speed cameras. The now disabled cameras - acquired through a 30 million euro European Union-backed modernization fund - contained a collection of Russian-linked phone numbers that enable backdoor access to the country's traffic systems."
  https://www.bankinfosecurity.com/russian-backdoor-found-in-slovak-traffic-cameras-a-32645
  https://securityaffairs.com/197764/hacking/slovakia-warns-of-cyber-risks-in-road-speed-cameras.html
• Cudy WR3000 Router Flaws Can Be Chained To Gain Root Access
  "Independent security researchers Hunt & Benito have released public exploit tools that reproduce a two-vulnerability chain affecting Cudy WR3000 routers. The code can extract authentication data from the router firmware, forge a valid token, and, when the required network access exists, execute operating-system commands as root. The toolkit was published on August 20, 2026, one day after GitHub published advisories for the vulnerabilities. Its release turns the technical findings into a repeatable exploitation process, although there is no evidence that either flaw is being exploited in real attacks."
  https://hackread.com/cudy-wr3000-router-flaws-chained-root-access/

Malware

• A Social Engineering Attempt Against ReliaQuest: What We Found
  "On August 22, 2026, ReliaQuest was the target of a social engineering attack. While unsuccessful beyond temporarily exposing one identity, the attempt was an important reminder of the persistent tactics of threat actor groups and what all organizations can do to guard against them. We are sharing the full details of this attempt for transparency and so others can learn from this playbook. The threat actor registered a lookalike domain and stood up a fake ReliaQuest single sign-on (SSO) page behind a content delivery network. The threat actor then called multiple ReliaQuest teammates, each time posing as a security employee by name in an attempt to steer them towards the fake page. One teammate entered their password and approved the push notification on their phone. That handed the attacker a brief session on our identity dashboard."
  https://reliaquest.com/blog/threat-spotlight-social-engineering-attempt-against-reliaquest-what-we-found/
  https://www.bleepingcomputer.com/news/security/reliaquest-confirms-failed-data-theft-attack-after-shinyhunters-breach/
  https://www.securityweek.com/reliaquest-confirms-shinyhunters-hack-but-says-impact-was-limited/
• AliExpress Webpage Keeping Multipoint Bluetooth Headphones Active With WebAudio Fingerprinting
  "Recently I ran into a strange problem with my Bluetooth headphones. They support multipoint Bluetooth audio, so they can be connected to my PC and phone at the same time. Normally the PC takes priority playing audio, with my phone being able to play audio when nothing is playing on the PC. Usually I listen to music on my phone but with notifications or Youtube playing through the PC, this works reliably until I open an AliExpress page in Firefox or Chrome (other browsers untested). Shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately. Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page."
  https://blog.laserphile.com/2026/08/aliexpress-webpage-keeping-multipoint.html
  https://www.bankinfosecurity.com/alibabas-aliexpress-uses-hidden-audio-to-fingerprint-devices-a-32646
  https://www.malwarebytes.com/blog/privacy/2026/08/aliexpress-caught-using-silent-audio-to-fingerprint-visitors-browsers
• WordlistLoader Delivering Amatera Via ClearFake Campaigns
  "Over the past few months, Amatera Stealer (also often referred to as ACR Stealer) has been actively developed and has gradually become one of the most prevalent infostealer in our user base. Most recently, we've been observing Amatera being distributed via ClearFake campaigns leveraging FakeCaptchas. Although FakeCaptcha, as a technique, is well-known and has been documented countless times, it has proven to be one of the most effective social engineering techniques for luring victims into infecting their own machines, which is why we still keep seeing it so often in malware campaigns, and why we proactively defend against these types of attacks with our Clipboard protection."
