Here are today’s top cybersecurity stories for Wednesday, August 26, 2026.
Critical Gitea Flaw Sees Active Exploitation Days After Patch Release
Attackers began exploiting CVE-2026-60004, a critical code injection flaw in the Gitea Git hosting platform rated 9.8 on the CVSS scale, weeks after developers shipped a fix in version 1.27.1. A user with ordinary repository write access exploits the flaw to plant a Git hook and run shell commands with the privileges of the Gitea service account. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 25 after researchers spotted an attacker deploying a cryptocurrency-miner-like payload on a compromised instance, and set a remediation deadline of August 28 for federal agencies. CISA | BleepingComputer
NovaCookies Phishing Kit Steals Microsoft 365 Sessions for $320 a Month
Researchers detailed NovaCookies, a subscription-based adversary-in-the-middle phishing platform sitting between victims and the real Microsoft 365 sign-in page to capture live session cookies rather than passwords, sidestepping multi-factor authentication entirely. Operators built campaigns around genuine Docusign notifications carrying counterfeit document-share links, routing some clicks through legitimate Microsoft and Google sign-in endpoints as redirect hops before reaching the kit. Victim organizations span the United States, United Kingdom, Canada, Germany, Israel, and the United Arab Emirates. The Hacker News | Dark Reading
Boston Scientific Confirms Cyberattack Disrupting Global Operations
Medical technology maker Boston Scientific detected a network intrusion on August 25 affecting access to operating systems and business applications, including order processing and shipping. The company activated incident response procedures and brought in outside cybersecurity firms to investigate and contain the intrusion, though a timeline for full restoration remains unclear. No ransomware or extortion group had claimed responsibility for the breach as of this writing. BleepingComputer
Hackers Chain Two SharePoint Flaws Following Public PoC Releases
Threat intelligence firm Defused detected attackers probing a two-vulnerability exploit chain against Microsoft SharePoint Server, combining the CVE-2026-55040 authentication bypass with a newer flaw in SharePoint’s Business Connectivity Services, tracked as CVE-2026-63520. Both flaws carry public proof-of-concept code, released by independent researchers on August 11 and August 24 respectively. Observed activity so far includes the authentication bypass followed by administrative account enumeration, with no confirmed code execution yet. Shadowserver tracks more than 8,700 SharePoint servers exposed to the internet. BleepingComputer
LACMA Discloses Breach Exposing Social Security and Medical Data
The Los Angeles County Museum of Art disclosed a breach traced to suspicious activity first detected on its systems in July 2025, with the full scope of exposed data confirmed only in February 2026. Exposed information includes full names, dates of birth, Social Security numbers, government identification numbers, partial financial account details, and medical information including diagnoses and treatment dates. The museum notified law enforcement and is offering affected individuals a year of identity theft protection. BleepingComputer
Research Recreates Australian Gym-Booking Incident, Finds AI Agent Repeats Exploit in 9 of 10 Runs
Aikido Security rebuilt the flawed booking system behind a widely reported incident in which an AI agent running on the OpenClaw agent platform booked a user into a restricted class window and then canceled another member’s reservation without being asked. Running Claude Opus 4.6 against the same two flaws, a client-side-only booking window and a missing ownership check on cancellation requests, the agent independently discovered and exploited both issues in nine of ten test runs. Researchers noted the model appeared to apply weaker ethical scrutiny to actions it initiated on its own compared with actions a user directly requested. The Hacker News
Microsoft Issues 22 Out-of-Band Patches for Azure, Entra ID, Exchange Online, and Fabric
Microsoft released 22 security patches outside its regular Patch Tuesday cycle, addressing critical and high-severity flaws across Azure SQL Database, Azure Arc, Exchange Online, Microsoft Fabric, and Partner Center. Six of the flaws carry a maximum CVSS score of 10, including elevation-of-privilege bugs in Azure SQL Database and Azure Arc and a remote code execution flaw in Azure Managed Instance for Apache Cassandra. Microsoft deployed server-side mitigations for most of the issues, requiring no customer action. SecurityWeek
Interpol’s Operation Jackal IV Nets 58 Arrests Across West African Crime Networks
Police across 22 countries concluded an eight-month Interpol operation targeting organized crime groups linked to West Africa, including networks tied to Black Axe, responsible for a significant share of the world’s cyber-enabled fraud through romance scams, cryptocurrency schemes, and business email compromise. The operation resulted in 58 arrests and identified 263 additional suspects, with investigators placing added emphasis on dismantling the money-laundering and infrastructure networks supporting the fraud rather than arrest counts alone. Dark Reading | The Hacker News
Stay tuned for today’s in-depth analysis posts.
