Daily Cybersecurity News – August 26, 2026
Gitea CVE-2026-60004 RCE actively exploited
CriticalWhat happened
CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical remote code execution flaw in Gitea.
The issue (CVSS 9.8) lets an attacker with ordinary repository write access abuse the diffpatch endpoint to install and execute a Git hook from repository-controlled content, running arbitrary shell commands as the Gitea OS user. With default open registration enabled, an unauthenticated visitor can register, create a repo, and trigger the exploit. It affects all versions from 1.17 and is fixed in 1.27.1.
One reported incident involved a miner-like dropper that spiked CPU usage on a VPS until the host limited resources.
Who is affected
Any self-hosted or managed Gitea instance running version 1.17 through 1.27.0, especially those left with open registration, no email confirmation, or OpenID signup enabled.
This includes development teams, open-source projects, and organizations using Gitea for source control. Default configurations make external attackers able to gain the needed write access without prior credentials.
Why it matters
A single write-capable account or open registration path turns into full OS-level code execution under the Gitea service account, enabling cryptominers, reverse shells, or further lateral movement.
Builders and operators running Git forges often treat them as internal tools and leave registration open; the KEV listing and real-world miner payload show the window is already being hit.
How it could have been prevented
Upgrade immediately to Gitea 1.27.1 or later. Disable open registration (DISABLE_REGISTRATION = true), require email confirmation, and restrict sign-in view and OpenID signup where possible.
Limit repository write access, monitor for unexpected Git hooks or high CPU from the Gitea process, and review recent account creations and diffpatch API usage. Federal agencies follow the KEV due date; everyone else should treat it as urgent.
Relevant professional terms
- Remote code execution (RCE)
- A flaw that lets an attacker run their own commands on a target system as if they were a legitimate user or service.
- Git hook
- A script that Git automatically runs at specific points in a repository workflow; if an attacker can plant one, it executes with the privileges of the hosting process.
Oracle WebLogic flaw added to CISA KEV
CriticalWhat happened
CISA added CVE-2026-21962 (CVSS 10.0) to its Known Exploited Vulnerabilities catalog, confirming active exploitation of a maximum-severity improper access control issue in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in.
An unauthenticated attacker with network access via HTTP can gain unauthorized creation, deletion, or modification of critical data and full access to data reachable by the affected components. Patches were released by Oracle in January 2026; exploitation has since been observed by multiple vendors, including activity linked to delivery of the SNOWLIGHT downloader and scanning alongside older WebLogic RCEs.
Who is affected
Organizations running Oracle HTTP Server or WebLogic Server Proxy Plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0.
This spans enterprise middleware deployments that front WebLogic applications, common in large commercial and government environments. Federal Civilian Executive Branch agencies face a BOD remediation deadline of August 27, 2026.
Why it matters
A CVSS 10 unauthenticated path to critical data access or modification on core middleware gives attackers a direct route into business systems and has already been chained with other long-lived WebLogic flaws.
Operators who assume January patches are sufficient overlook ongoing opportunistic and targeted scanning; the KEV addition forces prioritization and highlights persistent risk from unpatched Oracle stacks.
How it could have been prevented
Apply the Oracle January 2026 security updates for the affected HTTP Server and Proxy Plug-in versions immediately. Restrict network access to the components to trusted management networks only.
Monitor for anomalous HTTP traffic to the plug-in endpoints, review logs for unauthorized data access patterns, and treat any unpatched instance as high priority given confirmed exploitation and the federal due date.
Relevant professional terms
- Improper access control
- A weakness where the software fails to correctly enforce who is allowed to read, create, change, or delete data or functions.
- Known Exploited Vulnerabilities (KEV) catalog
- CISA’s authoritative list of flaws with confirmed real-world exploitation; federal agencies must remediate entries by set deadlines under binding operational directives.
Sleepwalker backdoor runs custom bytecode
HighWhat happened
An independent researcher documented a previously unreported Windows backdoor named SLEEPWALKER that remains inert in memory until a specifically crafted network packet arrives, then executes commands written in a custom 23-instruction bytecode language.
The sample is an unsigned 64-bit DLL of about 60 KB designed for side-loading into ERAAgent.exe (ESET Management Agent). It impersonates Microsoft’s dpapi.dll, exports the matching functions, and carries a copied version resource. It contains no hardcoded C2 domains or IPs, makes no outbound connections of its own, and decrypts an AES-256-CCM configuration that simply tells it to sniff every network interface for the trigger packet.
Who is affected
Windows hosts where an attacker already has local administrator rights sufficient to place the malicious DLL beside ERAAgent.exe so it is loaded via normal DLL search order.
Any environment running ESET Management Agent is a potential host process; the backdoor checks only the process name. Because it is post-compromise and relies on side-loading for persistence, the victim set is limited to machines already breached by other means.
Why it matters
The design is quiet and targeted: no beaconing, custom opcodes that look like nothing else, and a packet trigger that can be seen even on bridging or gateway hosts. Detection tools watching for known-bad infrastructure or cleartext C2 will miss it.
Builders and operators relying on ESET agents or similar must treat unexpected DLLs next to the agent binary as high-severity, because the only reliable response once confirmed is full incident response and rebuild rather than a simple patch.
How it could have been prevented
Monitor for unsigned or unexpected DLLs loaded into ERAAgent.exe or other trusted processes, especially those named like system libraries such as dpapi.dll. Enforce application allow-listing and DLL load restrictions where feasible.
Harden DLL search order, restrict write access to directories containing security agent binaries, and investigate any process that begins passive network sniffing without a clear business reason. On confirmed infection, isolate, collect memory, and rebuild rather than attempting cleanup.
Relevant professional terms
- Side-loading
- Placing a malicious library where a legitimate program will automatically load it because of how Windows searches for DLLs.
- Custom bytecode interpreter
- A tiny virtual machine inside the malware that runs its own compact instruction set instead of ordinary shell commands, making reverse-engineering and signature detection harder.
24 npm packages host fake Cloudflare CAPTCHA pages
MediumWhat happened
Researchers at OX Security detailed a campaign that published 24 npm packages whose sole purpose is to host a single HTML page that renders a fake Cloudflare CAPTCHA and redirects victims into ClickFix-style phishing or credential harvesting.
The packages are not intended to infect developers who install them. Instead they abuse the npm registry and its mirrors (especially unpkg) as free, trusted storage and CDN. Once mirrored, a URL such as unpkg.com/package@version/index.html serves a live phishing page on a reputable domain. Early versions pointed at a Microsoft-login typosquat; after Safe Browsing blocked it, the actor switched to the public KeyVal key-value store as a dead-drop resolver to fetch the final redirect target.
Who is affected
End users who click links that resolve to the mirrored HTML on unpkg or similar CDNs, and any organization whose users might be lured by those links.
Developers are not the primary infection vector; the packages themselves are low-download decoys used as infrastructure. The list includes names such as bgzxcuite2, ndmxchdjxn2, and @worrisome/reutil, some still downloadable at time of reporting.
Why it matters
Trusted package mirrors and CDNs become silent phishing hosts, bypassing many domain-reputation filters because the initial page lives on unpkg.com. ClickFix lures that trick users into running commands or entering credentials then become harder to spot.
Supply-chain defenders usually watch for malicious install scripts; this campaign shows attackers also weaponize the distribution layer itself for external phishing, so monitoring must extend to unexpected HTML content published under obscure package names.
How it could have been prevented
Block or tightly control access to unpkg and similar mirrors for non-development traffic if not required. Scan newly published npm packages for single-file HTML payloads that embed CAPTCHA or redirect logic.
Educate users that Cloudflare-style verification pages appearing outside expected flows are suspicious, enforce phishing-resistant MFA, and monitor for use of public key-value stores as dead-drop resolvers in outbound traffic. Report and request takedown of the listed packages.
Relevant professional terms
- ClickFix
- A social-engineering lure that shows a fake error or verification page and instructs the victim to copy-paste or run a command that actually installs malware or steals data.
- Dead-drop resolver (DDR)
- A technique that stores the real malicious destination in an innocuous third-party service so the phishing page only retrieves the live URL at click time, defeating static blocklists.
US sanctions Mabna Institute hackers for infrastructure breaches
HighWhat it means
Expect heightened scrutiny of any remaining Mabna-linked infrastructure and increased sharing of indicators tied to the named individuals. Critical infrastructure defenders should prioritize hunting for the group’s known techniques against energy, defense, healthcare, and government networks. Compliance teams must screen counterparties against the new OFAC listings immediately. The pairing of cyber sanctions with oil, nuclear, and missile designations signals a sustained whole-of-government pressure campaign rather than a one-off action.
What happened
The U.S. Treasury Department, under Operation Economic Outcast, sanctioned nearly 60 Iran-linked entities, individuals, and vessels, including members of the Tehran-based Mabna Institute affiliated with Iran’s Ministry of Intelligence and Security (MOIS).
Five individuals were designated in connection with widespread compromises of U.S. critical infrastructure since at least late 2023. They are accused of breaching energy companies, defense contractors, healthcare institutions, IT firms, financial institutions, and later local, state, and federal government offices, plus some Iranian targets for personal profit. Several had prior designations or recent DOJ indictments.
Who is affected
U.S. critical infrastructure operators in energy, defense, healthcare, IT, finance, and government sectors that were previously or remain potential targets of Mabna Institute / MOIS-linked activity.
