Here are today’s top cybersecurity stories for Friday, August 21, 2026.
Microsoft Confirms Exploitation of Maximum-Severity Entra ID Flaw
Microsoft disclosed and patched CVE-2026-69836, a CVSS 10.0 remote code execution flaw in Entra ID stemming from unsafe deserialization of untrusted data. An unauthenticated attacker needed no privileges or user interaction to trigger the flaw, and Microsoft confirmed exploitation attempts occurred before the fix went live. The company says the flaw is fully mitigated server-side and customers need to take no additional action. BleepingComputer | The Hacker News
Russia-Linked Clusters Abuse OAuth and WhatsApp Linking to Hijack Accounts
Google’s Threat Intelligence Group identified three suspected Russian espionage clusters, tracked as UNC6293, UNC7005, and UNC5976, manipulating targets into completing legitimate app-password, OAuth, device-code, and WhatsApp device-linking flows to gain authenticated account access despite multi-factor authentication protections. Targets span academia, aerospace and defense, government, and think-tank organizations across Europe and the United States. One cluster impersonates US State Department officials while another spoofs NATO-linked defense conferences. Google Threat Analysis Group | The Hacker News
Rust Supply Chain Attack Traces to Suspected North Korean Infrastructure
Attackers compromised a maintainer account behind the widely used arrayref Rust crate and published malicious versions of arrayref, internment, and append-only-vec containing a build-time payload downloader. The Rust Security Response Team removed the poisoned releases within roughly two hours of publication, and researchers at Wiz linked the command-and-control infrastructure to earlier npm supply chain campaigns attributed to North Korea’s Sapphire Sleet group. The Hacker News | Wiz
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Code Execution
Polish CERT researchers observed active exploitation of CVE-2026-73570, a CVSS 8.9 command injection flaw in Zimbra Collaboration’s SNMP notification handling, letting an unauthenticated attacker run operating system commands as the Zimbra user. The flaw affects servers with SNMP trap notifications enabled and the swatchdog service running, a configuration active by default where the optional SNMP module is installed. Zimbra fixed the issue in version 10.1.20, released July 20. The Hacker News | BleepingComputer
Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Rated Maximum Severity
Cisco released a security hardening update addressing nine vulnerabilities across Crosswork Data Gateway, Crosswork Network Controller, Crosswork Planning, and Secure Workload software, including five access-control and authentication flaws rated CVSS 10.0. Cisco found the issues during internal testing and says none show signs of active exploitation. Fixed versions require upgrading cluster, agent, and connector components together, with no workarounds available. The Hacker News | SecurityWeek
Critical Flaw in isolated-vm Sandbox Allows Guest-to-Host Escape
Researchers at Endor Labs disclosed a type confusion vulnerability in isolated-vm, a Node.js library used to run untrusted JavaScript inside a V8 isolate, tracked as GHSA-864f-rcv7-6rh4. The flaw lets code running inside the sandbox corrupt host process memory and hijack control flow, achieving a full guest-to-host escape from a single object reference. The library sees nearly one million weekly downloads and sits inside several AI application frameworks, with fixes available in versions 6.2.0 and 7.0.1. The Hacker News
CareCloud Data Breach Grows to 3.7 Million Affected Individuals
Healthcare technology provider CareCloud confirmed a data breach originally reported as affecting 350,000 people now impacts more than 3.7 million individuals. Attackers accessed a CareCloud AWS environment between March 10 and March 16, stealing names, addresses, Social Security numbers, driver’s license numbers, dates of birth, and health insurance and medical information. No group has publicly claimed responsibility for the intrusion. BleepingComputer | SecurityWeek
Researchers Trace Hundreds of Fake Bank Websites to a $25 Scam Template
Allure Security researchers traced hundreds of fraudulent bank websites, or phantom banks, to a common $25 website template sold to scammers. The sites impersonate legitimate financial institutions to harvest login credentials and personal information from visitors searching for banking services online. Researchers say the low cost and simplicity of the template lowers the barrier for large-scale phishing operations. Help Net Security
Stay tuned for today’s in-depth analysis posts.
