⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

Ravie LakshmananAug 24, 2026Cybersecurity / Hacking

A package deal will get put in. A login immediate opens. A field sits uncovered to the web. Nothing seems uncommon but.

That’s roughly the temper this week. Trusted instruments flip hostile, previous weak spots get contemporary consideration, AI makes exploit work cheaper, and researchers hold discovering assaults that sound more durable than they really are.

Loads to scrub up. Right here’s the quick model.

⚡ Risk of the Week

U.S. Warns of AI-Powered Attacks on Siemens PLCs — Risk actors are utilizing AI to put in writing exploit scripts concentrating on internet-exposed Siemens S7 Sequence programmable logic controllers (PLCs) used throughout water, power, manufacturing, and different crucial infrastructure sectors, in keeping with the U.S. authorities. The businesses warned: “This isn’t a theoretical threat—it’s an lively risk.” The exploitation of poorly secured PLCs may end in disruption of crucial industrial processes, security incidents, downtime or tools harm, compromise of delicate knowledge, and compliance violations, to not point out have cascading impacts throughout interconnected techniques. Risk actors have been noticed utilizing authentic scanning providers, equivalent to Censys and ZoomEye, to establish Web-exposed or insufficiently segmented Siemens S7 Sequence PLCs. As soon as weak techniques have been recognized, AI-generated scripts masquerading as authentic monitoring instruments are deployed to search out exploits. For functionality improvement, actors are testing and refining their exploitation methods towards particular PLC fashions to enhance their potential to compromise the PLCs,” the businesses stated. “To arrange for operational results, actors are leveraging learn entry to know goal environments, enabling preparation and positioning for future write operations to trigger disruption or different operational impacts.” It is at present not recognized who’s behind the exercise.

