Here are today’s top cybersecurity stories for Thursday, August 20, 2026.
SAP Commerce Cloud Flaw Exploited Days After Patch Release
Attackers began targeting CVE-2026-58231, a maximum-severity CVSS 10.0 flaw in SAP Commerce Cloud, within three days of SAP shipping a fix. The vulnerability stems from insufficient authorization checks and input validation in the Data Hub Adapter, letting an unauthenticated attacker abuse a default authentication client to achieve arbitrary code execution. Security firm Onapsis urged customers to apply the patch and redeploy affected environments without delay. The Hacker News | BleepingComputer
Citrix Patches Critical NetScaler Authentication Bypass
Citrix released fixes for CVE-2026-19490, a CVSS 9.3 authentication bypass affecting NetScaler ADC and NetScaler Gateway configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or as an AAA virtual server. An unauthenticated remote attacker sends crafted network requests to circumvent authentication controls with no user interaction required. Rapid7 has not confirmed active exploitation as of publication but notes Citrix authentication bypass flaws draw rapid attacker interest given widespread internet-facing deployment. BleepingComputer | SecurityWeek
Flaws in NASA Ground Software Allowed Unauthenticated Spacecraft Commands
Researchers at Cycode disclosed a chain of flaws in AIT-GUI, the operator console for NASA and JPL’s open-source AMMOS Instrument Toolkit, tracked as CVE-2026-60112 and GHSA-p9r8-2q67-fp86. Versions before 2.5.1 allowed an unauthenticated network attacker to obtain a valid session and issue commands to a spacecraft or instrument command bus by calling an exposed function with no credential check. NASA fixed the issue in version 2.5.2, and follow-up testing confirmed the update blocks the cross-origin requests used in the attack. The Hacker News
Researchers Demonstrate “Zombie Card” Attack on Expired Visa Cards
Researchers at the University of Massachusetts Amherst showed expired Visa contactless cards completing real point-of-sale purchases by intercepting and rewriting the expiration date a terminal reads over near-field communication, without breaking the card’s cryptography. The technique needs physical access to the expired card and a relay device positioned between the card and terminal. Mastercard, American Express, and Discover rejected the tampered transactions in testing, while Visa did not. The Hacker News | Help Net Security
Grandoreiro Banking Trojan Resurfaces With New Mexico Campaign
The long-running Grandoreiro banking trojan reappeared in a campaign concentrated in Mexico, which accounted for 40 percent of observed detections in recent telemetry. Attackers abused a legitimate file-management application through DLL sideloading, renaming the program and placing a malicious library alongside its legitimate dependencies to load the trojan. Acronis researchers first observed the renewed activity in May 2026, more than two years after a law enforcement operation disrupted parts of the malware’s infrastructure. Dark Reading
Fake Google Gemini Installer Delivers Vidar Infostealer
Darktrace researchers identified an attack chain delivering the Vidar infostealer through a fake Google Gemini installer hosted on Google Colab. The lure redirected victims to a site posing as a “Windows Software Hub” before serving the malicious executable, using trusted Google infrastructure to raise its perceived legitimacy. Vidar, active since 2018, collects browser credentials, financial information, and authentication tokens from infected systems. Help Net Security
Rapid7 Report Finds Vulnerability Disclosures Doubled Year Over Year
Rapid7’s second-quarter 2026 vulnerability report counted 8,539 new high- and critical-severity flaws, double the 4,268 recorded in the same quarter of 2025. Nearly two-thirds of exploited vulnerabilities this quarter needed no user interaction, up nine points from the prior year, and publicly available proof-of-concept code rose 76 percent year over year. Rapid7 says the pace of disclosure and exploitation now outpaces traditional patch cycle timelines. Help Net Security
Experts Push to Designate AI as Critical Infrastructure Sector
Security leaders and policy experts renewed calls to designate artificial intelligence and its supporting infrastructure as a critical infrastructure sector, citing foreign government cyber and physical attacks targeting data centers and related facilities. Proponents argue formal designation brings AI infrastructure under existing federal protection and information-sharing frameworks. No US agency has moved to finalize the designation. CyberScoop
OpenAI Details Security Overhaul for High-Capability AI Models
OpenAI outlined new containment measures for models nearing or meeting its “critical” cybersecurity capability threshold, including stricter sandboxing, a token-inspection system, and 30-minute alerting for suspicious activity. The changes follow internal evaluations indicating an upcoming model, Astra, is approaching the threshold. OpenAI previously paused Astra’s development over the same concern. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
