This Cybersecurity Weekly Report landed on a familiar theme: the gap between disclosure and exploitation keeps shrinking. CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog in just seven days. One of them, a JetBrains TeamCity flaw, went from “no known exploitation” to active cyber attacks in under two weeks. Another a chained Progress LoadMaster bug racked up hundreds of exploitation attempts before organizations had even finished testing patches.
The incident side of the ledger told a similar story about where attackers are now aiming. A supply-chain compromise at a single UK CRM vendor, Beacon, rippled out to more than 1,500 charities, including the English National Ballet. Meanwhile, a still-unattributed intrusion forced North Carolina’s three ports into manual cargo processing for several days, a reminder that patch management gaps at critical infrastructure operators carry consequences well beyond IT.
There was some resolution, too. A Canadian hacker’s guilty plea in the Snowflake extortion campaign closed one chapter of 2024’s biggest cloud breach yet this week proved the underlying playbook (stolen credentials, no MFA, mass extortion) hasn’t gone anywhere. For SOC teams and CISOs alike, the throughline is patch tempo: Microsoft’s August Patch Tuesday lands imminently after a record-breaking July, and the organizations still catching up on last month’s fixes are the ones most exposed to what’s coming next.
MAJOR INCIDENTS
1. North Carolina Ports cyberattack disrupts three facilities
An unattributed cyberattack struck the North Carolina Ports Authority’s IT systems late on August 4, forcing the Port of Wilmington, Port of Morehead City, and the Charlotte Inland Port into manual gate processing. The authority moved fast: it activated its cybersecurity contingency plan, engaged the U.S. Coast Guard, the state’s Department of Information Technology, and the Department of Transportation, and said the breach was contained by the morning of August 5.
Gates were back on a normal schedule by August 7, though delays continued as systems were restored. Wilmington alone handles more than 5,000 container gate moves weekly and roughly 600,000 TEU annually ,no small operation to run on paper and radio. No attacker has claimed responsibility, and the authority has not said whether commercial or employee data was accessed, nor whether a ransom was demanded.
Why This Matters: Critical logistics infrastructure remains an attractive target precisely because even a short IT outage cascades into real-world freight delays. And the lack of attribution nine days later says something worth remembering: most of the incident response work happens quietly, long after the headlines fade.
2. Levi Strauss discloses corporate data theft via vishing
Levi Strauss & Co. filed an SEC Form 8-K on August 7 disclosing that an unauthorized third party used social engineering not a software exploit against three employees to gain access to company-issued computers and exfiltrate corporate information. No malware, no zero-day. Just three convincing phone calls. The company said its rapid response contained the intrusion, that no consumer data was affected, and that it does not expect a material financial impact. No group has publicly claimed the attack, though some researchers have linked the activity to UNC6671, a cluster Google’s Threat Intelligence Group associates with a recent wave of voice-phishing campaigns that hit more than 200 organizations over five weeks.
Why This Matters: Three phone calls, zero exploited vulnerabilities a reminder that help-desk impersonation and voice cloning are now cheap enough to bypass technical controls entirely.
3. Unlimited Technology Systems healthcare breach hits 3.8 million people
Ohio-based revenue-cycle-management vendor Unlimited Technology Systems disclosed that an unauthorized actor accessed its commercial data center between October 5 and 10, 2025, and may have obtained files belonging to patients of the 4,500-plus oncology practices and 6,500 specialty providers it serves. HHS’s Office for Civil Rights portal lists 3,803,750 affected individuals making this the largest healthcare data breach reported so far in 2026, ahead of Trizetto Provider Solutions’ 3.4 million-record incident. Exposed data includes names, Social Security numbers, medical record numbers, diagnoses, and scanned identity documents, though not full medical records or payment card data. No extortion group has claimed responsibility.
Why This Matters: A ten-month gap between intrusion and public disclosure at a business-associate vendor illustrates why HIPAA’s proposed update aims to tighten oversight of the third parties that increasingly sit at the center of healthcare’s largest breaches.
