AI Risks, Critical Infrastructure Attacks, and Zero-Days Dominate Cybersecurity News

Critical Vulnerabilities Under Active Exploitation:

• CISA Adds Seven Actively Exploited Flaws to KEV Catalog: CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with seven new flaws, notably including CVE-2026-82329 (JFrog Artifactory), CVE-2026-59822 (LiteLLM), and CVE-2026-48710 (Starlette), which directly impact AI/ML infrastructure. This highlights emerging risks such as supply chain attacks, data poisoning, and model theft targeting the MLOps pipeline.
• SonicWall Patches Two Actively Exploited SMA 1000 Zero-Days: CISA has added CVE-2026-83548 and CVE-2026-83549 to its KEV catalog, mandating patches for Federal agencies by September 5, 2026, due to active exploitation. The Cyber Security Agency of Singapore also confirmed these vulnerabilities are being exploited, underscoring the urgent need for all affected SonicWall SMA 1000 users to update.
• Google Patches Actively Exploited Chrome V8 Zero-Day Flaw: Google has released an emergency update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript engine that allows for arbitrary code execution. Users are strongly advised to apply the patch immediately for Windows, macOS, and Linux.

New Threats and Advisories:

• 12-Year-Old "PostGREShell" Flaw Threatens PostgreSQL Servers: A long-standing vulnerability, CVE-2026-6471 or "PostGREShell," affecting PostgreSQL versions since 9.4, allows users with 'Replication' privileges to execute arbitrary code and escalate privileges. Patches are available, and administrators should update systems and audit replication accounts.
• Settra Ransomware Claims Attack on Medical Firm MedEvolve: The Settra ransomware group has claimed responsibility for an attack on MedEvolve, a medical billing company, alleging the theft of 820GB of internal documents. This incident underscores the ongoing targeting of the healthcare sector by ransomware operations.
• CISA Warns of High-Severity Flaw in Ignition ICS Platform: CISA has issued an advisory for CVE-2026-77393, a high-severity vulnerability in Inductive Automation's Ignition ICS platform. An incorrect default permission setting allows authenticated users to create new projects, potentially leading to unauthorized modifications in industrial environments. Users should upgrade to version 8.1.54.

Critical Infrastructure and Industry Initiatives:

• [UPDATE] CISA: Over 100 U.S. Water Systems Targeted in July Cyber Campaign: Iranian state-sponsored actors have expanded their cyber operations beyond U.S. water systems to include telecommunications and energy providers. While recent attempts have not yet caused disruption, they indicate reconnaissance and intent for future disruptive attacks on critical infrastructure.
• OpenAI Commits $1B to Boost AI Defenses for Critical Infrastructure: OpenAI has launched the "Daybreak for Frontline Defenders" program, a $1 billion initiative to provide under-resourced cybersecurity teams at critical infrastructure entities with advanced AI tools and training. A pilot program will focus on water utilities and other public sector entities.