  https://www.gendigital.com/blog/insights/research/wordlistloader-delivering-amatera-via-clearfake-campaigns
  https://www.darkreading.com/data-privacy/wordlistloader-disguises-malware-ordinary-text
  https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html
• The "Chameleon" Threat: Unmasking And Mitigating Cloaked SEO Poisoning In Financial Services
  "In Q2 2026, Fortra Intelligence and Research Experts (FIRE) observed a more than 40% increase of threat actors weaponizing trust through a new tactic dubbed by researchers as “Chameleon SEO Poisoning.” The tactic uses cloaked search engine results to deploy phishing payloads such as credential theft and session hijacking. This allows them to remain invisible to standard security scanners and remain active longer. To successfully detect and mitigate these campaigns, security teams should move beyond relying solely on static automated sweeps and integrate context-aware, emulated scanning that mirrors a victim’s search journey."
  https://www.fortra.com/blog/the-chameleon-threat
  https://www.helpnetsecurity.com/2026/08/24/chameleon-seo-poisoning-fake-banking-websites-phishing/
• Cato CTRL Insights: When Trust Becomes The Payload In a Fake Codex ClickFix Campaign
  "Attackers are using a fake Codex download experience to trick macOS users into pasting a malicious command into Terminal. This technique, known as ClickFix, relies on social engineering rather than a conventional malware download: the victim is persuaded to perform the execution step themselves. We analyzed sponsored search results leading to convincing Google Sites pages, a no-code website-building and hosting service provided by Google. An attacker-controlled embedded page then presented the fake installer and the Terminal instruction."
  https://www.catonetworks.com/blog/cato-ctrl-when-trust-becomes-payload-in-fake-codex-clickfix-campaign/
  https://www.infosecurity-magazine.com/news/fake-codex-download-google-sites/
• DOUBLOON DREDGER Token Harvesting: Notion Abuse, EvilTokens, And a Side Of Tycoon2FA
  "In July 2026, a Sublime customer reached out about having observed Notion abuse for the purpose of delivering phishing attacks. In parallel, Sublime Threat Intelligence & Research (STIR) had identified similar phishing activity directed at another customer in a similar vertical. In these attacks, the threat actor abuses Notion by creating a fake account and then invites targets to view a PDF that contains a malicious link. The payload link then takes the target to an EvilTokens device code harvesting page."
  https://sublime.security/blog/doubloon-dredger-token-harvesting-notion-abuse-eviltokens-and-a-side-of-tycoon2fa/
  https://www.infosecurity-magazine.com/news/doubloon-dredger-notion/
• Fake GTA 6 Extended Look And Demo Sites Deliver An Infostealer
  "GTA 6 footage really has leaked online, and Rockstar has an official Extended Look coming to Netflix on August 27. But cybercriminals are exploiting the hype with fake Rockstar sites that lead visitors to password-stealing malware. We identified a network of sites appearing in searches for a GTA 6 demo and impersonating Rockstar Games. One Google result advertises an “Official Download,” but visitors who follow the sites’ “Play Now” links can instead end up downloading gta6_installer.exe."
  https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer
  https://www.tomshardware.com/video-games/fake-gta-vi-iso-circulates-on-the-internet-a-few-days-after-leak-internet-sleuths-claim-113gb-download-is-padded-malware-testers-claim-file-is-99-99-percent-empty-zeroes-with-50kb-virus-embedded
  https://securityaffairs.com/197772/malware/cybercriminals-turn-gta-vi-leaks-into-malware-bait.html
• Fake Microsoft Security Scans Trick Victims Into Uninstalling Their Antivirus
  "A wave of websites is offering to check whether your antivirus is working. They call themselves SysScan, carry Microsoft branding, and all reach the same conclusion: Your computer has serious problems, and the cause is the antivirus software you installed. Windows, they claim, no longer supports third-party antivirus. Uninstall it immediately. That is false, and it is the first step in a refund scam designed to get victims onto the phone, remove their security software, and ultimately hand over personal, banking, and remote-access information."
