Here are today’s top cybersecurity stories for Monday, August 17, 2026.
French Tax Authority Data Breach Affects 678,000 Individuals
France’s Directorate General of Public Finances confirmed unauthorized access to internal systems using stolen credentials from an employee and an authorized third party during June and July. The intrusion exposed names, dates of birth, home addresses, phone numbers, family status, and tax details for 678,000 individuals and businesses, though secure taxpayer accounts on the agency’s website remain unaffected. Notifications to affected users began August 17. BleepingComputer | Help Net Security
Criminal Actor Sells Azure Data Stolen From Fortune 500 Companies
A threat actor using the alias TheHatman is offering millions of employee records allegedly taken from the Azure and Entra tenants of major firms including McDonald’s, Vodafone, Tata Consultancy Services, HCL Technologies, and InterContinental Hotels Group. Researchers say the data appears legitimate and likely stems from compromised credentials, infostealer malware, or overly permissive third-party API access rather than a platform-wide Azure flaw. The largest confirmed dataset, from McDonald’s, contains more than 1.7 million records. SecurityWeek | The Register
Active Exploitation of macOS Screen Sharing Flaw Plants Monero Miners
The Dutch National Cyber Security Centre confirmed active exploitation of a patched macOS Screen Sharing vulnerability, tracked as CVE-2026-65400, against internet-exposed Macs with port 5900 open. Attackers bypass authentication in the screensharingd daemon to gain root access, then install a Monero cryptocurrency miner on every confirmed victim system. CISA raised the flaw’s severity score from 7.1 to 9.8 on August 14 following release of a public proof-of-concept exploit. The Hacker News | SecurityWeek
SafePal Discloses Data Breach Affecting 40,000 Customers
Cryptocurrency hardware wallet maker SafePal disclosed a breach after attackers exploited a flaw in an order-tracking plugin tied to its customer information system. The incident exposed order and contact details for roughly 40,000 customers, though SafePal says wallet seed phrases and funds remain unaffected. SecurityWeek
CISA Adds Three Actively Exploited Flaws to KEV Catalog
CISA added a Metabase SQL injection flaw, a Cisco Secure Firewall vulnerability, and a Windows WinSock elevation-of-privilege bug to its Known Exploited Vulnerabilities catalog on August 17 based on confirmed in-the-wild exploitation. Federal agencies face mandated remediation deadlines under CISA’s binding directive. CISA | SC Media
Unisoc VoLTE Exploit Chain Grants Full Android Kernel Access
Researchers published the second stage of an exploit chain targeting Unisoc baseband firmware, extending a remote code execution flaw disclosed in March through a malformed VoLTE video call into full kernel-level access on affected Android devices. The Hacker News
176 Flaws Found in Samsung Preinstalled Mobile Apps
Oversecured researchers identified 176 vulnerabilities across Samsung’s proprietary system apps, which run outside Google Play Protect and are not removable by users. The flaws include one-click Samsung account takeover, remote code execution through malicious image files, and DNS manipulation capable of hijacking device network traffic. Samsung says it fixed every reported issue in its August security update. SC Media | TechRepublic
GitHub Suffers Worldwide Outage
GitHub confirmed a global outage beginning at 9:40 a.m. EDT on August 17, disrupting API requests, Actions, pull requests, webhooks, Copilot, and enterprise authentication services including SAML and OIDC. Error rates reached roughly 20 percent for web and API traffic before GitHub reported the degradation mitigated by late afternoon UTC. BleepingComputer
Kimwolf Botnet Resurfaces With HTTP/2 DDoS Evasion
A new version of the Kimwolf Android botnet, tracked as v7, adds an HTTP/2-based flood technique which constructs full browser fingerprints to evade DDoS mitigation, months after a joint Canada-US-Germany operation dismantled an earlier iteration of the botnet family. The Hacker News
Missing Authorization Flaw in Odysseus AI Workspace Rated CVSS 9.9
Researchers disclosed a critical missing-authorization vulnerability in the open-source Odysseus AI workspace platform, tracked as CVE-2026-70619, which lets authenticated non-admin users manipulate server-wide embedding backend configurations. A separate flaw let any self-registered user run shell commands on the platform through two ordinary API calls. Both issues are patched. The Hacker Wire | Manifold Security
Stay tuned for today’s in-depth analysis posts.
