Cybersecurity briefing, 2026-08-13

Here is the briefing for August 13.

• CISA’s KEV Update Spans Four Live Exploits
• Gunra Shifts Ransomware to Perimeter Break-ins
• LiteLLM Breach Grew Into CI Secret Spill
• White House Opens Hack-Back Role for Private Firms
• SharePoint JWT Flaw Is Being Exploited
• Sandworm Used Private APN to Reach CHP Controls
• Helix Claims Uber Freight Mailbox Theft
• FBI Probe Validates North Korean Remote-Hire Threat
• Akira Used Safe Mode to Silence EDR
• Defender Cloud Scan Opens a SYSTEM Path
• FileRun Thumbnails Turn Filenames Into Code
• CISA Orders Two-Week Fix for Exploited Windows Bug
• Flock Tightens Defaults After ALPR Abuse Scandals
• SonicWall GMS RCEs Hit Retired Management Platform
• Microsoft Broadens AI Gateway Abuse to Three Workloads
• SeaweedFS SSRF Exposes Internal Cloud Services
• City Forum Emerges as One Persistent Scraper
• Unbound Patch Shifts Priority to DNS Resolvers

Recent editions

• Wednesday, August 12, 2026: Gunra Shifts Ransomware to Perimeter Break-ins · 17 stories
• Tuesday, August 11, 2026: VulnCheck Chains SharePoint Bypass Into RCE · 17 stories
• Monday, August 10, 2026: Head Mare Turns TrueConf Updates Into Malware Delivery · 17 stories
• Sunday, August 9, 2026: Metabase Exploitation Exposes Connected Databases · 3 stories
• Saturday, August 8, 2026: Metabase Exploitation Exposes Connected Databases · 15 stories
• Friday, August 7, 2026: Cisco IOS XE Fixes Expose Broader Codebase Weaknesses · 19 stories
• Thursday, August 6, 2026: npm Worm Now Spreads Through Stolen Tokens · 17 stories