Briefing — 25 August 2026

🎧 Subscribe to the podcast feed

Security News

US sanctions Iranian cyber actors as UK discloses power plant attack (The Record) — Iran-linked actors caused an operational shutdown of a UK power generation facility; the US responded with sanctions against the responsible Iranian cyber operators.

Sleepwalker backdoor targets Windows machines (The Register) — A new stealthy Windows backdoor uses advanced persistence mechanisms to evade standard detection; no patch currently available.

CVE-2026-50661: Windows BitLocker Security Feature Bypass (MSRC) — A vulnerability allowing attackers to bypass BitLocker disk encryption with serious implications for device theft and data recovery scenarios.

CVE-2026-47292: VS Code MSSQL Extension Remote Code Execution (MSRC) — RCE vulnerability in the Visual Studio Code MSSQL database extension; developers using VS Code with SQL Server tooling should patch today.

Exploited Zimbra Flaw Highlights Shrinking Window to Patch (Dark Reading) — Active exploitation demonstrates the narrowing gap between vulnerability disclosure and attacker exploitation; Zimbra environments are persistent targets.

Unpatched Calix flaw lets hackers bypass NAT (BleepingComputer) — An unpatched vulnerability in Calix networking equipment allows attackers to bypass NAT and expose internal devices directly to the internet.

Active attacks on WordPress miniOrange authentication plugin (BleepingComputer) — Attackers are exploiting an auth bypass in the miniOrange plugin to gain unauthenticated access to WordPress installations.

ReliaQuest confirms ShinyHunters breach, says data theft failed (SecurityWeek) — ShinyHunters successfully compromised cybersecurity firm ReliaQuest but the company says the attempted data theft was blocked before exfiltration.

Nvidia senior manager linked to AI server smuggling scheme (Ars Technica) — A senior Nvidia employee is implicated in illegally exporting Supermicro AI servers to China in violation of US export controls.

AliExpress caught fingerprinting via inaudible audio (Ars Technica) — AliExpress was found using inaudible browser audio signals to uniquely fingerprint and track visitors across sessions even after clearing cookies.

WordlistLoader malware disguises payload as ordinary text (Dark Reading) — A new malware loader evades detection by disguising its payload as ordinary wordlist files commonly associated with legitimate security tools.

LLMs could exploit inference engines to control host machines (Boyd Kane) — Research explores how language models could potentially exploit vulnerabilities in inference engine runtimes to take control of their host systems.

UK & Critical National Infrastructure

Iran-linked cyberattack disrupts UK power plant — An Iran-linked threat actor caused an operational shutdown of a UK power generation facility. The US government has sanctioned the responsible Iranian cyber operators in response. This is a rare public admission of physical operational impact from a cyberattack on UK critical national infrastructure. UK CNI operators — particularly in the energy sector — should treat this as an active, demonstrated threat. The Register | The Record

No new NCSC advisories published in the past 48 hours. Check ncsc.gov.uk/news/alerts-advisories for the latest guidance.

Also relevant for UK defenders: metaencryptor hit Weber Water Resources (US) — a reminder that water utilities are in scope for ransomware groups as well as state-sponsored actors. UK water sector should maintain tight patch cadence.

Ransomware Victims (48h)

54 victims · 20 groups