Unpatched and under-disclosed vulnerabilities dominated today's exploitation activity. CISA gave federal agencies three days to patch CVE-2026-21962, a maximum-severity Oracle WebLogic and HTTP Server flaw under active exploitation that can grant attackers complete access to affected systems, despite a patch being available since January. More than 270 internet-facing Zimbra Collaboration Suite servers were compromised through CVE-2026-73570. Attackers also exploited two miniOrange SAML SSO bypasses, CVE-2026-61979 and CVE-2026-15981, to obtain WordPress administrator access. Those vulnerabilities remained exposed for weeks because six paid plugin editions were not tracked in public vulnerability databases. Microsoft's own defences were affected as well: ShieldBreak (CVE-2026-69414) allows a low-privileged local attacker to escalate to SYSTEM through Microsoft Defender's file-scanning engine, with no patch currently available.

Phishing operations continued to use legitimate communication services and increasingly automated techniques. AnonyMousKIT combines AI voice agents, email, SMS and WhatsApp to persuade owners of stolen iPhones to surrender Activation Lock credentials, with calls reportedly costing around ten cents each. ZeroTokens gives operators live session control over phishing targets across 53 financial brands, while Mirage2FA has affected an estimated 4,500 US and EU companies by abusing Microsoft 365 login flows to bypass two-factor authentication. Separately, npm packages used unpkg mirrors to host fake Cloudflare CAPTCHA redirects. These campaigns use existing platforms and services to make phishing infrastructure harder to distinguish from legitimate activity.

A distributed denial-of-service attack also disrupted Norway's shared government digital services. At the same time, INTERPOL's Operation Jackal IV, conducted across 22 countries, resulted in 58 arrests and identified 263 suspects linked to West African organised crime networks including Black Axe.

An eight-month INTERPOL operation identified 263 suspects linked to West African organised crime networks behind romance scams, cryptocurrency fraud and business email compromise. Authorities in South Africa arrested 39 people and seized USD 2.67 million after raiding sites tied to a romance and investment scam syndicate. Investigators in Argentina uncovered a Crime-as-a-Service network of 196 individuals supplying website domains and money laundering support to these groups.

Two critical authentication bypasses in the miniOrange SAML 2.0 Single Sign On WordPress plugin allowed unauthenticated attackers to sign in as any user, including administrators. The vulnerabilities, CVE-2026-61979 and CVE-2026-15981, stemmed from flawed signature algorithm handling and misread OpenSSL verification results. DigitalOcean discovered both flaws after blocking a suspicious admin session, later finding six paid plugin editions had been silently patched without advisories, leaving them unlisted in vulnerability databases.

CISA added CVE-2026-21962, a maximum-severity access control flaw in Oracle's HTTP Server and WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog. The bug allows attackers to create, delete or modify critical data, potentially gaining complete access to affected systems. Oracle patched the flaw in January 2026, though a CloudSEK honeypot captured exploitation attempts against it as early as that same month.

CVE-2026-69414, dubbed ShieldBreak, is a zero-day flaw in the Microsoft Malware Protection Engine that lets a low-privileged local attacker escalate to SYSTEM. A public proof-of-concept was released on 12 August 2026, and Microsoft assigned the CVE two days later, with no patch yet available. The exploit abuses Defender's cloud-file hydration process, using a user-mode callback to manipulate which files Defender scans, and has been shown to work on Windows 11 25H2 and Windows Server 2025.

Researchers exposed AnonyMousKIT, a Phishing-as-a-Service platform that uses AI voice calls, email, SMS and WhatsApp to trick owners of stolen Apple devices into surrendering Activation Lock credentials. A coding flaw involving bare relative paths exposed operational logs, revealing a reseller network spanning 506 domains and 168 storefront brands active since 2024. The platform's AI voice agents impersonated Apple Support across 200 calls, mostly targeting Brazil, at a total cost of under twenty dollars.