  https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-microsoft-security-scans-trick-victims-into-uninstalling-their-antivirus
• Tracking PavinLoader Across ClickFix And Fake Download Campaigns
  "In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain. Further threat hunting has since shown that the same loader, which we track as PavinLoader, is being used across several different campaigns, including ClickFix attacks and fake software downloads. Despite differences in how these campaigns reach victims, we found several common elements."
  https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns
• Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats Via VHD-Delivered Go Backdoor
  "Seqrite APT Team has been tracking threat activity across the globe, with a focus on campaigns targeting different industries and regions. During our recent research, we found a campaign targeting Myanmar that uses a Burmese-language graduation ceremony invitation from Myanmar’s Information Technology and Cyber Security Department as lure. The threat actor delivers the malware through a Virtual Hard Disk (VHD) file. While analyzing the VHD, we discovered several interesting artifacts. we also recovered files from the Recycle Bin that appear to have been unintentionally left behind by the threat actor. These overlooked files provided valuable context that helped us better understand the campaign’s attribution."
  https://www.seqrite.com/blog/operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats-via-vhd-delivered-go-backdoor/
  https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html
• Active Exploitation Of a Software Development Platform Within Australia
  "The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) has observed active exploitation of a vulnerability affecting TeamCity On-Premises servers within Australia. TeamCity is a Continuous Integration and Continuous Deployment (CI/CD) server to automate the processes of building, testing, and deploying software. CVE 2026-63077 may allow an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands."
  https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/active-exploitation-of-a-software-development-platform-within-australia
• Connecting The Dots: Securing The Overlooked Corners Of The Software Development Lifecycle (SDLC) Supply Chain
  "While supply chain threats have been quietly compounding over the past decade, the last 12–18 months have triggered a drastic shift in the scale and velocity of these attacks. Rather than just hunting for bugs in finished software, attackers are targeting the everyday tools and code developers rely on. Unit 42 research shows this happening at every step of the building process. We've observed attackers spending years pretending to be helpful contributors just to hide backdoors in core software, as seen in the XZ Utils vulnerability (CVE-2024-3094). We've seen attackers hijack accounts to drop malware into popular libraries, like in the Axios supply chain attack. And we've seen them misuse setup scripts to automatically steal credentials using the Shai-Hulud npm worm."
  https://unit42.paloaltonetworks.com/sdlc-supply-chain/

General News

• July 2026 Threat Trend Report On Ransomware
  "The July 2026 Threat Trend Report on Ransomware summarizes major Korean & global ransomware issues based on statistics regarding the quantity of new ransomware samples, the number of compromised systems, and statistics on targeted businesses. Statistics on targeted businesses were compiled based on information published on DLS (Dedicated Leak Sites, also referred to as ransomware PR sites or PR pages) operated by ransomware groups."
  https://asec.ahnlab.com/en/95112/
• Treasury Launches Unprecedented Campaign Against Iranian Regime On Economic D-Day
  "Today, at President Trump’s direction, the U.S. Department of the Treasury has begun Operation Economic Outcast: an unprecedented, whole-of-government, economic campaign against the Islamic Republic of Iran and its enablers. “In the Second World War, D-Day marked the historic beginning of a campaign with our allies to target and drive the enemy from its positions, including those in third countries. Today, in that same spirit, we are launching an economic onslaught against Iran’s financial connections around the globe."
  https://home.treasury.gov/news/press-releases/sb0613/
  https://therecord.media/iran-cyberattacks-us-uk
  https://cyberscoop.com/us-treasury-sanctions-iranian-hackers-economic-dday/
• The Vulnerability Gap: Why Discovery Is Outrunning Repair
  "For decades, finding a serious vulnerability in widely used open source software was specialized work. It took a skilled researcher weeks, sometimes months, to trace a flaw and responsibly bring it to a maintainer. That timeline has effectively collapsed. Advanced AI models can now produce vulnerability reports in hours, demolishing what a seasoned professional would have taken weeks to develop. That's not hypothetical: it's what the open source security community has watched happen since the fall of last year, as tools built on frontier models and strong open-weight models alike started turning out findings that are, frankly, good."
