Saturday, August twenty-second, 2026 | Jonathan Brown

Today’s posture is defined by trusted access pathways: self-hosted communications servers, software-development platforms, identity infrastructure, content-management systems, cloud isolation boundaries, security drivers, and telecom interconnection points. Several stories also show the same operational pattern: patching closes the technical weakness, but defenders still need to investigate what happened while the weakness was exposed.

TrueConf Server flaws move from vulnerability management into emergency response

CISA has added two actively exploited TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026 dash seven two five two nine allows an unauthenticated attacker with network access to TCP port 4307 to execute an arbitrary script. CVE-2026 dash seven two five three zero can allow code execution to escape the TrueConf sandbox and reach the underlying operating system.

The affected branches include all TrueConf Server versions before five dot three, five dot three versions before five dot three dot nine, five dot four versions before five dot four dot nine, and five dot five versions before five dot five dot five. Kaspersky reports that the Head Mare group used the flaws against Russian organizations, including transportation, energy, information technology, electronics, and software companies. That attribution is separate from CISA’s confirmation of exploitation.

Organizations should patch immediately, remove TrueConf management and service ports from the public internet, and inspect server logs, installer files, newly created accounts, scheduled tasks, and outbound connections. The next material development will be evidence that the flaws are being used beyond the previously reported regional campaigns, especially against government or industrial networks.

GitLab exploitation shows how quickly a repository can become an attack surface

WatchTowr reports observing exploitation of GitLab CVE-2026 dash one nine four seven eight within days of disclosure. The flaw affects self-managed GitLab Community Edition and Enterprise Edition installations and can allow an unauthenticated attacker, under certain conditions, to modify or delete public projects and user data through a GraphQL directive.

GitLab fixed the issue in versions eighteen dot eleven dot eleven, nineteen dot zero dot eight, nineteen dot one dot six, and nineteen dot two dot four. GitLab branches eighteen dot two through eighteen dot ten have no direct patch and must be upgraded to a supported branch. GitLab dot com and GitLab Dedicated were already patched. The earlier GitLab advisory did not disclose confirmed exploitation, but WatchTowr says it reproduced the flaw rapidly and observed attacks against its honeypot infrastructure.

Self-managed operators should upgrade immediately and review web logs for GraphQL requests containing “@gl_introduced,” along with unexpected repository deletions, altered merge records, disabled maintainers, and unexplained project changes. A successful attack could corrupt the software-development record itself, making a malicious change appear to have been reviewed or fixed. The next important signal is whether attackers move from public-project manipulation into private repositories, runners, credentials, or build pipelines.

Microsoft corrects the exploitation status of a maximum-severity Entra ID flaw

Microsoft disclosed CVE-2026 dash six nine eight three six in Entra ID, its cloud identity and access-management service. The flaw involved unsafe deserialization and received a CVSS score of ten. Microsoft said it had fully mitigated the issue in the service and that customers did not need to install anything.

The important correction came afterward. Microsoft’s initial bulletin indicated exploitation, but the company later changed the status to say that the vulnerability had not been exploited in the wild. Microsoft has not explained the discrepancy in detail. Because Entra ID controls access to Microsoft 365, Azure, and connected applications, even a theoretical remote-code-execution flaw in the identity plane would have had an unusually large potential blast radius.

There is no current basis for treating this as a confirmed customer compromise. Administrators should nevertheless review Entra sign-in logs, service-principal changes, application-consent events, and unusual privileged activity as part of ordinary identity monitoring. The next material development will be a technical explanation from Microsoft or independent evidence establishing whether the original exploitation flag was an error, an early warning, or a reporting-status problem.

Elementor Pro flaw could turn millions of WordPress sites into code-execution targets

Wordfence has disclosed an unauthenticated arbitrary-file-upload vulnerability in Elementor Pro, a WordPress plugin with an estimated six million active installations. CVE-2026 dash three two four seven five affects the Forms module and allows an attacker to bypass file-extension checks and upload executable PHP content to a public directory.

The affected versions are Elementor Pro four dot two dot one and earlier. The vulnerability was fixed in version four dot two dot two. Public reporting has not established active exploitation, but the attack path is direct: an attacker does not need an account, can place server-side code on the site, and may then gain complete control of the WordPress installation.

Administrators should update immediately, disable unused file-upload functionality, search web-accessible upload directories for unexpected PHP files, and review administrator accounts, redirects, scheduled tasks, and outbound connections. A compromised WordPress site can become a malware host or command-and-control node, not merely a defaced page. The next important signal will be mass scanning or confirmed attempts against the Forms upload endpoint.

Sakura Internet breach exposes the danger inside hosting-provider control planes

Japanese cloud and data-center provider Sakura Internet says attackers accessed a sales-management system containing customer and membership information. The company’s investigation began with unauthorized access involving five hundred eighty-three Sakura Rental Server accounts and malware found on company systems. A later update placed as many as one point three six million accounts within the possible scope.

Potentially exposed information includes names, addresses, phone numbers, email addresses, birth dates, subscribed services, contract periods, and billing information. Sakura says credit-card information was not stored in the affected system, and the company has not confirmed large-scale data exfiltration. The maximum account figure is therefore a potential scope, not a confirmed number of stolen records.

The incident matters because a breach discovered in a relatively small hosting environment expanded into a much larger customer-management exposure. Hosting providers should review administrative access, customer-support systems, rental-server telemetry, malware persistence, and lateral movement between service environments. The next material development is Sakura’s confirmation of whether attackers reached customer workloads or merely accessed provider-side business records.

