Cyber Security Brief — 2026-08-26

A roundup of what's actually happened in security over the last couple of days — real incidents and newly disclosed vulnerabilities, not filler.

In the news

INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown (The Hacker News) — An eight-month INTERPOL operation targeting West African organized crime groups has led to arrests of 58 people and the identification of 263 suspects. "The operation, which brought together 22 countr…
Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode (The Hacker News) — An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER, that stays inert in memory until a specifically crafted network packet reaches the machin…
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload (The Hacker News) — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability…
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes (The Hacker News) — Cybersecurity researchers have disclosed details of a phishing-as-a-service (PhaaS) platform built to strip Apple's Activation Lock from stolen devices, using rented AI voice agents that call theft vi…
LACMA data breach last year exposed social security and medical data (BleepingComputer) — The Los Angeles County Museum of Art (LACMA) has announced that a breach last year exposed customer and employee information. [...]

Newly published, high-severity CVEs

CVE-2026-78570 (CVSS 9.8, CRITICAL) — The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an a…
CVE-2026-49845 (CVSS 9.8, CRITICAL) — SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partit…
CVE-2026-79657 (CVSS 9.8, CRITICAL) — NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payload…
CVE-2026-16286 (CVSS 9.8, CRITICAL) — Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a We…

Source: NIST National Vulnerability Database.

How our own customers' sites are doing

We ran 3 Security Score scans across our customers in the past 7 days.

medium: 4
info: 19
high: 7
low: 9

Most common issues:

Cross-origin stylesheet loaded without Subresource Integrity (seen 6x)
DKIM not detected at common selectors (seen 3x)
No DMARC record (seen 3x)
DNSSEC not detected (seen 3x)
Missing recommended headers (1) (seen 2x)

If any of the above sounds familiar, the fix is usually quick: missing security headers and outdated front-end libraries are the two most common findings we see, and both are typically a same-day fix. Run a free Security Score scan to see where your own site stands.

This brief is generated daily from CISA's KEV catalog, NIST's NVD, a small set of established security news feeds, and Hebrides Cyber's own (anonymised) scan data. Set AZURE_OPENAI_ENDPOINT/KEY/DEPLOYMENT for a narrative AI write-up instead of this templated summary — see src/lib/newsletter.ts.