• GitLab Flaw Comes Under Attack — A newly disclosed safety flaw in GitLab got here beneath lively exploitation inside days of public disclosure, in keeping with watchTowr. The vulnerability in query is CVE-2026-19478 (CVSS rating: 9.4), a case of code injection that permits an unauthenticated attacker to change or delete publicly accessible GitLab initiatives and rewrite their knowledge beneath sure circumstances with out requiring credentials, consumer interplay, or obscure configuration.
• 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor — A set of 14 trojanized npm packages have been discovered to masquerade as useful calendar and streak utilities however are engineered to stealthily ship a man-made intelligence (AI)-powered Linux implant dubbed RedC2 4.0. RedC2 4.0, marketed on cybercrime boards as a cross-platform toolkit for Home windows, macOS, and Linux, affords surveillance, credential theft, payload loading, and mass-operation capabilities. The model was marketed by a risk actor named “MarlboroMan” on Hack Boards in early June 2026, describing it as a command-and-control (C2 or C&C) framework “constructed for evasion.”
• Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payment Fraud — Educational researchers demonstrated a brand new Zombie Card assault that bypasses cryptographic checks to finish contactless funds utilizing bodily expired Visa bank cards. By benefiting from a smartphone relay setup to change the expiration date fed to the point-of-sale (PoS) terminal with out breaking the cardboard’s cryptography, it is attainable to make actual in-store purchases. Raja Hasnain Anwar, the lead creator, instructed The Hacker Information that transactions succeeded at most of these banks when the crew modified the Client Machine Cardholder Verification Methodology (CDCVM) flag. There isn’t any proof the approach has been exploited within the wild.
• Suspected Russian Hackers Abuse Legitimate Authentication Workflows — Three distinct suspected Russian cyber espionage risk clusters, viz., UNC6293, UNC7005, and UNC5976, have been noticed leveraging authentic authentication flows to single out people working in academia, aerospace and protection, governments, and suppose tanks throughout Europe, in addition to academia and suppose tanks throughout the U.S. “These clusters have interaction in persistent, adaptive phishing campaigns, utilizing subtle social engineering techniques to compromise private accounts throughout a number of platforms,” Google stated. UNC7005 has additionally been attributed to CaptiveCrunch, which targets captive Wi-Fi portals in places equivalent to motels, convention facilities, and airports within the U.S. and elsewhere to stealthily redirect customers to attacker-controlled infrastructure to steal credentials. A brand new report from Lumen Black Lotus Labs has discovered that the risk actor probably compromised three Managed Service Suppliers (MSPs) to conduct the captive portal hijack by way of a provide chain assault.
• Cloudflare Workers Spectre Attack Leaks JWT — A distant Spectre assault towards Cloudflare Employees has been discovered to leak a JSON Net Token (JWT) from a co-located Employee within the manufacturing surroundings at as much as 12 bits per second, 360 occasions the speed of a earlier assault demonstrated in 2021. “Cloudflare Employees is among the prime three edge-computing options and handles hundreds of thousands of HTTP requests per second worldwide throughout tens of 1000’s of internet sites each day,” researchers stated in a research. “We exhibit a distant Spectre assault utilizing amplification methods together with a distant timing server, which is able to leaking 120 bit/h.”