Also affected are any entities doing business with the newly sanctioned individuals or front companies, who now face secondary sanctions risk.
Why it matters
The action names specific operators behind multi-year intrusions into U.S. critical infrastructure and pairs cyber designations with a broader economic campaign against IRGC and regime financial networks.
Operators gain clearer attribution and a legal basis to block related infrastructure, while the dual espionage-plus-profit motive shows the same actors may strike both strategic and opportunistic targets.
Relevant professional terms
- Sanctions designation
- An official government listing that freezes assets and prohibits U.S. persons from dealing with the named individuals or entities.
- MOIS-linked cyber actor
- A threat group directed or supported by Iran’s Ministry of Intelligence and Security, typically conducting espionage and disruptive operations aligned with state goals while sometimes pursuing personal financial gain.
ZeroTokens phishing platform steers attacks in real time
HighHow it works
- Victim opens a convincing email that passes authentication checks and lands on a high-fidelity clone of their bank or brokerage.
- A WebSocket connection quietly reports every input and page state to a live operator.
- The operator selects the next verification screen (credentials, ID upload, SMS, app push, trading password) and can recover from failed checks.
- Once data is collected the victim is sent to the real institution site; theft or fund movement happens later with the harvested material.
What happened
Abnormal AI analyzed a phishing platform called ZeroTokens that gives operators live visibility into each victim session and the ability to change the next prompt in real time while harvesting credentials and financial data.
More than 45,000 messages reached over 24,000 recipients across 700-plus organizations, with a single-day peak of 24,000 messages. Campaigns used ten sender domains and nine compromised SendGrid accounts that passed SPF, DKIM, and DMARC. Lures posed as W-8BEN tax-document reviews. The site cloned the target institution and supported up to eight verification stages; a persistent WebSocket fed inputs to the operator console so the flow could adapt to failed checks and collect logins, ID images, card data, SMS codes, app approvals, and trading passwords before redirecting to the real site.
Who is affected
Customers and employees of 53 financial institutions and users of 36 card-issuer templates spanning banks and brokerages in multiple regions.
Any organization whose users hold U.S. securities (the W-8BEN pretext) or interact with the supported brands is in scope. The scale and dual super-admin/operator roles indicate an in-house criminal operation rather than a public phishing-as-a-service rental.
Why it matters
Real-time human steering defeats many static phishing detections and keeps victims engaged through multi-factor and step-up challenges that would otherwise kill the session.
Financial institutions and their customers face higher success rates for credential and payment-data theft; the platform itself stops at collection, so actual fraud occurs in a second stage using the stolen material, complicating takedown and attribution.
Relevant professional terms
- Real-time phishing session control
- An operator watches what a victim types and instantly chooses the next fake page, adapting the attack while the user is still on the line.
- WebSocket-relayed operator console
- A persistent two-way channel that streams victim keystrokes and form data to the attacker’s dashboard and carries back instructions that alter the phishing page without reloading.
Red team insights from two SOC assessments
MediumWhat to watch
- Whether detection content is baselined and tuned so real anomalies surface above routine noise.
- Clarity of incident-response roles, escalation paths, and defender authority to isolate systems without lengthy approval chains.
- Coverage and playbooks specifically for cloud identity, resource access, and containment, not only on-premises endpoints.
- Evidence that the organization can force an advanced adversary into an assume-breach fight rather than remaining blind until exfiltration or ransomware.
What happened
CISA published advisory AA26-237A describing simultaneous red team assessments at two organizations. In both cases the red team achieved full domain compromise and reached sensitive business systems and cloud resources.
Organization A never detected or contained the activity. Organization B rapidly spotted initial compromise attempts, isolated affected systems, and forced the red team into an assume-breach posture. The advisory extracts lessons on detection tuning, organizational silos, and cloud response gaps.
Who is affected
Critical infrastructure organizations and any enterprise that operates a SOC, hybrid identity, or cloud estate and wants to benchmark detection and response maturity.
The findings apply especially to environments where tools are deployed but baselines, alert triage, and cross-team authority remain immature.
Why it matters
Identical red-team techniques produced opposite outcomes solely because of differences in tuning, process, and authority. Untuned tools generate noise that hides real threats; silos and bureaucracy slow containment even when alerts fire; cloud often lacks both controls and playbooks.
Operators who assume “we have EDR and a SIEM” still fail if the people and processes around those tools are broken. The advisory supplies concrete lessons learned rather than generic best-practice lists.
Relevant professional terms
- Full domain compromise
- The attacker gains control of the organization’s central identity system (typically Active Directory) and can therefore reach almost any joined resource.
- Assume-breach model
- A defensive posture that treats initial access as inevitable and focuses resources on rapid detection, isolation, and limiting damage inside the environment.