Iranian-linked actors are continuing to target Western critical infrastructure. A four-day shutdown at a UK power plant coincided with attacks on more than 30 US water utilities, with both campaigns targeting operational technology at facilities that generally have fewer security resources than larger strategic systems. The US Treasury's same-day sanctions against six MOIS-linked nationals add a diplomatic response, but do not address the underlying exposure at these facilities.

Two of today's critical vulnerabilities involve attack chains in which an initial weakness enables more serious downstream exploitation. CVE-2026-55040's JWT bypass provides initial access to SharePoint, while unsafe .NET type instantiation in Business Connectivity Services can turn that access into unauthenticated remote code execution across at least 8,500 internet-facing servers. CVE-2026-18963 in Keycloak similarly abuses a password-reset mechanism to gain unauthorised access. In both cases, the impact depends on how the initial weakness can be combined with other functionality.

ClickFix also appeared in several unrelated campaigns, including WordlistLoader delivering Amatera Stealer, PavinLoader distributed through fake software downloads, and fake GTA 6 sites targeting credentials. The repeated use of the technique across different campaigns shows that attackers continue to rely on user-executed commands as a low-cost delivery method.

The US Treasury sanctioned six Iranian nationals linked to Iran's Ministry of Intelligence and Security for cyberattacks on critical infrastructure since 2023. Targets included energy, defence, healthcare and financial sector organisations, plus multiple US government offices compromised in 2024. The sanctions follow reports that Iranian hackers shut down a small UK power plant for four days without affecting the wider grid.

Researchers at Straiker showed how poisoned telemetry data tricked an Amazon Bedrock-powered SRE agent into deploying a privileged Kubernetes container. The container escaped to the host via nsenter, encrypted application files with AES-256-CBC, and replaced a storefront with a ransom page. A watchdog mechanism re-poisoned the environment for 20 minutes, defeating the agent's own automated recovery attempts.

Gen Threat Labs identified WordlistLoader, a new malware loader distributing Amatera Stealer through ClearFake campaigns using fake CAPTCHA pages. Victims are tricked into pasting malicious commands via the ClickFix technique, triggering downloads that reconstruct shellcode encoded as English words. Amatera has since evolved with stronger obfuscation, hardened syscall evasion, and a revamped bypass for Chrome's Application-Bound Encryption.

A researcher discovered AliExpress silently creates two WebAudio contexts via obfuscated scripts, collina.js and fireyejs.js, tied to Alibaba's anti-fraud tooling. The scripts generate an oscillator waveform, analyse it through a zero-gain node connected to the audio destination, contributing to a broader fingerprint alongside canvas, WebGL and hardware data. No visible media elements or Media Session activity indicate the processing, and it can interfere with Bluetooth multipoint audio switching.

ReliaQuest disclosed a social engineering attack on 22 August 2026, where attackers impersonating staff phoned employees toward a fake single sign-on page. One employee entered credentials and approved an MFA push, granting view-only dashboard access. Device trust controls blocked further access, and the session, password, and authentication factors were terminated within hours.

VulnCheck developed a working exploit chaining CVE-2026-55040, a JWT authentication bypass, with CVE-2026-63520, an unsafe .NET type instantiation flaw in SharePoint's Business Connectivity Services. An unauthenticated attacker can forge a JWT token, upload a malicious BDC model file, and trigger remote code execution by querying an external list. CVE-2026-55040 was added to CISA's Known Exploited Vulnerabilities catalogue on 18 August, with at least 8,500 internet-facing SharePoint servers identified as potentially exposed.