2026-08-25: Federal agencies have 48 hours to patch a critical Oracle WebLogic flaw already under active

Show Notes - 2026-08-25

Stories Covered: - Today: - Oracle WebLogic Server Proxy Plug-in Improper Access Control (CVE-2026-21962) (https://thehackernews.com/2026/08/actively-exploited-oracle-weblogic-flaw.html) - Zimbra Collaboration Suite SNMP Command Injection (CVE-2026-73570) (https://www.darkreading.com/vulnerabilities-threats/zimbra-flaw-exploitation-shrinking-window-patch) - GitLab Unauthenticated Code Injection (CVE-2026-19478) (https://thehackernews.com/2026/08/weekly-recap-ai-powered-plc-attacks.html) - SynkLoader Malware May Herald Ransomware Attacks (https://www.darkreading.com/threat-intelligence/tricky-synkloader-multitool-ransomware) - ShinyHunters vs ReliaQuest Claim Disputed (https://databreaches.net/2026/08/24/shinyhunters-provided-no-real-proof-they-hacked-reliaquest-because-they-didnt-get-anywhere-reliaquest/) - Mirage2FA Campaign Hits 4,500 Organizations (https://thehackernews.com/2026/08/mirage2fa-surge-hits-4500-us-and-eu.html) - WordlistLoader and SynkLoader Deliver Amatera Stealer via ClickFix (https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html) - E4del and PINHOLE RATs Use FTP Banners as Dead Drop Resolvers (https://thehackernews.com/2026/08/e4del-and-pinhole-rats-turn-ftp-banners.html) - U.S. Warns of AI-Powered Attacks on Siemens PLCs (https://thehackernews.com/2026/08/weekly-recap-ai-powered-plc-attacks.html) - Keycloak Password Reset Bypass Allows Account Takeover (CVE-2026-18963) (https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html) - Latvia Road Traffic Safety Directorate Breach Affects 1.2 Million (https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/) - Sakura Internet Breach Exposes 1.36 Million Customer Accounts (https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/) - Apollo Global Data Breach via Social Engineering (https://www.securityweek.com/personal-information-exposed-in-apollo-global-data-breach/) - Berlin Government Ministries Isolated After Breach (https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/) - AI-Enabled Malware Mostly Proof-of-Concept (https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) - Autonomous AI Agent Exploits GitHub Actions Flaw in Snowflake Repo (https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/) - 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor (https://thehackernews.com/2026/08/weekly-recap-ai-powered-plc-attacks.html) - 24 npm Packages Abuse unpkg Mirrors for ClickFix Phishing (https://thehackernews.com/2026/08/24-npm-packages-abuse-unpkg-mirrors-to.html) - Weedhack Malware Spreads via Fake Minecraft Clients (https://thehackernews.com/2026/08/weedhack-malware-spreads-via-fake.html) - First Malware Built for Car Head Units Fuels Botnet (https://www.securityweek.com/first-malware-built-specifically-for-car-head-units-fuels-botnet/) - Taiwan Charges 9 Over Illegal AI Server Exports to China (https://www.securityweek.com/taiwan-charges-9-over-illegal-ai-server-exports-to-china-including-nvidia-and-super-micro-staff/) - Cisco Crosswork and Secure Workload Critical Flaws (https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/) - Citrix NetScaler ADC and Gateway Vulnerabilities (https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/) - miniOrange SAML Plugin WordPress Vulnerabilities Under Attack (https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html) - NASA/JPL AIT-GUI Critical Command Execution Flaw (https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/)

CVEs Referenced: CVE-2017-10271, CVE-2020-14882, CVE-2020-2551, CVE-2026-15981, CVE-2026-18963, CVE-2026-19478, CVE-2026-19489, CVE-2026-19490, CVE-2026-21962, CVE-2026-61979, CVE-2026-73570

Indicators of Compromise: Domains: 123[.]42, okta[.]com, jsdelivr[ ...