📰 DAILY THREAT BRIEFING
Wednesday, August 12, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of August 12, 2026.

  1. DeadLock ransomware uses blockchain to resist infrastructure takedown
    — Bleeping Computer

    The DeadLock ransomware operation is using a decentralized infrastructure that relies on blockchain-backed services to protect its communica…
  2. Microsoft's Patch Tuesday Deluge Continues With August Updates
    — Dark Reading

    Security experts say prioritization should be the main focus for the August updates, not the massive CVE volume.
  3. Microsoft Plugs Nearly 400 Security Holes
    — Krebs on Security

    Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, in…
  4. Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA
    — Dark Reading

    The ransomware-as-a-service operation is finding success against critical infrastructure targets with leaked Conti code and old flaws in fir…
  5. Sandworm hackers target IT pros with trojanized WireGuard VPN client
    — Bleeping Computer

    Hackers associated with the Russian threat group Sandworm have been targeting system administrators and IT professionals through fake job of…
  6. Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack
    — The Hacker News

    Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in…
  7. Cisco warns of ASA and FTD VPN flaw exploited to crash devices
    — Bleeping Computer

    Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being acti…
  8. Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
    — The Hacker News

    Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with si…
  9. Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client
    — The Hacker News

    Anyone sharing their screen on a Zoom call could have taken over the computers of everyone watching, and anyone watching could have taken ov…
  10. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th)
    — SANS ISC

    This month we got patches for 418 vulnerabilities. Of these, 62 are critical, 1 is being exploited in the wild, and 2 were publicly disclose…
  11. Kimwolf v7: An Evolution of the Kimwolf Botnet
    — Unit 42

    Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The …
  12. ISC Stormcast For Tuesday, August 11th, 2026 https://isc.sans.edu/podcastdetail/10046, (Tue, Aug 11th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (11220 in last 30 days).
Critical: 3 · High: 9 · Medium: 8 · Low: 0. View full dashboard →

  1. CVE-2024-14043
    — CVSS 6.3 (MEDIUM)

    A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-path.c of the component Diameter S6a Interface. Executing a man…
  2. CVE-2026-73249
    — CVSS 7.5 (HIGH)

    calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch…
  3. CVE-2026-73247
    — CVSS 8.6 (HIGH)

    Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.c…
  4. CVE-2026-73246
    — CVSS 7.5 (HIGH)

    Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the …
  5. CVE-2026-73245
    — CVSS 6.5 (MEDIUM)

    Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic…
  6. CVE-2026-68067
    — CVSS 9.8 (CRITICAL)

    The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email a…
  7. CVE-2026-67568
    — CVSS 9.1 (CRITICAL)

    The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information…
  8. CVE-2026-67558
    — CVSS 7.4 (HIGH)

    The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist…
  9. CVE-2026-66875
    — CVSS 8.8 (HIGH)

    In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, ex…
  10. CVE-2026-66340
    — CVSS 5.3 (MEDIUM)

    The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access …
  11. CVE-2026-66098
    — CVSS 6.5 (MEDIUM)

    The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disru…
  12. CVE-2026-64934
    — CVSS 4.3 (MEDIUM)

    The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submi…
  13. CVE-2026-5917
    — CVSS 9.6 (CRITICAL)

    libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by …
  14. CVE-2026-29036
    — CVSS 7.5 (HIGH)

    cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch …
  15. CVE-2026-18710
    — CVSS 6.5 (MEDIUM)

    A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This…
  16. CVE-2026-66832
    — CVSS 6.5 (MEDIUM)

    When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the We…
  17. CVE-2026-66154
    — CVSS 8.3 (HIGH)

    An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network…
  18. CVE-2026-66150
    — CVSS 7.8 (HIGH)

    Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arb…
  19. CVE-2026-66149
    — CVSS 7.8 (HIGH)

    Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arb…
  20. CVE-2026-66148
    — CVSS 6.3 (MEDIUM)

    An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · August 12, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com