• Cl0p Deploys Bespoke Web Shell in PTC Windchill Attacks — A JavaServer Pages (JSP) net shell deployed following the exploitation of a crucial safety flaw in PTC Windchill and FlexPLM servers is particularly designed for the enterprise Product Lifecycle Administration (PLM) software program. Per ReliaQuest, the online shell is a totally geared up extortion platform able to mapping delicate vault knowledge, decrypting each credential within the Windchill keystore, and working further code via a customized Java class loader. This isn’t the primary time the Clop gang has deployed customized net shells. The e-crime group was beforehand noticed dropping DEWMODE and LEMURLOOT after exploiting SQL injection flaws in Accellion (CVE-2021-27101) and MOVEit Switch (CVE-2023-34362) file switch software program, respectively. As of August 12, 2026, the ransomware gang began releasing alleged victims’ full names. Over 40 organizations are stated to have been focused by the prolific e-crime group. The event continues Cl0p’s pattern of concentrating on zero-days in well-liked SaaS platforms for mass exploitation and extortion.
• Security Flaw in Unisoc — Researchers disclosed a brand new unpatched flaw in Unisoc T612 modem firmware that, when mixed with a previously disclosed distant code execution (RCE) vulnerability (additionally unpatched), may enable a risk to acquire elevated entry to the Android kernel on affected units. The exploit could be triggered by first delivering a malicious payload to the telephone’s modem by way of the RCE vulnerability after which putting a video name to the machine, which the sufferer would want to reply. “A crucial vulnerability has been recognized within the Unisoc modem firmware that permits arbitrary code execution with kernel privileges from the modem context,” SSD Safe Disclosure stated. “By disabling protections on the primary reminiscence area (ID 0) of the Reminiscence Safety Unit (MPU), an attacker can acquire unrestricted learn and write entry to bodily reminiscence. This may in the end result in native privilege escalation, together with the flexibility to change kernel code.”

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the hole between a patch and an exploit is shrinking quick. These are the heavy hitters for the week: high-severity, broadly used, or already being poked at within the wild.

Verify the record, patch what you have got, and hit those marked pressing first — CVE-2026-15748 (Forminator Varieties), CVE-2026-15826 (Consumer Profile Builder), CVE-2026-73570 (Zimbra), CVE-2026-32475 (Elementor Professional), CVE-2026-64849 (MLflow), CVE-2026-25895 (FUXA), CVE-2026-20030, CVE-2026-20357, CVE-2026-20358, CVE-2026-20359, CVE-2026-20231, CVE-2026-20315, CVE-2026-20317, CVE-2026-20318, CVE-2026-20319 (Cisco), CVE-2026-19478 (GitLab), CVE-2026-65346 (Apple), CVE-2026-19505, CVE-2026-19506, CVE-2026-19507, CVE-2026-19508, CVE-2026-19509 (RDK Central RDK-B WebUI), CVE-2026-75874, CVE-2026-74934, CVE-2026-74935, from CVE-2026-74936 via CVE-2026-74949 (Mozilla Firefox and Thunderbird), CVE-2026-76034, CVE-2026-76036, CVE-2026-76017 (Google Chrome), CVE-2026-14682, CVE-2026-12143 (Atlassian Bamboo Knowledge Middle), CVE-2026-76404, CVE-2026-76389, CVE-2026-76395, CVE-2026-76310, CVE-2026-76311, CVE-2026-76312 (Splunk), CVE-2026-69106, CVE-2026-65922 (JFrog Artifactory), CVE-2026-6837 (Zyxel), CVE-2026-18051 (W3 Whole Cache), CVE-2026-63093 (Cursor), CVE-2026-40144, CVE-2026-40145 (BeyondTrust Endpoint Privilege Administration for Home windows), CVE-2026-57580 (Authentik), CVE-2026-63182 (PHP litesaml/lightsaml), CVE-2026-41473, CVE-2026-41472 (CyberPanel), CVE-2026-66794 (Multicluster Engine for Kubernetes), CVE-2026-69502, CVE-2026-69555, CVE-2026-65816, CVE-2026-65801, CVE-2026-65770, CVE-2026-69836, CVE-2026-24301 (Microsoft), CVE-2026-15580 (N-Ready Passportal), CVE-2026-59270, CVE-2026-47836, CVE-2026-47841 (Spring Safety UnboundID LDAP server), CVE-2026-75501 (Calix GS7 XGS GS5239XG router), CVE-2026-18963 (Keycloak), and GHSA-p9r8-2q67-fp86 (AMMOS Instrument ToolkiT-GUI).

🎥 Cybersecurity Webinars

• AI Coding Is Creating Remediation Debt. See What 300 Enterprise Leaders Found → AI coding is accelerating improvement, nevertheless it’s additionally pushing extra unvetted open supply into manufacturing and increasing the backlog safety groups should handle. See what 300 enterprise safety and engineering leaders revealed in regards to the rising threat, and which governance approaches are literally serving to groups regain management.
• AI Attacks Can Move in Minutes. Can Your Security Operations Keep Up? → AI is compressing vulnerability discovery, exploit improvement, and assault chaining into a lot shorter home windows. Be taught a sensible AI threat-readiness framework for enhancing attack-surface visibility and accelerating investigation, validation, and remediation earlier than machine-speed threats outpace present safety operations.

📰 Across the Cyber World

• Dwell Stripe keys for 659 retailers leaked — A dataset printed on a data-trading discussion board on August 18, 2026, comprises dwell Stripe API keys for 659 service provider accounts, together with roughly 35 GB of buyer and fee knowledge pulled from them. “A Stripe secret key isn’t a password to a dashboard,” Ransomnews said. “It’s full programmatic entry to the account. Anybody holding one can learn each buyer report, create expenses, problem refunds, and alter the place payouts are despatched. The 519 accounts in that backside row may, on the collector’s personal report, each take cash in and transfer it out.”
• CISA Releases Steering for Enhancing Operational Requirements — The U.S. Cybersecurity and Infrastructure Safety Company (CISA) printed the Logging Reference Structure for federal businesses to determine logging, visibility, and operational requirements in an Company Logging Plan. The steerage implements a sensible, risk-based, prioritized logging method that improves company community monitoring. “Cyber protection begins with perception. Strong logs present the crucial visibility wanted to counter day by day threats concentrating on federal techniques. CISA is enhancing company logging methods to make sure safety groups can quickly detect and reply to cyber incidents,” said CISA Appearing Government Assistant Director for Cybersecurity Chris Butera. “The Logging Reference Structure guides businesses away from fragmented practices, establishing a mature enterprise functionality that maximizes the operational worth of their knowledge.”
• U.S. Court docket Partially Overturns Ex-Google Engineer’s Conviction — Linwei Ding, a former Google software program engineer who was convicted earlier this yr for allegedly stealing 1000’s of the corporate’s confidential paperwork to construct a startup in China, had a part of the ruling overturned by a U.S. federal choose final week. In accordance with Reuters, U.S. District Court docket Decide Vince Chhabria in San Francisco dominated there was not sufficient proof that the defendant supposed or knew his conduct would profit the federal government of China. Ding is scheduled to be sentenced on September 1, 2026.
• How Risk Actors Abuse ScreenConnect — Risk actors are utilizing varied strategies, starting from phishing lures and Search engine optimisation-poisoned balenaEtcher downloads to malvertising redirects and an already-resident SimpleHelp agent, to deploy ScreenConnect by way of PowerShell and msiexec. “Within the one case that reached full hands-on management, the operator rotated domains, deployed a number of ScreenConnect situations disguised as Microsoft providers, layered persistence throughout providers, SafeBoot, and credential suppliers, and ran scripts to evict rival RMM instruments earlier than forcing a reboot,” Pattern Micro said.
• DCRat in 2026 — Judicial‑themed phishing lures are getting used to propagate DCRat, per Trellix. “Each stage of the assault required human interplay, from opening the phishing electronic mail to extracting the archive to executing the malicious elements alongside trusted libraries by utilizing DLL sideloading,” the cybersecurity firm said. “In its remaining stage, the malware employed course of hollowing to inject malicious code right into a trusted system course of, successfully evading detection. The top payload was DCRat, granting attackers full distant entry and management. This marketing campaign is especially notable for a authentic, signed utility to bypass conventional safety perimeters.”
• Utilizing Apple’s Discover My to Observe Dwell Location — A safety researcher who goes by the title Zerotistic has devised a option to enroll a Linux-based machine into Apple’s Discover My community and browse dwell location knowledge from it for many who have opted to share their places with the Apple account proprietor.
• WebAudio Fingerprinting on Alibaba — Developer Matt Callaghan has accused Alibaba’s AliExpress of making an attempt to trace net customers by enjoying sounds via browsers weak to audio fingerprinting. The software program engineer found the problem late final week after investigating why his Bluetooth headphones stopped enjoying music each time he visited the AliExpress web site. “Shortly after loading the AliExpress homepage, audio from my telephone would cease enjoying,” Callaghan stated. “Closing the AliExpress tab fixes it instantly. Muting the tab/Firefox/Home windows doesn’t assist, and there’s no seen video, music, or different media enjoying on the web page.” Firefox issued an announcement on X saying its anti-fingerprinting expertise blocks Alibaba’s monitoring approach. Tom Ritter, who leads safety efforts for Mozilla Firefox, said: “We made the WebAudio fixed in Firefox 118 three years in the past as a part of our preliminary spherical of Fingerprinting Safety options. This eradicated a lot of the variations.”
• Anthropic Expands Claude Mythos 5 Entry — Anthropic stated it is working with cybersecurity expertise and providers companions to combine Claude Mythos 5 into their services to safe their software program. “Prospects on Claude Enterprise plans can now run our most succesful mannequin in Claude Safety, utilizing it to scan their codebases for safety vulnerabilities and counsel patches,” it said. “Our new Defender Benefit Fund (0xDAF) will present $35 million in credit to organizations working to patch vulnerabilities in open-source initiatives, automate components of the method of scanning and patching open-source software program, and experiment with new safety approaches.”
• Agentic Supply Code Assessment — Google said it makes use of what’s known as the Agentic Vulnerability Discovery Harness (AVDH) to “quickly analyze code and discover exploit paths throughout proactive evaluations, penetration checks, pink crew operations, and incident response engagements.” The event comes amid growing adversarial misuse of AI. The tech big stated its use of AVDH over the previous 10 months has led to the invention of over 100 true-positive crucial vulnerabilities, together with crucial flaws in Drupal (CVE-2026-13242 and CVE-2026-55803). The system outlined by Google is similar to Microsoft’s MDASH.

• 768 Leaked Company AWS Keys Maintain Full Admin Rights — Truffle Safety’s scan has verified 64,024 distinctive AWS key pairs throughout 431,875 public findings, together with git historical past, Hugging Face datasets, Docker photographs, package deal registries, CI logs. These keys surfaced publicly between August 2022 and August 2026. Of those pairs, 10,616 got here with full credentials. In accordance with Truffle Safety: “”88% nonetheless authenticate. 768 of the dwell ones belong to an organization and carry full management of its AWS account: 526 root keys plus 242 IAM customers holding AdministratorAccess. The median dwell leaked secret is 5 years previous and has by no means been rotated.”

Conclusion

This week’s helpful reminder: attackers not often want the whole lot to fail. One uncovered service, one trusted shortcut, or one neglected dependency could be sufficient to get began.

So the higher query isn’t “what’s the following huge risk?” It’s “what are we nonetheless assuming is protected?” That often finds the issue sooner.