4. Beacon CRM breach exposes UK charity donor data
Beacon, a customer-relationship-management platform used by more than 1,500 UK charities, confirmed on August 3 that compromised credentials gave an unauthorized party access to its systems on July 29, resulting in the copying of database backups. The advice to customers was blunt: assume all stored data names, addresses, phone numbers, dates of birth, and donation histories – was downloaded, and be aware that encrypted fields may have been decrypted. Affected organizations include the English National Ballet and charities working with the Scottish Council for Voluntary Organisations. The UK Charity Commission confirmed it is coordinating with the Information Commissioner’s Office as the lead data-protection regulator.
Why This Matters: This is a textbook single-vendor cascade. One compromised CRM account put donor and beneficiary data from homeless-services charities, hospices, and abuse-support organizations simultaneously at risk.
5. Liechtenstein beneficial-ownership register breached
Unknown attackers accessed Liechtenstein’s Register of Beneficial Owners overnight on July 29–30, exfiltrating data on roughly 31,000 companies, foundations, and trusts before the Office of Justice detected the intrusion and took the system offline. The government convened a crisis unit. Officials say there is no evidence data was altered and that no banking information was exposed. The register, created under EU anti-money-laundering rules, identifies the individuals who ultimately control legal entities often used by international wealth-management structures.
Why This Matters: Registries built specifically for financial transparency becoming breach targets is a pointed irony. And the exposure has implications well beyond Liechtenstein: UK and US wealth managers whose clients hold Liechtenstein-domiciled structures now have their own disclosure question to answer.
ANALYST INSIGHT: Three of this week’s five major incidents – Beacon CRM, Unlimited Technology Systems, and the Liechtenstein register – are single-point-of-failure breaches at an intermediary rather than the ultimate data owner. Whether it’s a CRM vendor, a revenue-cycle processor, or a government registry, attackers are increasingly choosing the aggregation point over the individual target, because one compromise now yields hundreds of downstream victims at once.
NEW VULNERABILITIES & PATCHES
CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog this week, all independently confirmed via CISA’s own advisories. Taken together, they’re a good snapshot of how fast a vulnerability disclosure can turn into a live incident – several of these went from patch release to confirmed exploitation in days, not months.
[CVE] CVE-2026-63077 – JetBrains TeamCity (CVSS 9.8)
An unauthenticated deserialization-of-untrusted-data flaw in TeamCity On-Premises’ agent polling protocol lets an attacker with network access bypass authentication and run arbitrary OS commands with server-process privileges. JetBrains disclosed the bug and said it saw no active exploitation on July 27. CISA confirmed in-the-wild attacks just nine days later, on August 5, and gave federal agencies an unusually short three-day remediation window. Fixed in TeamCity 2025.11.7 and 2026.1.3; a security patch plugin covers versions back to 2017.1.
- Exploitation status: Actively exploited.
- Mitigation: Upgrade immediately or apply JetBrains’ interim patch plugin; restrict TeamCity server exposure to VPN-only access.
- Business impact: A compromised build server can leak source code, cloud credentials, and signing keys, and tamper with downstream CI/CD artifacts – this is a supply-chain risk, not just a server compromise.
[CVE] CVE-2026-8037 – Progress LoadMaster (CVSS 9.6)
An unauthenticated command-injection flaw in the LoadMaster load balancer’s API lets attackers execute arbitrary commands as root by exploiting improper quote-escaping in multiple command endpoints. Proof-of-concept code has circulated since late June. eSentire recorded active exploitation attempts beginning June 29. CISA added it to KEV on August 7 with a federal remediation deadline of August 10.
- Exploitation status: Actively exploited; reported in the hundreds of attempts.
- Mitigation: Apply the vendor patch immediately; restrict management API access. –
- Business impact: LoadMaster sits at the network edge in front of production traffic – root-level compromise there is a direct path to lateral movement and ransomware staging.
[CVE] CVE-2026-9198 – IBM Langflow OSS (CVSS 9.8)
Chaining an unauthenticated endpoint that issues superuser tokens with a code-validation endpoint that runs arbitrary Python lets an attacker achieve full remote code execution on default Langflow deployments. IBM patched it in version 1.10.1 on July 17. Functional PoCs appeared roughly a week later, and telemetry from KEVIntel recorded 650 exploitation attempts from 244 unique IPs across 41 countries.
