Critical remote code execution vulnerability in Windows RMCAST driver with CVSS 8.8. Allows network-based attackers to execute arbitrary code through malicious multicast packets. Part of August 2026 Patch Tuesday addressing 37 total RCE vulnerabilities.
Deploy August 2026 Cumulative Update to all Windows systems. Disable RMCAST protocol on systems not requiring multicast functionality. Implement network-level filtering of multicast traffic from untrusted sources.
Source: MSRC • Published: 2026-08-11
Supply chain attacks surged 260% in campaign count and 450% in package volume in H1 2026 versus all of 2025. First half of 2026 produced 37 campaigns and 497 indexed malicious packages. Major tools compromised include Aqua Security's Trivy, Bitwarden, and Checkmarx, enabling downstream compromises of OpenAI and Vercel.
Implement software bill of materials (SBOM) tracking for all dependencies. Use package managers with built-in security scanning. Pin dependency versions and review updates manually. Implement private package repositories with security scanning. Monitor for typosquatting attacks and AI-generated malicious packages. Apply least privilege to CI/CD pipelines.
Source: Web • Published: 2026-08-17
Privilege escalation vulnerability in four major AI CLI/IDE tools on Windows loading system-wide configuration from C:\ProgramData\, writable by non-administrative users. Enables privilege escalation through configuration poisoning. Anthropic resolved with CVE-2026-35603, while Cursor, OpenAI, and Google triaged as low severity or did not respond.
Anthropic fully deprecated vulnerable C:\ProgramData\ClaudeCode\ path, relocating to write-protected Program Files location. For other tools, restrict write permissions on C:\ProgramData\ directories used by AI coding tools. Monitor for unauthorized configuration changes and consider application whitelisting.
Source: Cycode • Published: 2026-06-17
Russian state-sponsored APT28 (Fancy Bear) and APT29 (Cozy Bear) conducting espionage, influence operations, and infrastructure reconnaissance. Living-off-the-land techniques account for 79% of detections. Target government, defense, critical infrastructure, and energy sectors across NATO.
Implement robust identity and access management with mandatory MFA for all privileged accounts. Deploy EDR tools capable of detecting living-off-the-land techniques. Maintain comprehensive logging and SIEM integration. Segment networks to limit lateral movement. Participate in information sharing with CISA and relevant ISACs.
Source: CISA • Published: 2026-08-17
Identity Theft Resource Center tracked 1,803 data compromises in H1 2026, on pace to surpass 2025's record of 3,321 incidents. Single Instructure Holdings Canvas breach exposed 275 million records (58% of H1 total). Supply chain attacks generated 280.6 million notices from 38 initial events affecting 206 entities. AI makes attacks easier to execute.
Implement data minimization - don't collect or retain unnecessary personal information. Encrypt data at rest and in transit. Deploy data loss prevention (DLP) tools. Conduct regular security assessments of third-party vendors. Implement zero-trust architectures. Provide identity protection services to affected individuals. Report breaches promptly to regulators.
Source: Web • Published: 2026-08-14
Dragos identified 1,140 ransomware incidents involving industrial organizations in Q2 2026, up 12% from Q1. Manufacturing accounts for 65% (747 incidents), construction 176, equipment manufacturing 114, and food/beverage 70. Attacks disrupt IT systems supporting industrial environments, interrupting production without direct ICS access.
Implement network segmentation between IT and OT environments. Maintain offline, immutable backups of critical systems and data. Deploy industrial-specific threat detection tools. Conduct regular tabletop exercises for ransomware response. Implement privileged access management for OT systems. Train OT staff on cybersecurity awareness.
Source: Web • Published: 2026-08-11
ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts in July 2026. Exposed data includes names, email addresses, phone numbers, and potentially additional account information. Breach confirmed by Have I Been Pwned.
RingCentral users must immediately reset passwords and enable multi-factor authentication. Review account activity logs for suspicious access. Monitor for phishing attempts using compromised information. Consider changing phone numbers used for 2FA if exposed. Organizations should review RingCentral access logs and revoke suspicious sessions.
Source: BleepingComputer • Published: 2026-08-14
NIST's Center for AI Standards and Innovation (CAISI) launched AI Agent Standards Initiative on February 17, 2026, establishing three-pillar program for agent security, interoperability, and identity. First US government program dedicated to agentic AI system standards. NCCoE proposes OAuth 2.0, SPIFFE/SPIRE, and Model Context Protocol for agent identity.
Begin planning for AI agent identity management. Implement structured logging for all AI agent tool calls. Deploy short-lived credentials for agents. Establish human approval gates for high-impact agent actions. Follow NIST guidance as standards develop. Participate in NCCoE demonstration projects if applicable.
Source: NIST • Published: 2026-02-17
CVE-2026-62816: Critical remote code execution vulnerability in Windows RMCAST driver with CVSS 8.8. Allows network-based attackers to execute arbitrary code through malicious multicast packets. Part of August 2026 Patch Tuesday addressing 37 total RCE vulnerabilities.