AI Risks Escalate, Ransomware Evolves, and Critical Flaws Targeted

The 'Greatness' Phishing-as-a-Service (PhaaS) platform has integrated device code phishing, a sophisticated adversary-in-the-middle (AiTM) technique. This method exploits the OAuth 2.0 Device Authorization Grant flow, tricking victims into entering a short code on a legitimate Microsoft login page. This action, combined with their MFA, inadvertently grants the attacker's machine full access to their Microsoft 365 account via stolen session and refresh tokens. Recent campaigns have spoofed RingCentral notifications, making this advanced MFA bypass accessible to a wider range of attackers and significantly increasing the threat of account takeover.

A critical (CVSS 9.8) insecure deserialization vulnerability in JetBrains TeamCity (CVE-2026-63077) is now under active attack. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities (KEV) catalog on August 6, 2026. This official confirmation of in-the-wild exploitation mandates U.S. federal agencies to apply patches within three days. All organizations using on-premises TeamCity servers are urged to assume compromise if unpatched and apply the late July 2026 security updates immediately to mitigate severe software supply chain risks.

The INC Ransomware group has escalated its extortion tactics, now making direct phone calls to victims, with reports mentioning an individual named 'Andrew' pressuring for payment. This adds significant psychological pressure to the ongoing attacks. Furthermore, technical analysis confirms the group is specifically stealing TOTP Multi-Factor Authentication (MFA) seed configurations, allowing them to bypass MFA for compromised accounts. The campaign continues to impact organizations globally, with numerous new victims listed on their data leak site since early August 2026, underscoring the persistent threat and expanding reach of these attacks.

N-able has confirmed that a 'limited' number of partners have been breached via CVE-2026-18577. The vulnerability affects N-central versions up to and including 2026.3.1. New cyber observables for Cloudflare Tunnel persistence include outbound connections to *.cfargotunnel.com and monitoring the C:\Program Files (x86)\N-able Technologies\Windows Agent\ directory for unexpected executables. These details further refine detection and remediation efforts for the actively exploited authentication bypass flaw.

The data extortion group ExfilSquad has officially claimed responsibility for the PNLD data breach, confirming they exfiltrated 1.9 GB of data containing approximately 135,000 records, including 114,000 PNLD subscribers and 21,000 'Ask the Police' users. They have published samples on their dark web leak site and are actively demanding a ransom. The incident, detected on July 26, 2026, is now being managed by West Yorkshire Police with the National Crime Agency (NCA) investigating. The breach affects all 43 Home Office police forces, British Transport Police, Crown Prosecution Service, and His Majesty's Courts and Tribunals Service, significantly increasing the risk of targeted phishing and harassment for personnel.

The update provides additional context on the actively exploited vulnerabilities. For Langflow (CVE-2026-9198), reports suggest a China-based threat actor may have used an AI agent for discovery and exploitation. The Apache Tomcat flaw (CVE-2026-34486) is further detailed as affecting cluster message handling, allowing attackers to read or tamper with sensitive session data between nodes. The N-able N-central authentication bypass (CVE-2026-18556) is clarified as a precursor to CVE-2026-18577, which was an incomplete fix. These details offer a deeper understanding of the exploitation methods and specific impacts.