Briefing — 26 August 2026

🎧 Subscribe to the podcast feed

Security News

CISA Warns of Exploited Gitea Vulnerability (SecurityWeek) — CISA issued an alert for an actively exploited vulnerability in the Gitea self-hosted Git service; organisations running Gitea internally should treat this as a priority patch.

Alabama Launches Investigation Into OpenAI's Alleged Hack of Hugging Face (Slashdot) — The state of Alabama is formally investigating allegations that OpenAI compromised the Hugging Face AI model and dataset platform, a significant and still-developing story.

AnonyMousKIT PhaaS uses voice AI to phish iPhone passcodes (BleepingComputer) — A Phishing-as-a-Service platform is deploying voice AI agents to call iPhone users, impersonate Apple Support, and socially engineer device passcodes from victims.

58 arrested in Interpol international cybercrime crackdown (The Record) — A multi-continent Interpol operation resulted in 58 arrests across cybercriminal networks and infrastructure.

Paylogix employee benefits platform breached by Akira (The Record) — Akira ransomware stole financial and health data from Paylogix, which administers employee benefits programmes across multiple employers.

Hospital operator Nutex Health confirms data stolen in cyberattack (BleepingComputer) — US hospital operator Nutex Health confirmed patient data was stolen in a cyberattack, extending the week's pattern of healthcare sector targeting.

Massive DDoS attack disrupts Norway's government digital services (BleepingComputer) — A large-scale DDoS attack caused significant disruption to Norwegian government digital infrastructure; no attribution confirmed.

Hackers abuse npm mirrors for phishing redirects (BleepingComputer) — Attackers are exploiting npm package mirror infrastructure as a phishing redirect host, leveraging the implicit trust developers place in the npm ecosystem.

Hidden Prompts Trick AI Into False Email Summaries (Dark Reading) — Prompt injection attacks can manipulate AI email assistants into generating false message summaries, with the potential to cause recipients to act on entirely fabricated information.

All 1,449 Oracle patches applied — and still breached (The Register) — An attacker successfully compromised a fully-patched Oracle environment via misconfiguration, demonstrating that patching alone is not a sufficient security posture.

NemoClaw: Network-based LLM poisoning in OpenClaw (Dark Reading) — A vulnerability in the OpenClaw open-source LLM framework allows network-based poisoning of model context — a novel attack class against AI inference infrastructure.

Microsoft CVE batch: PowerShell RCE, NTFS RCE, Excel RCE (MSRC) — A cluster of high-severity CVEs including CVE-2026-70337 (PowerShell RCE), CVE-2026-50448 (Windows NTFS RCE), CVE-2026-55137 (Excel RCE), and multiple elevation of privilege vulnerabilities across Winlogon, CLFS, and Windows Clipboard Server.

UK & Critical National Infrastructure

ShadowByt3$ hits two UK organisations simultaneously — A-Plus Software Limited (technology) and Nottingham Trent University (education) were posted by ShadowByt3$ within minutes of each other on 25 August. The coordinated posting pattern against a software firm and a large UK university may indicate a campaign rather than opportunistic compromise. NTU holds research data, industry partnership IP, and student records across a large institution.

No new NCSC advisories published in the past 48 hours. Check ncsc.gov.uk/news/alerts-advisories for the latest guidance.

Norway government DDoS — relevant signal for UK defenders — The targeting logic for Scandinavian government digital services applies equally to UK public sector infrastructure. BleepingComputer

The Iranian power plant disruption context from Tuesday remains the standing CNI threat signal for UK energy sector operators. No follow-on UK-specific incidents reported, but the threat actor capability is confirmed and active.

Ransomware Victims (48h)

43 victims · 16 groups · 3 UK victims 🇬🇧