Monday, August 10, 2026 | Jonathan Brown

Attackers are using two N-central bypasses to reach managed-service-provider customers

N-able’s N-central remote-management platform remains the week’s most urgent MSP exposure. CISA lists both CVE-2026-18556 and CVE-2026-18577 in its Known Exploited Vulnerabilities catalog after N-able issued follow-on remediation for an incomplete earlier fix. Hosted instances were updated by N-able, but self-hosted operators must apply the vendor’s current remediation themselves.

Sophos reported hands-on-keyboard activity after one compromise, including new domain accounts, administrator-password resets, reconnaissance, and deployment of several legitimate remote-control tools. That matters because an RMM compromise can turn one exposed management console into reach across multiple customer environments. MSPs should patch to the current vendor guidance, review N-central activity from before remediation, and treat unexpected remote-control sessions, new administrative identities, and tunnel software as incident leads rather than routine support activity.

Watch for: A further N-able remediation or evidence that the activity reached additional managed customer networks would materially expand the assessment.

Sources: CISA, “Known Exploited Vulnerabilities Catalog,” August 2026; N-able, “N-central 2026.3 Hotfix 1 Mitigation for CVE-2026-18577,” August 2, 2026; Sophos, “N-able N-central Exploitation Results in RMM Tool Deployment,” August 4, 2026.

JetBrains confirms exploitation of unpatched TeamCity build servers

JetBrains says it has received reports of active and attempted exploitation of CVE-2026-63077 in TeamCity On-Premises. The unauthenticated remote-code-execution flaw affects all on-premises versions through the agent-polling protocol. JetBrains fixed it in 2025.11.7 and 2026.1.3, with a security patch plugin available for older supported installations. TeamCity Cloud is not affected.

Build servers deserve a different response from ordinary application servers. They can contain deployment credentials, build configurations, signing material, and artifacts that downstream users trust. JetBrains advises checking for suspicious XStream exception messages and unexpected build agents, particularly names beginning with “scan.” Organisations should also rotate credentials stored in any TeamCity instance that was exposed before patching and verify the integrity of recent build outputs.

Watch for: The first confirmed case of tampered build artifacts or a disclosed actor using TeamCity access for software-supply-chain compromise.

Sources: JetBrains, “CVE-2026-63077: Critical Security Issue in TeamCity,” July 27, 2026; JetBrains, “CVE-2026-63077 Update,” August 7, 2026; CISA, “Known Exploited Vulnerabilities Catalog,” August 2026.

Metabase says a zero-day reached cloud tenants and downstream customer data

Metabase disclosed that attackers exploited a previously unknown vulnerability in Metabase Cloud versions 1.58 and later. The company blocked the affected endpoints and released fixed versions for supported branches, including 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. Metabase has not assigned a CVE.

The incident matters because business-intelligence platforms often retain standing credentials for data warehouses and operational databases. Metabase’s own remediation guidance calls for truncating sessions, reviewing administrator accounts and API keys, rotating credentials for every connected database, and reviewing warehouse logs. Framework subsequently told customers that its Metabase instance had been accessed and that customer contact information was exposed. The named victim makes the cloud incident more than a theoretical risk.

Watch for: A CVE assignment, a self-hosted victim disclosure, or evidence that attackers used copied database credentials beyond the Metabase environment.

Sources: Metabase, “Security Update,” August 6, 2026; Framework, customer security notification, August 6, 2026; TechCrunch, “Computer Maker Framework Notifies All Customers of a Data Breach,” August 7, 2026.

Water utilities are still finding attackers inside exposed control systems

The FBI and Environmental Protection Agency warned that malicious actors have targeted internet-facing Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers at water and wastewater systems in at least seven states. Reported actions include changed IP addresses and passwords, altered project files, loss of monitoring and control, pressure loss, and flooding.

The government notice does not publicly attribute every event to a named actor. That uncertainty should not delay action. Operators should remove direct internet access to controllers and engineering interfaces, account for undocumented cellular connectivity, preserve clean controller project files, compare ladder logic and network settings with known-good copies, and rehearse manual operations. A controller that can be reconfigured remotely can disrupt a physical service even without conventional malware on a corporate network.

Watch for: A joint technical advisory naming the access infrastructure, indicators, or an actor would determine whether the incidents represent one coordinated campaign.

Sources: FBI Internet Crime Complaint Center and Environmental Protection Agency, “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing PLCs,” July 30, 2026; CISA, “CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs,” July 30, 2026.

LoadMaster command injection now carries a three-day federal remediation deadline

CISA added CVE-2026-8037 in Progress LoadMaster to the Known Exploited Vulnerabilities catalog on August 7, setting an August 10 deadline for federal civilian agencies. The flaw is a command-injection issue in the application-delivery-controller API. Progress says affected products include LoadMaster GA version 7.2.63.1 and earlier, and LTSF version 7.2.54.17 and earlier; its bulletin directs customers to apply the available patch.

The Canadian Centre for Cyber Security has also warned that exploitation is occurring. Public proof-of-concept code has been available since June, and third-party telemetry reports repeated attempts. A LoadMaster appliance commonly terminates TLS and fronts business-critical applications, so successful access could expose both the appliance and the services behind it. Organisations should patch using current Progress guidance, restrict management access, and investigate exposure before the patch rather than treating the update as proof of clean recovery.

