Skip to content
August 2026 Page 14

August 2026

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

Ravie LakshmananAug 18, 2026Vulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.… 

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects

Swati KhandelwalAug 17, 2026Vulnerability / DevOps GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker… 

‘Unprecedented’ number of Apple users received recent spyware alert, say investigators

‘Unprecedented’ number of Apple users received recent spyware alert, say investigators

An unprecedented number of Apple customers have reported receiving a recent threat notification alerting them to suspected spyware attacks targeting their devices, according to experts who investigate these types of incidents.  Several people publicly and… 

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

Swati KhandelwalAug 17, 2026Vulnerability / Artificial Intelligence Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake’s public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to… 

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Ravie LakshmananAug 17, 2026Vulnerability / Website Security A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution… 

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of…