Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Incident Map
Government 3 stories
ACSC Issues High-Rated Alert on Active Exploitation of N-able Slopes — Australia Priority
The Australian Cyber Security Centre (ACSC) issued a High-rated alert on 19 August warning of active exploitation in Australia of N-able and N-central remote monitoring and management (RMM) vulnerabilities tracked as CVE-2026-18556 and CVE-2026-18577. The ACSC rated the alert High and directed Australian organisations — across business, critical infrastructure and government — to assess exposure and apply mitigations. This is a direct, Australia-specific active-threat warning in an RMM product class long-targeted by Australian campaigns.
Berlin Cuts Two State Ministries Off Government Network After Security Breach
Berlin cut two state ministries off the German government network following a security breach, in an operation actors reportedly linked to the supply-chain issue affecting the government network. The move is the latest in a wave of German and European government-network incidents this year, and illustrates the operational trade-off between availability and containment when a breach is detected in shared government infrastructure.
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on 18 August: Microsoft Internet Key Exchange (IKE) service extensions (CVE-2026-33824), Broadcom VMware vCenter path traversal (CVE-2026-59310), Microsoft SharePoint weak authentication (CVE-2026-55040) and Apple macOS improper authentication (CVE-2026-65400). The additions carry a two-week federal remediation obligation under BOD 26-04 and signal confirmed exploitation in the wild across Windows, VMware, SharePoint and macOS. A further MLflow SSRF entry was added on 19 August (CVE-2026-64849).
Global (Macro) 4 stories
Microsoft Copilot Personal Flaws Let One Click Exfiltrate Data From Connected Apps — CoSnitch
Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal that could allow a single click on a crafted link to silently exfiltrate data from connected apps and other information available to the victim's Copilot session. The flaws, collectively named CoSnitch (CVE-2026-24301), turn in part on an undocumented `autorun=1` URL parameter that Copilot itself surfaced during testing; the researchers reported the issue to Microsoft in December 2025 and patches shipped 18 August. The group found no evidence of in-the-wild exploitation.
Critical GitLab GraphQL Flaw Lets Unauthenticated Attackers Delete Public Projects
GitLab patched a critical vulnerability in its GraphQL API that could allow an unauthenticated attacker to delete public projects, disclosed with a zero-click angle. The flaw, reported on 17 August, adds to a busy week of critical web-application findings and reinforces GitLab's position as a high-value, internet-facing target.
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Researchers documented a single threat actor continuously scraping both Salesforce and ServiceNow web portals since 2025, harvesting data exposed in those customer-facing SaaS platforms. The finding underscores the pivot to SaaS-scraping as a low-friction mass-compromise technique, where public/waters surfaces on widely used enterprise platforms are mined at scale rather than exploited by a single breach.
Medusa Ransomware Tallying Hundreds of New Victims; CISA Updates Tactics
CISA identified more than 200 victims of the Medusa ransomware operation over the last year and updated its advisory on the group's tactics, techniques and procedures. The updated advisory reflects a continuing and high-volume Ransomware-as-a-Service targeting pattern and gives defenders fresh detection guidance, in line with CISA's ongoing KEV and advisory cadence.
Healthcare 1 story
American Addiction Centers & Octopus Pathology Disclose Hacking Incidents
American Addiction Centers and Oculus (Octopus) Pathology disclosed hacking incidents involving unauthorised access to protected health information. Both entities filed the required notifications consistent with federal and state breach-notification rules; details on record volumes and impacted individuals were limited in the early disclosures.
Financial Services 2 stories
ASIC Warns of Deepfake Scam Surge Against Australian Consumers
The Australian Securities and Investments Commission (ASIC) warned of a surge in deepfake-related scams targeting Australian consumers and investors, including authorised-transaction and high-stream fake celebrity/authority models. The warning reinforces the OAIC and ACSC standing guidance on AI-enabled fraud and identity theft, and flags the growing consumer exposure to AI-generated visual content.
ANZ Warns of Troubling 'Scam-Coaching' Trend
Australian bank ANZ warned of a "scam-coaching" trend, in which fraudsters coach victims to lie to their bank to subvert scam-prevention controls — a variant of social-engineering designed to defeat the very protections banks and regulators have deployed. The warning is directly relevant to the OAIC Notifiable Data Breach scheme's anti-fraud regime and to the industry's escalating fight against authorised-push-payment scams.
Transport 1 story
Six Arrested as UK Police Target Cargo Theft Costing £70m+ a Year
UK police arrested six people in an operation targeting cargo and freight theft — a logistics-side physical-cyber overlap that moves goods loss into the supply-chain risk picture. The arrests underscore the convergence of organised freight crime with digital coordination of supply chains used by Australian and global shippers.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →