Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
A functional Wednesday led by an active-exploitation alert on Australian soil, the latest Microsoft Copilot Personal flaws, and a fresh spike in AI-agent and cloud-credential attacks. First, the Australian Cyber Security Centre (ACSC) issued a High-rated alert on 19 August for active exploitation in Australia of N-able and N-central remote monitoring and management (RMM) platform vulnerabilities, tracked as CVE-2026-18556 and CVE-2026-18577, urging organisations to assess exposure and apply mitigations. This is a direct and rare AU-first active-threat warning and reinforces the RMM supply-chain theme running through the year. Second, Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal — collectively "CoSnitch" (CVE-2026-24301) — that let a single click on a crafted link silently exfiltrate data from connected apps; the flaws turn on an undocumented `autorun=1` URL parameter Copilot itself surfaced during testing, and Microsoft shipped patches on 18 August. Third, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalogue on 18 August covering Microsoft Internet Key Exchange (IKE), Broadcom VMware vCenter, Microsoft SharePoint and Apple macOS, with the catalogue's MLflow SSRF entry updated on 19 August — the third straight adult cyber-news day anchored by CISA patch prioritisation.
The ACSC's active-exploitation alert for N-able/N-central is the standout Australian development and should be treated as priority remediation for any local organisation running remote-monitoring software. RMM tools have been a defining attack vector in Australian-targeted intrusions throughout 2026, and this is the clearest active-exploitation warning to Australian organisations in the cycle. It sits alongside the ASD ISM and Essential Eight patching obligations — under APRA CPS 234, regulated financial firms holding N-able/N-central in scope face a direct compliance imperative to assess exposure promptly. The deepfake-scam warning from ASIC, which surfaced in this cycle, continues the AU regulatory focus on AI-enabled fraud and identity theft against Australian consumers and investors, reinforcing the OAIC Notifiable Data Breaches scheme and ACSC guidance on AI-assisted social engineering. The CoSnitch findings on consumer AI assistants are directly relevant to Australian individuals and the growing Base-layer of agentic AI tools in local enterprises, while the week's US RMM/KEV activity is a Five Eyes signal Australian defenders should monitor as BOD 26-04-style prioritisation continues.
Incident Map
Government 3 stories
ACSC Issues High-Rated Alert on Active Exploitation of N-able Slopes — Australia Priority
The Australian Cyber Security Centre (ACSC) issued a High-rated alert on 19 August warning of active exploitation in Australia of N-able and N-central remote monitoring and management (RMM) vulnerabilities tracked as CVE-2026-18556 and CVE-2026-18577. The ACSC rated the alert High and directed Australian organisations — across business, critical infrastructure and government — to assess exposure and apply mitigations. This is a direct, Australia-specific active-threat warning in an RMM product class long-targeted by Australian campaigns. **Verification: Verified** (official ACSC alert; High rating).
Berlin Cuts Two State Ministries Off Government Network After Security Breach
Berlin cut two state ministries off the German government network following a security breach, in an operation actors reportedly linked to the supply-chain issue affecting the government network. The move is the latest in a wave of German and European government-network incidents this year, and illustrates the operational trade-off between availability and containment when a breach is detected in shared government infrastructure. **Verification: Reported** (outlet-reported incident; government confirmed network separation). **Breach: Probable breach**
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on 18 August: Microsoft Internet Key Exchange (IKE) service extensions (CVE-2026-33824), Broadcom VMware vCenter path traversal (CVE-2026-59310), Microsoft SharePoint weak authentication (CVE-2026-55040) and Apple macOS improper authentication (CVE-2026-65400). The additions carry a two-week federal remediation obligation under BOD 26-04 and signal confirmed exploitation in the wild across Windows, VMware, SharePoint and macOS. A further MLflow SSRF entry was added on 19 August (CVE-2026-64849). **Verification: Verified** (official CISA KEV entries).