StopAndProtect turns compromised WordPress sites into a distributed criminal network

Check Point Research has described StopAndProtect, a criminal operation that used nearly two thousand compromised WordPress domains to host malware, relay commands, and store stolen files. Exposed operator logs indicated more than six thousand victim IP addresses, with significant concentrations in the United States, Russia, and India.

The operation begins with a fake CAPTCHA or ClickFix prompt that persuades a visitor to copy and execute a PowerShell command. Multiple .NET stages then deliver a modular toolkit containing ransomware, a credential stealer, a screen locker, an SMB and USB worm, a Visual Basic script spreader, and an operator chat component. Encryption was not used against every victim; in many cases the operators quietly collected file lists, screenshots, credentials, and selected documents first.

WordPress operators should inspect file integrity, unknown PHP endpoints, directory listings, modified plugins, new administrative accounts, and unexplained outbound traffic. Visitors who encountered suspicious CAPTCHA instructions should review PowerShell, browser, and endpoint telemetry rather than assuming that no visible encryption means no compromise. The next material signal will be the identification of the original vulnerabilities used to compromise the WordPress sites or evidence that the same infrastructure is being used by another criminal group.

Cloudflare Workers research reopens the problem of shared-process isolation

Cloudflare and academic researchers disclosed a remote Spectre attack against Cloudflare Workers that recovered a JSON Web Token from a co-located worker in the production environment. The experiment achieved leakage of up to twelve bits per second with approximately ninety-nine percent accuracy, a substantial improvement over earlier demonstrations.

Cloudflare Workers run code from different customers in separate V8 isolates that may share an operating-system process. The attack required attacker-controlled and victim-controlled workers to be placed in a suitable co-located environment. Cloudflare says it found no evidence of exploitation during the previous three years and has already improved Dynamic Process Isolation, integrated the V8 Sandbox, and deployed memory-protection-key isolation.

This is not evidence that Cloudflare customers were breached. It is evidence that serverless isolation remains a security boundary requiring continual testing, especially when applications keep long-lived tokens or cloud credentials in memory. Operators should confirm current platform mitigations, reduce token lifetime, and avoid placing unnecessary high-value secrets inside shared edge runtimes. The next important development will be whether comparable attacks are demonstrated against other isolate-based serverless platforms.

Microsoft Defender’s remediation driver becomes a kernel-level research primitive

Check Point Research has reverse-engineered Microsoft Defender’s Boot-Time Removal driver, known as BTR dot sys. The signed Microsoft component uses encrypted transaction data to perform file and registry operations during remediation. Researchers demonstrated that a specially constructed transaction could turn the driver into a powerful kernel-level operation primitive without relying on memory corruption or a traditional vulnerable-driver exploit.

Check Point released a research tool called BTR underscore CLI to demonstrate the technique. The research does not establish active criminal exploitation, and it does not mean that every appearance of the Defender driver is malicious. It does show that a trusted security component can be repurposed to disable or alter security controls while retaining a Microsoft signature.

Defenders should avoid indiscriminately blocking legitimate Defender remediation, but should investigate unexpected randomized driver names, temporary service entries, alternate data streams, unusual reboot-time driver activity, and file or registry changes associated with BTR behavior. Endpoint detections based only on signer reputation may miss this class of abuse. The next material signal will be evidence that attackers have incorporated BTR behavior into malware or ransomware tooling.

ToxicPanda 2.0 expands Android banking malware into a remote-control platform

Zimperium reports that ToxicPanda 2.0 has expanded from a conventional banking trojan into a much broader Android control and fraud platform. The updated malware supports one hundred sixty-seven remote commands and targets three hundred forty-nine banking, financial, cryptocurrency, and electronic-wallet applications across sixteen countries.

The malware uses Android Accessibility Services to read screen content, display fraudulent overlays, steal credentials and PINs, and automate actions. It can also abuse wireless debugging to obtain shell-level control, steal lock-screen credentials, and maintain real-time communication through WebSocket connections. Zimperium says recent samples were delivered through Amazon Web Services-hosted buckets.

Organizations should monitor mobile-device management telemetry for unexpected Accessibility Service grants, developer-mode activation, wireless-debugging changes, fake system-update screens, and applications installed outside approved channels. Mobile devices used for authentication or corporate banking should be treated as privileged endpoints, not merely personal accessories. The next material signal will be evidence of ToxicPanda moving from consumer banking into enterprise identity, cryptocurrency custody, or corporate mobile applications.

T-Mobile’s physical cable cut illustrates the reality of telecom containment

New reporting revisits a 2024 incident in which T-Mobile’s security team physically disconnected a system after identifying suspected Salt Typhoon access through an interconnection with another telecom provider. The account describes investigators cutting the cable to the compromised equipment after months of searching for the source of unusual activity.

This is not a newly disclosed T-Mobile intrusion, and public reporting does not establish that customer data was taken. T-Mobile previously said that it detected attempted access and protected customer information. The operational lesson is more important than the dramatic image: in a telecom environment, a compromised trusted connection may require immediate physical isolation when logical controls cannot establish confidence in the boundary.

Network operators should maintain tested procedures for emergency segmentation, circuit shutdown, evidence preservation, and restoration through clean equipment. Interconnection inventories should identify which external providers, routers, management systems, and lawful-intercept pathways can reach sensitive infrastructure. The next material development will be further disclosure about the compromised interconnection and whether similar access paths remained active elsewhere in the telecom sector.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.