- Exploitation status: Actively exploited.
- Mitigation: Upgrade to Langflow 1.10.1 or later without delay.
- Business impact: AI-agent development platforms like Langflow increasingly touch production data pipelines, so RCE here can expose whatever the platform is orchestrating, not just the server itself.
[CVE] CVE-2026-18556 & CVE-2026-18577 – N-able N-central (CVSS 8.2 and 7.4)
An authentication-bypass flaw in N-able’s remote monitoring and management platform was exploited as a zero-day before N-able’s initial patch proved incomplete. A hotfix issued in late July generated a second CVE for the bypass of that fix. Both are now in KEV.
- Exploitation status: Actively exploited.
- Mitigation: Apply N-able’s latest hotfix and verify against both CVE IDs, not just the first.
- Business impact: N-central is an RMM platform used heavily by MSPs – a single compromised instance can cascade into every downstream client tenant it manages.
[CVE] CVE-2026-34486 – Apache Tomcat (CVSS 7.5)
An April patch for a padding-oracle issue in Tomcat’s optional EncryptInterceptor cluster-messaging component introduced a regression. Moving one line of code flipped the encryption layer from fail-closed to fail-open, opening a path to unauthenticated remote code execution on clustered Tomcat deployments using that interceptor.
- Exploitation status: Actively exploited.
- Mitigation: Apply the corrected patch and confirm EncryptInterceptor configuration explicitly.
- Business impact: A textbook reminder that patches themselves need regression testing – the fix for one bug quietly created another.
PRIORITY ACTION: If your organization runs internet-facing build infrastructure, load balancers, or RMM tooling, patch TeamCity and LoadMaster first – both carry CVSS scores above 9.5, are confirmed under active exploitation, and sit at chokepoints that give attackers outsized downstream access.
RANSOMWARE ACTIVITY
Ransomware volume stayed elevated through late July into this reporting week. Independent tracking from Comparitech, cited by The Register, recorded 799 ransomware attacks globally last month – the second-busiest month of the year – with the United States the most-targeted country by a wide margin.
Qilin, the group behind the 2024 Synnovis attack that disrupted NHS pathology services, claimed 125 victims in July alone. The Gentlemen tell a different story: a RaaS operation that only launched in mid-2025, it has already scaled to hundreds of publicly listed victims, largely by offering affiliates a 90% revenue share – among the highest cut in the underground economy.
On the law-enforcement side, there was one piece of good news. Connor Riley Moucka, a 26-year-old Canadian also known by the aliases “Waifu” and “Judische,” pleaded guilty on August 5 in a Washington state federal court to computer fraud, wire fraud, aggravated identity theft, and conspiracy tied to the 2024 Snowflake extortion campaign – one of the largest data-theft malware campaigns of the past two years.
Moucka and co-conspirators used credentials stolen via infostealer malware to access at least 165 Snowflake customer accounts that lacked multi-factor authentication, stealing data from companies including AT&T, Ticketmaster, and Santander, and extorting at least $2.5 million in ransom payments. He faces up to 32 years in prison at an October 27 sentencing.
Healthcare remains disproportionately targeted. A Comparitech report found 410 ransomware attacks against healthcare organizations in the first half of 2026, a 14% rise from the second half of 2025, with median ransom demands around $310,000 for providers.
CYBERINFOS TAKEAWAY: The Snowflake case closes with a familiar lesson that keeps repeating across this week’s incidents – none of the 165 breached accounts had multi-factor authentication enabled. Two years and one guilty plea later, MFA gaps on cloud storage accounts remain one of the cheapest fixes with the highest payoff against exactly this kind of mass-extortion campaign.
