The Dutch NCSC saw attackers using CVE‑2026‑65400 to bypass authentication on macOS Screen Sharing when port 5900 is internet‑exposed, gaining root and deploying Monero mining software. The bug affects Sequoia 15.7.9, Sonoma 14.8.9 and Tahoe 26.6.1; Apple’s patches should be applied now.
A critical SAP Commerce Cloud remote code execution bug (CVE‑2026‑58231) was patched three days ago, yet threat intel firm Defused observed active exploitation on its honeypots. The flaw lets unauthenticated attackers run arbitrary code, jeopardizing any high‑profile e‑commerce site that hasn’t patched.
Within hours of public disclosure, threat actors began probing GeoServer instances for an unauthenticated SQL injection in the jsonArrayContains filter that can lead to remote code execution. WatchTowr recorded hundreds of attempts from a handful of IPs, and with no patch available, organizations should isolate exposed servers and monitor for malicious activity.
Reco uncovered a long-running campaign that exploits guest-user access in Salesforce Experience Cloud and ServiceNow Service Portals. Using a bespoke Go-based toolset, the attacker enumerates Aura, LWR and ServiceNow search endpoints, exfiltrating records from telecoms, banks and public-sector sites. The operation has been active since March 2025, targeting any organization with over-permissive guest access.
After a credential‑spray into an un‑MFA’d SonicWall SSL VPN, an Akira affiliate RDP’d to the domain controller, stole data, then forced the host into Safe Mode with Networking via msconfig.exe. The reboot disabled Huntress’s agent and Microsoft Defender, but also caused memory errors that halted the encryptor. Incident shows anti‑EDR tricks can backfire and why safe‑mode reboots should trigger alerts.
Shell confirmed it is looking into a possible breach after Clop ransomware gang posted 89 GB of engineering drawings, test reports, and facility photos on its leak site. The data appears to have been taken from exposed PTC Windchill/FlexPLM systems vulnerable to CVE‑2026‑12569. If true, the leak could reveal critical infrastructure designs to adversaries.
OpenAI introduced Computer History, an opt‑in macOS feature that records clicks, keystrokes and app switches as local markdown memory files, replacing the earlier Chronicle preview that captured continuous screenshots. The shift removes invasive screenshot surveillance but still raises privacy concerns because detailed activity logs are stored locally and processed on OpenAI’s servers for context.
You’re caught up.
That was all 7 stories in the 15 August issue.