Here are today’s top cybersecurity stories for Wednesday, August 19, 2026.
CISA Flags Actively Exploited Windows IKE Extension Flaw
CISA added CVE-2026-33824, a Windows Internet Key Exchange Service Extensions double-free vulnerability, to its Known Exploited Vulnerabilities catalog on August 18 after confirming active exploitation. Palo Alto Networks Unit 42 observed a Chinese-speaking actor manually sending reverse-shell callbacks to three IKE VPN endpoints through the CVSS 9.8 flaw, which allows an unauthenticated attacker to run code over a network. Federal civilian agencies face an August 21 remediation deadline. CISA | BleepingComputer
US Charges 17 Iranians in Mabna Institute University Theft Campaign
The Justice Department unsealed a superseding indictment charging 17 Iranian nationals tied to the Mabna Institute, a hackers-for-hire operation prosecutors say worked on behalf of Iran’s Islamic Revolutionary Guard Corps. The group allegedly breached 144 US universities, 42 private-sector companies, and at least five federal and state agencies since 2013, stealing more than 31 terabytes of academic data and intellectual property, material universities spent an estimated $3.4 billion to obtain. Five defendants remain fugitives with a $10 million reward offered for information. DOJ | BleepingComputer
Password Spraying Attacks Surge 155x as Azure CLI Campaign Exploits MFA Gaps
Huntress reported a 155-fold increase in password spraying attacks during the first half of 2026, driven in large part by a campaign targeting Microsoft Azure CLI through the deprecated OAuth ROPC authentication flow. Traffic tied to hosting provider LSHIY generated more than 81 million login attempts and compromised 78 accounts in a two-week window, with affected organizations sharing inconsistent or absent MFA enforcement across cloud applications. Attackers migrated to a new hosting provider after LSHIY suspended the offending account. BleepingComputer | Huntress
One-Click “CoSnitch” Flaw Exposed Microsoft Copilot Personal Data
Varonis Threat Labs disclosed CVE-2026-24301, a critical flaw chaining three weaknesses in Microsoft Copilot Personal, letting an attacker exfiltrate data from a victim’s connected accounts through a single click on a malicious link. Researchers uncovered the exact undocumented URL parameter needed for exploitation after Copilot itself explained its own architecture while attempting to demonstrate the attack was not feasible. Microsoft patched the flaw on August 18, and Varonis found no evidence of exploitation before the fix shipped. The Hacker News | Varonis
CISA Warns of Active Threat to Siemens S7 Series PLCs
CISA published advisory AA26-231A warning of ongoing threat activity against Siemens S7 Series programmable logic controllers, part of a broader campaign already linked to Iranian-affiliated actors targeting internet-exposed industrial control devices. The advisory calls for owners and operators to inventory affected PLCs, apply available patches, remove internet exposure, and strengthen access controls. CISA notes the underlying threat extends beyond Siemens equipment to other PLC vendors. CISA
Operation CameraSwarm Compromised Over 14,500 Dahua Devices
Hunt.io researchers detailed a campaign, dubbed Operation CameraSwarm, compromising more than 14,530 Dahua camera devices between June 17 and July 22 using credential attacks, two authentication-bypass flaws, and a peer-to-peer relay technique. The findings came from an exposed 407 MB working directory containing operator tooling, logs, and campaign records, with confirmed compromises concentrated in Ukraine and Russia. Language artifacts point to a Russian-speaking operator not yet tied to a named group. The Hacker News | Hunt.io
Oracle Ships 943 Patches in August Critical Patch Update
Oracle released 943 security patches addressing more than 1,000 unique CVEs across two dozen products in its August 2026 Critical Patch Update, including more than 460 vulnerabilities exploitable remotely without authentication. The update covers Oracle Database, Fusion Middleware, E-Business Suite, Java SE, MySQL, Enterprise Manager, and PeopleSoft, among other product lines. SecurityWeek
“Ransom Busters” Pose as Recovery Firm in New Extortion Tactic
Researchers identified a group calling itself Ransom Busters contacting ransomware victims before an incident becomes public, offering to recover encrypted files and erase stolen copies. Investigators assess the operation as a ransomware affiliate running a secondary extortion channel rather than a legitimate recovery service, noting the outreach pattern requires advance knowledge of a private breach. The tactic adds a new pressure point alongside standard double-extortion demands. Cybersecurity News
Stay tuned for today’s in-depth analysis posts.