THREAT INTELLIGENCE
[TTP] CaptiveCrunch – Midnight Blizzard hijacks hotel Wi-Fi
Microsoft Threat Intelligence disclosed on July 31 that Storm-2945, an operational sub-cluster of the Russian SVR-linked group Midnight Blizzard (also known as APT29 or Cozy Bear), has been manipulating DNS and HTTP traffic on hospitality-venue captive portals since early May 2026, in a campaign it calls CaptiveCrunch. Compromised hotel and conference-center Wi-Fi networks redirect travelers into phishing attacks that impersonate Microsoft 365 sign-in flows and fake OS or browser update prompts.
[IOC] Two malware tools are involved: CornFlake, a Go-based Windows RAT with keylogging and screen-capture capabilities, and ChocoShell, an in-memory PowerShell credential stealer that uses UAC-bypass techniques and Chrome DevTools Protocol abuse to extract browser cookies and Microsoft 365 SSO tokens despite Chrome’s App-Bound Encryption. The group has also run AI-augmented device-code and OAuth phishing against Entra ID since February 2026. Microsoft credited Anthropic and OpenAI for collaboration during the investigation.
Business impact: A single business traveler connecting to compromised hotel Wi-Fi can hand attackers an MFA-satisfied token straight into corporate Microsoft 365 and Azure environments – no credential entry required.
[TTP] LAUNDRY BEAR’s Zimbra exploitation continues to reverberate
The joint CISA/NSA/FBI advisory on LAUNDRY BEAR’s exploitation of a Zimbra Collaboration Suite zero-click flaw (CVE-2025-66376) was published in late July, but the campaign’s Western targeting – spanning defense contractors, government, law enforcement, and NGOs – remains an active concern heading into this week, with the NCSC among the co-signing agencies. The exploit requires only that a user view a crafted email in a vulnerable Zimbra Classic webmail session. That’s one of the more unsettling security vulnerabilities in this week’s roundup precisely because it needs no click, no download, nothing beyond opening the message.
Business impact: Organizations still running unpatched ZCS Classic UI should treat this as an active, not historical, risk – patches have existed since November 2025, but adoption lags.
INDUSTRY NEWS
NCSC responds to frontier AI safety incidents.
On August 4, NCSC Chief Technology Officer Ollie Whitehouse issued a statement following reports of frontier AI models carrying out unsanctioned, human-like deceptive actions during evaluations. His point was simple but pointed: these systems need strong safeguards, real-time oversight, and incident response plans built in from the outset, because detection after the fact won’t be enough.
Why it matters: As agentic AI tools get wider enterprise deployment, security teams should expect governance and oversight requirements not just capability benchmarks to become a bigger part of AI procurement conversations.
North Korean IT worker alert reissued.
The US State Department, UK Foreign, Commonwealth & Development Office, and international partners jointly warned this week that North Korea continues to rely on networks of remote IT workers using false identities to fund its weapons programs.
Why it matters: Hiring pipelines and remote-contractor vetting remain an underappreciated attack surface. HR and procurement teams should be looped into this advisory, not just security.
DCMS opens the 2026/2027 UK Cyber Security Breaches Survey.
The Department for Science, Innovation and Technology began surveying UK businesses, educational institutions, and charities on their security posture and incident experience.
Why it matters: Prior years’ survey data has directly shaped UK cyber policy and Cyber Essentials requirements participation feeds the evidence base regulators use.
Patch-volume trend continues.
Following July’s record 621-CVE Microsoft release, analysts tracking Patch Tuesday cadence say August’s release (expected 200–300+ CVEs) confirms sustained high-volume patching is the new normal rather than a one-off spike. It’s a shift Microsoft’s own MSRC guidance has already acknowledged this year, and one that keeps pushing patch management further up the SOC operations priority list.
TOOL UPDATES
Rapid7 publishes technical analysis of CVE-2026-63077.
Rapid7 Labs’ write-up on the JetBrains TeamCity deserialization flaw details how a permissive XStream allowlist in vulnerable servers fails to strip default deserialization permissions, and confirms that the vendor patch – which adds NoTypePermission.NONE ahead of the TeamCity allowlist – successfully closes the gap. A public proof-of-concept is available for defenders to validate their own environments.
Use case: Blue teams can use the analysis to build detection signatures for anomalous agent-polling-protocol traffic ahead of confirming patch deployment.
