EU Cyber Resilience Guidance, Ransomware, and Zero-Days Dominate Cybersecurity News

The Qilin ransomware group has added Chun Tai Sing Chemical Industry, a Hong Kong-based firm, to its leak site on August 9, 2026. The group claims to have exfiltrated customer information after the company reportedly refused to pay a ransom, continuing Qilin's double-extortion tactics. The group's ransomware is noted to be written in both Go and Rust, making it adaptable across operating systems. Affiliates are also known to use tools like Mimikatz for credential theft, expanding on previously reported TTPs. The breach remains unconfirmed by the victim.

The European Union Agency for Cybersecurity (ENISA) has significantly expanded its role as a Root in the global Common Vulnerabilities and Exposures (CVE) Program. On August 10, 2026, ENISA onboarded new CVE Numbering Authorities (CNAs), including the NATO Communications and Information Agency (NCIA) and AI security firm AISLE, bringing its total managed CNAs to 20. This strategic expansion is directly linked to the upcoming enforcement of the Cyber Resilience Act (CRA), particularly the September 2026 mandate for manufacturers to report actively exploited vulnerabilities. ENISA is building the necessary infrastructure to handle this influx of reports and coordinate their disclosure, strengthening the EU's vulnerability management capabilities and strategic autonomy.

Microsoft Threat Intelligence reports China-linked Storm-1175 is actively exploiting CVE-2026-18577 in N-able N-central to deploy a new custom C++ ransomware, StormEncryptor. This campaign, which began August 2, leverages the authentication bypass to gain administrative control, then uses tools like AnyDesk and Cloudflare Tunnel for persistence and lateral movement. StormEncryptor appends '.encrypted' to files and drops '!!!README_FIRST!!!.txt' ransom notes. This significantly escalates the threat, confirming ransomware deployment by a specific, financially motivated group against MSPs in healthcare, finance, and professional services across the US, UK, and Australia.

The Metabase zero-day SQL injection vulnerability is now officially tracked as GHSA-vwf4-m7j8-wcjf. Updated patch versions have been released, including v1.58.10, v1.59.6, v1.60.6, v1.61.5, v1.62.4, and v1.63.1. A critical new detection method involves monitoring for a POST request to /api/session/reset_password resulting in an HTTP 400, immediately followed by a GET request to /api/user/current with an HTTP 200 from the same source IP. This sequence is a strong indicator of successful exploitation. Additionally, /api/user/current has been identified as a key hunting observable.

New details confirm PhantomCore as a Remote Access Trojan (RAT) used by Head Mare in their TrueConf supply chain attack. The campaign, observed in July 2026, specifically targets Russian organizations across instrumentation, electronics, transport, energy, and IT sectors. Affected TrueConf Server versions include 5.3.x (before 5.3.9), 5.4.x (before 5.4.9), and 5.5.x (before 5.5.5). Patches for these vulnerabilities were released on June 18, 2026. Additional mitigation advice emphasizes code signing verification and Web Application Firewall (WAF) deployment.