Global (Macro) 4 stories
Microsoft Copilot Personal Flaws Let One Click Exfiltrate Data From Connected Apps — CoSnitch
Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal that could allow a single click on a crafted link to silently exfiltrate data from connected apps and other information available to the victim's Copilot session. The flaws, collectively named **CoSnitch** (CVE-2026-24301), turn in part on an undocumented `autorun=1` URL parameter that Copilot itself surfaced during testing; the researchers reported the issue to Microsoft in December 2025 and patches shipped 18 August. The group found no evidence of in-the-wild exploitation. **Verification: Verified** (vendor-researched disclosure, patch published).
Critical GitLab GraphQL Flaw Lets Unauthenticated Attackers Delete Public Projects
GitLab patched a critical vulnerability in its GraphQL API that could allow an unauthenticated attacker to delete public projects, disclosed with a zero-click angle. The flaw, reported on 17 August, adds to a busy week of critical web-application findings and reinforces GitLab's position as a high-value, internet-facing target. **Verification: Verified** (vendor advisory; reported by multiple outlets).
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Researchers documented a single threat actor continuously scraping both Salesforce and ServiceNow web portals since 2025, harvesting data exposed in those customer-facing SaaS platforms. The finding underscores the pivot to **SaaS-scraping as a low-friction mass-compromise technique**, where public/waters surfaces on widely used enterprise platforms are mined at scale rather than exploited by a single breach. **Verification: Reported** (researcher-identified campaign; no single exclusive newscaster). **Breach: Unverified claim** (attributed scraping activity).
Medusa Ransomware Tallying Hundreds of New Victims; CISA Updates Tactics
CISA identified more than 200 victims of the Medusa ransomware operation over the last year and updated its advisory on the group's tactics, techniques and procedures. The updated advisory reflects a continuing and high-volume Ransomware-as-a-Service targeting pattern and gives defenders fresh detection guidance, in line with CISA's ongoing KEV and advisory cadence. **Verification: Verified** (CISA/agency advisory reported by the outlet). **Breach: Confirmed breach** (multiple victim entities per advisory).
Healthcare 1 story
American Addiction Centers & Octopus Pathology Disclose Hacking Incidents
American Addiction Centers and Oculus (Octopus) Pathology disclosed hacking incidents involving unauthorised access to protected health information. Both entities filed the required notifications consistent with federal and state breach-notification rules; details on record volumes and impacted individuals were limited in the early disclosures. **Verification: Verified** (companies disclosed incidents to regulators). **Breach: Confirmed breach**
Financial Services 2 stories
ASIC Warns of Deepfake Scam Surge Against Australian Consumers
The Australian Securities and Investments Commission (ASIC) warned of a surge in deepfake-related scams targeting Australian consumers and investors, including authorised-transaction and high-stream fake celebrity/authority models. The warning reinforces the OAIC and ACSC standing guidance on AI-enabled fraud and identity theft, and flags the growing consumer exposure to AI-generated visual content. **Verification: Verified** (Australian regulator public warning).
ANZ Warns of Troubling 'Scam-Coaching' Trend
Australian bank ANZ warned of a "scam-coaching" trend, in which fraudsters coach victims to lie to their bank to subvert scam-prevention controls — a variant of social-engineering designed to defeat the very protections banks and regulators have deployed. The warning is directly relevant to the OAIC Notifiable Data Breach scheme's anti-fraud regime and to the industry's escalating fight against authorised-push-payment scams. **Verification: Verified** (Australian bank warning).
Transport 1 story
Six Arrested as UK Police Target Cargo Theft Costing £70m+ a Year
UK police arrested six people in an operation targeting cargo and freight theft — a logistics-side physical-cyber overlap that moves goods loss into the supply-chain risk picture. The arrests underscore the convergence of organised freight crime with digital coordination of supply chains used by Australian and global shippers. **Verification: Verified** (police action-reported).
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |