🚨 Hugging Face Diffusers can run code it was told not to trust.

Three high-severity flaws let crafted model repositories bypass trust_remote_code during custom pipeline loading.

How FaceHugger gets past the check: https://thehackernews.com/2026/08/hugging-face-diffusers-flaws-could-let.html

🛑 Attackers took over N-central servers.

N-able says they reached customer endpoints through Take Control and left Cloudflare tunnels for persistent access. The first fix missed an alternate exploit path.

What MSPs need to check: https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html

⚠️ DNA test files could be altered before analysts ever see them.

In a CVE-2026-17583 demonstration, a researcher combined two people’s profiles into one Applied Biosystems file.

It raised no warning and appeared untouched since 2015.

How the tampering works - https://thehackernews.com/2026/08/thermo-fisher-patches-flaw-that-could.html

🚨 PNLD breach puts U.K. police and government contact details on the dark web.

Names, organisations and work emails were exposed, potentially making phishing aimed at named officers more convincing.

ExfilSquad, a newly surfaced extortion group, claimed the breach.

Read - https://thehackernews.com/2026/08/pnld-breach-exposes-uk-police-and.html

🚨 Fake AWS and Apple login pages are triggering an iPhone exploit chain.

Experts tied more than 100 web properties to an unknown Chinese threat actor using the leaked DarkSword kit. Successful exploitation deploys GHOSTBLADE to steal credentials and files.

Read: https://thehackernews.com/2026/08/chinese-threat-actor-uses-leaked.html

Low severity does not mean low risk.

Analysis of more than 25 million alerts found nearly 1% of confirmed incidents began with low-severity or informational alerts. An autonomous AI SOC can investigate the full queue, while Claude helps analysts hunt, write detections, and make decisions.

See where each type of AI fits: https://thehackernews.com/2026/08/fomo-in-soc-where-ai-platforms-like.html

We all know "Password123" is a bad idea—but what are people actually using?

The Specops Breached Password Report 2026 analyzed more than 6 billion stolen passwords to uncover the trends, habits, and risks shaping today's threat landscape. From the most commonly compromised passwords to the latest credential theft tactics, the report offers an inside look at how attackers are gaining access to accounts.

Explore the findings and see what security teams can do to stay ahead: https://thn.news/specops-pass

⚡ The weekly recap is here...

Rogue AI • $88M wallet theft • OWA spying • Rails secret leaks • water-system attacks • hijacked hotel Wi-Fi • Teams ransomware • AUR takeovers • npm botnets • RubyGems miners • exposed MCP servers • login-flow phishing • AI CVE slop • keystroke spying

Everything that mattered this week, in one sharp read: https://thehackernews.com/2026/08/weekly-recap-rogue-ai-models-88m.html

⚠️ INC Ransomware is now the main actor exploiting SonicWall SMA 1000 flaws.

Researchers say related attacks extracted credentials, active sessions, and TOTP seeds, giving attackers persistent access and a route deeper into corporate networks.

What defenders need to check: https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html

‼️ ALERT - Windows malware could silently sign in to passkey-protected accounts.

Researchers found 3 post-compromise paths in Chrome's Google Password Manager that could bypass user verification, plant an attacker-controlled key, or recover the secret protecting an account's synced passkeys.

Two give reusable access from another machine.

Here's how the attacks work: https://thehackernews.com/2026/08/google-password-manager-attacks-could.html

🚨 Alibaba tool users were targeted with a cross-platform RAT.

Researchers linked 18 malicious npm packages to a layered dependency chain that served Windows, #Linux, and #macOS payloads with command execution, persistence, file transfer, and lateral movement capabilities.

How the npm attack worked: https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html

⚠️ N-central attacks are reaching managed endpoints.

Attackers are exploiting CVE-2026-18577 to bypass authentication, gain admin access, and abuse Take Control for lateral movement. N-able confirms limited customer compromises, and CISA has added the flaw to KEV.

What defenders need to check: https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html

🚨 DOUBLECUP turns ClickFix into a cross-platform malware pipeline.

It stages code in browser-cached PNGs, locks payloads to each victim’s public IP, and delivers CountLoader on Windows and macOS or the newly documented DeviceManager RAT.

Inside the attack chain: https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html

‼️ WARNING - A new critical cPanel flaw could let an authenticated hosting customer run SQL as database root.

CVE-2026-58048 affects all supported cPanel & WHM versions and WP Squared. In some configurations, the compromise may reach the underlying OS.

Affected builds and details: https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html

🚨 One malicious GitHub issue could trigger a privileged Google ADK agent.

Google pulled 3 ADK AI workflows after researchers demonstrated that adk-bot’s trusted identity could become a bridge to CI runner code execution and bot PAT exfiltration.

How the chain worked: https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html

AI is lowering the bar for cyberattacks.

LLMs help less experienced attackers understand vulnerabilities, prototype code, debug payloads, and adapt known techniques faster. The result is a wider pool of capable attackers and less time for defenders to react.

What security teams need to change: https://thehackernews.com/2026/08/when-vibe-hacking-turns-ai-into-junior.html

🛑 Fake Adobe and Zoom updates lead to persistent remote access.

The active SMOKE#SCREEN campaign uses phishing lures to install ScreenConnect, letting attackers blend into legitimate IT activity instead of deploying a custom RAT.

How the attack works: https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html

🔥 ALERT - A massive npm supply-chain attack is unfolding right now.

It began with a poisoned Keyv release and spread across hundreds of packages.

The worm:
→ Credential stealer via install scripts
→ npm, GitHub, cloud and CI secrets targeted
→ Claude Code and VS Code hooks in Keyv repo
→ Valid OIDC and SLSA provenance

Read the full story: https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html

This is what a modern SOC should look like: connected, context-driven, and ready to act. Equip yours with operationalized threat intelligence from 15K+ SOCs to support triage, detection, and response -> https://thn.news/feeds-soc

⚠️ Greatness now has another route past MFA.

The $289/month PhaaS kit adds device code phishing to AiTM token theft, OAuth consent abuse, and ready-made lures, all from one operator panel.

Researchers saw one stolen Microsoft 365 token still being used more than two weeks later.

See how it works: https://thehackernews.com/2026/08/greatness-phaas-adds-device-code.html