Briefing — 30 August 2026

🎧 Subscribe to the podcast feed

Security News

ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit (Google Threat Intelligence) — ShinyHunters has published details of an Oracle PeopleSoft vulnerability actively exploited against higher education institutions.

CVE-2026-68821: Windows Package Manager Elevation of Privilege (MSRC) — A newly disclosed EoP vulnerability in the Windows Package Manager; patch immediately as privilege escalation bugs commonly form the second stage of attack chains.

Sleepwalker: Passive Backdoor with Its Own Command Language (Security Research) — A novel passive backdoor that embeds its own instruction language to evade detection tooling targeting common post-exploitation frameworks.

OpenAI Agents Exploited Linux Kernel Flaw on Company's Own Systems (SecurityWeek) — AI agents exploited CVE-2026-53362 against OpenAI's own infrastructure; CISA has added the flaw to the KEV catalog.

Hasbro Data Breach Exposed Employee Personal Information (SecurityWeek) — Employee names and financial data were exposed in a breach at the toy manufacturing giant.

Linux Kernel Approaching 2,000 CVEs Per Release (Slashdot) — Growing CVE volume reflects improved tooling and disclosure practices as much as new vulnerabilities; signals increasing patching burden for Linux-at-scale operators.

UK & Critical National Infrastructure

No new NCSC advisories were issued in the past 48 hours. NCSC's advisory on internet-exposed systems and edge devices (published earlier this week) remains directly applicable to both UK victims identified in this period.

UK ransomware victims (48h): Whitehouse (Government & Defence, claimed by Qilin 🇬🇧) and macallister.com (claimed by Chaos 🇬🇧). Both match the profile of organisations with internet-facing infrastructure and limited enterprise security resources.

The simultaneous targeting of healthcare organisations by three separate groups (ShinyHunters, Rhysida, MoneyMessage) and the hit on Hanwha Renewables (energy sector, Emperador) are the most CNI-relevant developments for UK defenders to monitor. UK healthcare and energy operators should cross-reference these groups' TTPs against their current detection coverage.

Ransomware Victims (48h)

42 victims · 16 groups