Metasploit shifts to a bi-weekly wrap-up cadence.
Rapid7 confirmed the long-running Weekly Metasploit Update blog is moving to a bi-weekly schedule, while the framework itself continues weekly code releases. Recent additions have included modules targeting recently disclosed RCE and SSRF flaws in self-hosted platforms.
Use case: Teams that rely on the wrap-up for patch-prioritization signal should adjust monitoring cadence and check GitHub release notes directly for anything time-sensitive.
Senserva’s KEV tracker highlights the compressed patch window.
Third-party tooling built on CISA’s KEV feed flagged this week’s run of additions in near-real time, underscoring how quickly a CVE can move from disclosed to on the federal remediation clock.
Use case: Free KEV-monitoring feeds are a low-cost way for smaller security teams without dedicated threat-intel subscriptions to stay ahead of the federal remediation deadlines that often serve as an informal industry patch-priority signal for cyber defense planning.
LOOKING AHEAD
Microsoft’s August Patch Tuesday lands August 11, exactly one month after July’s record-breaking 621-CVE release. Analysts are forecasting another 200–300+ CVE release, with early signals pointing to a Windows kernel privilege-escalation bug and a chained SharePoint remote-code-execution issue among the highest-priority items. That’s worth noting given that CVE-2026-50522, a SharePoint RCE from the July release, is already under active exploitation. Organizations still working through July’s backlog should prioritize SharePoint before this month’s release compounds the queue.
[WATCH] North Carolina Ports attribution remains unresolved. Nine days after the intrusion, no threat actor has claimed responsibility, and the authority has not disclosed the initial access vector or confirmed whether data was stolen. Whether this becomes a ransomware disclosure, a nation-state espionage story, or resolves quietly will shape how critical-infrastructure operators in the transportation sector benchmark their own incident response plans.
Also worth tracking: the ICO’s ongoing coordination with the UK Charity Commission on the Beacon CRM breach, which could set a regulatory precedent for supply-chain breach notification obligations among third-sector data processors. And whether N-able’s second patch for CVE-2026-18577 fully closes the N-central authentication-bypass chain, or triggers a third round.
BY THE NUMBERS
| Metric | Figure | Source |
|---|---|---|
| New CVEs added to CISA KEV this week | 6 | CISA KEV catalog |
| Highest CVSS score among new KEV entries | 9.8 (TeamCity, Langflow) | CISA / vendor advisories |
| People affected, Unlimited Technology Systems breach | 3,803,750 | HHS Office for Civil Rights |
| Legal entities affected, Liechtenstein register breach | ~31,000 | Government of Liechtenstein |
| UK charities using the breached Beacon CRM platform | 1,500+ | Beacon CRM / Charity Commission |
| Global ransomware attacks recorded in July 2026 | 799 | Comparitech (via The Register) |
| Ransom extorted in Snowflake campaign | ~$2.5 million | US Department of Justice |
| Snowflake-linked organizations breached (2024 campaign) | 165 | US Department of Justice |
| Federal remediation deadline for Progress LoadMaster CVE | August 10, 2026 | CISA BOD 26-04 |
| Expected CVE count, August 2026 Patch Tuesday | 200–300+ (forecast) | Industry analyst estimates |
RECOMMENDED READING
- CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild – The Hacker News’s breakdown of the compressed disclosure-to-exploitation timeline.
- North Carolina Ports confirms cyberattack disrupting operations – BleepingComputer’s initial report on the port authority incident.
- UK charities count the cost of Beacon CRM cyberattack -The Register’s on-the-ground reporting from affected charities.
- Canadian Man Pleads Guilty in Snowflake Extortions – Krebs on Security’s detailed background on the Moucka case.
- CaptiveCrunch: Midnight Blizzard targets travelers worldwide – Microsoft’s original technical disclosure of the hotel Wi-Fi campaign.
- Guidance for charities affected by the Beacon cyber security incident – Official UK Charity Commission guidance.
- CISA Warns of Exploited Langflow, N-central, and Tomcat Vulnerabilities – SecurityWeek’s consolidated coverage of the three-CVE KEV addition.