  https://www.darkreading.com/cybersecurity-operations/vulnerability-gap-why-discovery-is-outrunning-repair
• CISA Releases Foundational, Flexible Guidance To Help Federal Agencies Implement Effective Logging, Visibility And Operational Standards
  "Today, the Cybersecurity and Infrastructure Security Agency (CISA) published the Logging Reference Architecture, an outcome-driven guide for federal civilian executive branch (FCEB) agencies to establish logging, visibility and operational standards in an Agency Logging Plan, as required in Office of Management and Budget (OMB) Memorandum M-26-14. Developed in collaboration with OMB and the Chief Information Security Officers (CISO) Council, this guidance implements a practical, risk-based, prioritized logging approach that improves agency network monitoring. In alignment with the objectives of M-26-14, CISA’s Logging Reference Architecture guidance directly helps agencies achieve priority logging capabilities that support continuous event monitoring, threat hunting, incident response, and forensics. Agencies will be able to utilize this guidance to update enterprise logging strategies, which will inform an Agency Logging Plan that agencies are required to submit to OMB and CISA by November 18, 2026. The M-26-14 Agency Logging Plan Template, provided by CISA, offers a structured format to streamline planning."
  https://www.cisa.gov/news-events/news/cisa-releases-foundational-flexible-guidance-help-federal-agencies-implement-effective-logging
  https://www.cisa.gov/resources-tools/resources/logging-reference-architecture
  https://www.cisa.gov/sites/default/files/2026-08/logging-reference-architecture.pdf
  https://www.helpnetsecurity.com/2026/08/24/cybersecurity-logging-guidelines-strategy/
• New Guidance Helps Businesses Verify Quantum-Safe Hardware Claims
  "As organizations race to future-proof their systems against quantum-enabled attacks, questions remain around how to verify whether hardware is quantum-safe. A new industry benchmark aims to answer that question. The Trusted Computing Group (TCG) released new guidance on August 24 that helps prove that trusted platform modules (TPMs) genuinely meet essential PQC requirements. TCG is a nonprofit organization tasked with promoting vendor-neutral standards for hardware-based security products like TPMs."
  https://www.infosecurity-magazine.com/news/guidance-verify-quantum-safe/
  https://trustedcomputinggroup.org/is-your-tpm-truly-pqc-ready/
• Multi-Cloud Architecture Challenges: Security And Compliance Implications
  "NIST Internal Report (IR) 8613 ipd (initial public draft), Multi-Cloud Architecture Challenges, identifies, categorizes, and analyzes the security and compliance challenges that are unique to or significantly amplified by multi-cloud architectures. This analysis by the NIST Multi-Cloud Security Public Working Group (MCSPWG) addresses security and Authorization to Operate (ATO) challenges and highlights areas where additional community research could meaningfully reduce risk. The MCSPWG identified 23 consolidated challenge areas that represent novel friction points and architectural misalignments that emerge when orchestrating control across autonomous cloud silos."
  https://csrc.nist.gov/pubs/ir/8613/ipd
  https://www.infosecurity-magazine.com/news/nist-risks-multi-cloud/
• Hired For One Job, Judged On Another: The CISO’s Real Problem
  "Industry surveys have long put CISO tenure below that of other C-suite roles, and part of the reason is a double standard. During recruitment, the focus is technical depth, security experience, and leadership. But when budget season arrives and the board weighs a leader’s performance, the lens is cost, growth, customer trust, and brand protection. Many CISOs feel this acutely. They came up through security, or through risk and compliance, and that is where they are fluent. Their board is not. It wakes up thinking about cost, growth, and customer commitments, and a security leader who cannot connect their work to that language will be seen as important, but rarely as strategic."
  https://www.securityweek.com/hired-for-one-job-judged-on-another-the-cisos-real-problem/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

เมื่อวันที่ 24 สิงหาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 1 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand