2026-08-26: CISA adds actively exploited Gitea RCE to KEV catalog with a Thursday patch deadline

Show Notes - 2026-08-26

Stories Covered: - Today: - Critical Gitea RCE Actively Exploited as CISA Issues Patch Deadline (CVE-2026-60004) (https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html) - NVIDIA NemoClaw Local AI Model Poisoning via DNS Rebinding (No CVE) (https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html) - SLEEPWALKER Backdoor Uses Custom 23-Instruction Language and Network Trigger Packets (https://thehackernews.com/2026/08/newly-sleepwalker-backdoor-waits-for.html) - Fake Apple Support AI Voice Calls Target Stolen Device Owners (AnonyMousKIT PhaaS) (https://thehackernews.com/2026/08/fake-apple-support-ai-calls-target.html) - Coordinated MyChart Phishing Targets Epic Patient Portal Passwords (https://databreaches.net/2026/08/25/health-systems-warn-of-coordinated-phishing-targeting-epics-patient-portal/) - Microsoft Publishes Patch Window Collapse Analysis and Control Plane Recommendations (https://azure.microsoft.com/en-us/blog/the-patch-window-is-collapsing-why-security-needs-a-new-control-plane/) - Russia Begins Blocking DNS-over-HTTPS and DNS-over-TLS Servers (https://news.risky.biz/risky-bulletin-russia-starts-blocking-doh-and-dot/) - INTERPOL Operation Jackal IV Arrests 58 in West African Cybercrime Crackdown (https://thehackernews.com/2026/08/interpol-operation-jackal-iv-arrests-58.html) - U.S. Sanctions Five Iranian MOIS-Linked Hackers Behind Infrastructure Breaches (https://thehackernews.com/2026/08/us-sanctions-iran-linked-hackers-behind.html) - CISA Red Team Assessment Shows Detection Gap Between Two Organizations (https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a) - Q2 2026 Vulnerability Registrations Reach Unprecedented Levels (https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/) - Cybersecurity Affordability Crisis Threatens Small Businesses and Supply Chains (https://www.darkreading.com/cybersecurity-operations/is-cyber-facing-an-affordability-crisis-) - Siemens SIMATIC IoT2050 Advanced Missing Authentication (CVE-2026-58115) (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-03) - Ebyte NE2-D11 Gateway Multiple Authentication Bypasses (6 CVEs) (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06) - Bendix EC80 Brake ECU Stack Overflow and Out-of-Bounds Write (3 CVEs) (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05) - WordPress MiniOrange SAML SSO Plugin Authentication Bypass (CVE-2026-61979, CVE-2026-15981) (https://www.securityweek.com/wordpress-websites-targeted-via-miniorange-plugin-vulnerabilities/) - ZoneMinder Authenticated OS Command Injection (CVE-2026-76060) (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02) - FURUNO FA-50 AIS Transponder Hardcoded Credentials (CVE-2026-59769, CVE-2026-67578) (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-07) - PayRange API Missing Authorization (CVE-2026-18965) (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-04) - Rently Smart Home Credential Protection Weakness (CVE-2026-75960) (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-01)

CVEs Referenced: CVE-2024-28224, CVE-2026-15981, CVE-2026-18965, CVE-2026-58115, CVE-2026-59769, CVE-2026-60004, CVE-2026-61979, CVE-2026-67560, CVE-2026-67578, CVE-2026-68967, CVE-2026-71187, CVE-2026-71396, CVE-2026-73125, CVE-2026-73809, CVE-2026-73839, CVE-2026-75960, CVE-2026-76060, CVE-2026-76179

Indicators of Compromise: IPs: 169.254.169.254, 0.0.0.0, 1.1.1.1, 8.8.8.8

Full brief: https://carolinacleartech.com/brief/2026-08-26/