Watch for: A confirmed successful compromise, affected-sector disclosure, or Progress statement identifying fixed build numbers and exploitation scope.

Sources: CISA, “Known Exploited Vulnerabilities Catalog,” August 2026; Progress, “LoadMaster Critical Security Bulletin: CVE-2026-8037 and CVE-2026-33691,” June 2026; Canadian Centre for Cyber Security, “Progress Security Advisory AV26-552,” August 2026.

The ChainDrop npm worm showed that signed provenance is not a complete supply-chain defense

Security researchers reported that the ChainDrop campaign poisoned more than 440 npm packages and over 2,200 package versions after a maintainer account was compromised. The malicious code used installation scripts to collect registry, source-control, cloud, Kubernetes, and vault credentials, then spread through additional packages.

The campaign is notable because the poisoned releases carried valid provenance attestations signed through GitHub Actions. That does not make provenance useless, but it demonstrates its limit: a valid signature can prove that a trusted workflow published a package while saying nothing about whether the maintainer account or workflow was compromised. Development teams should identify whether affected versions entered their dependency graph, restore trusted lockfiles, rotate exposed developer and cloud credentials, and introduce package-release age controls where operationally practical.

Watch for: Second-stage cloud or source-control compromises tied to credentials collected by the poisoned packages.

Sources: SecurityWeek, “Over 400 npm Packages Infected in ChainDrop Supply-Chain Attack,” August 5, 2026; CSO Online, “ChainDrop Credential-Stealing Worm Infects Over 400 npm Packages,” August 4, 2026.

Public exploit code raises the priority of the Rails Active Storage flaw

Researchers have published proof-of-concept code and a Metasploit module for CVE-2026-66066, known as KindaRails2Shell. The flaw affects Active Storage in several Ruby on Rails branches and can allow an unauthenticated attacker to read arbitrary files when vulnerable image-processing paths are exposed. Files such as process environments can contain application secrets, database credentials, and storage keys.

Rails released fixed versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Older branches do not have a fixed Rails release. Rapid7 said it was not aware of in-the-wild exploitation when it published its analysis, so this is a public-proof-of-concept risk rather than a confirmed active campaign. Nevertheless, the potential for secret disclosure means affected organisations should patch or apply the supported workaround, then rotate secrets that the application could have exposed.

Watch for: Confirmed exploitation or KEV listing now that working public tooling is available.

Sources: RubySec, “CVE-2026-66066,” July 2026; Rapid7, “KindaRails2Shell: Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails,” August 3, 2026; Ruby on Rails security advisory, July 2026.

Cisco’s network software and management controllers both need attention

Cisco released a hardening advisory covering seven vulnerabilities in IOS XE, including CVE-2026-20272, which Cisco rates 9.8. The issues affect IOS XE regardless of configuration, and Cisco says there are no workarounds. Fixed releases vary by train, including 17.9.10, 17.12.8, 17.15.6, 17.18.4 or 17.18.4a, and 26.1.2. Cisco said it was not aware of malicious use when it published the advisory.

Separately, public proof-of-concept code is available for CVE-2026-20200 in Cisco Integrated Management Controller on certain UCS C-Series systems and appliances. The flaw requires an authenticated low-privileged user but can allow commands to run as root. There is no confirmed in-the-wild exploitation, but management controllers are frequently patched on a different schedule from the systems they administer. Security teams should schedule IOS XE upgrades, inventory exposed IMC interfaces, and enforce least privilege for controller users.

Watch for: Public exploitation of either the IOS XE injection flaw or the IMC proof of concept, particularly against externally reachable management interfaces.

Sources: Cisco, “Cisco IOS XE Software Hardening Vulnerabilities,” August 5, 2026; NVD, “CVE-2026-20200,” August 2026; Help Net Security, “Cisco IMC Vulnerability CVE-2026-20200: Public PoC Exploit Released,” August 6, 2026.

Vishing incidents at Exact Sciences and Levi Strauss show the cost of trusted identity

Have I Been Pwned added a breach corpus attributed to Exact Sciences after ShinyHunters published data associated with the cancer-diagnostics business. The service reported approximately 10.9 million unique email addresses alongside personal and health-related data. Abbott, which owns Exact Sciences, has said that some affected files contained personal information or protected health information. That confirms a serious confidentiality event, but attacker claims about the total number of records and specific data classes remain unverified.

Levi Strauss separately disclosed in an August 7 Securities and Exchange Commission filing that social engineering gave an unauthorised party access to three employee computers and certain corporate information. Levi said it contained the event, found no impact on consumer data or operations, and did not consider the incident material. Together, the disclosures reinforce a familiar point: identity compromise is not confined to email. Help-desk processes, MFA changes, recovery channels, and cloud-application sessions all need high-signal monitoring and rapid containment paths.

Watch for: Required health-data notification details from Abbott, or an amended Levi Strauss filing that changes the company’s materiality assessment.

Sources: Have I Been Pwned, “Exact Sciences,” August 7, 2026; Abbott, Exact Sciences data-incident notice, August 2026; Levi Strauss & Co., Form 8-K, August 7, 2026; Reuters, “Levi Strauss Reveals Cybersecurity Breach Amid Wider Wave of Attacks,” August 7, 2026.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.