PostgreSQL's own security page for CVE-2026-6471 (fix published 13 August 2026) describes missing authorisation in logical decoding: a non-superuser with REPLICATION privilege can cause the server to dlopen any file visible to the OS account running PostgreSQL by choosing the logical decoding plugin path, which runs arbitrary code as that account. Affected before 18.6, 17.11, 16.15, 15.19, and 14.24; fixed in those builds. Vendor CVSS 3.0 is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Cyera's PostGREShell research (covered by SecurityWeek on 4 September 2026) explains how replication-protocol plugin loading can be abused for RCE, privilege escalation and persistence when REPLICATION is granted to backup or monitoring accounts. Inventory roles with REPLICATION, patch to the fixed minor releases, and do not treat REPLICATION as a low-privilege convenience grant.
Nick Scali Limited's 13 August 2026 ASX release says it is investigating a security incident and elected to take certain systems offline. The company said it was bringing those systems back online, continuing to complete sales orders and deliveries, with slower-than-normal customer response times. At the time of the release, Nick Scali said it did not have any evidence of unauthorised access to customer data. It notified the Australian Cyber Security Centre and the Australian Federal Police, and said further updates would follow as appropriate. The Sydney Morning Herald (13 Aug) reported that chief executive Anthony Scali said the incident happened 'about mid-last week' and that staff were referring to manual records to get in touch with customers whose orders had been affected. UPDATE (22 Oct 2026): in an email to customers reported by the NZ Herald on 10 September, Nick Scali said details on sales orders, including name, email address, delivery address and phone number, were affected, and that no credit card details are recorded on sales orders because card payments go through a third-party provider. In its 21 October 2026 ASX trading update, Nick Scali said the incident left its ERP systems unavailable for about three weeks, with stores processing sales orders manually, and that about $980,000 of direct consultant and legal costs will be reported outside underlying net profit. Capital Brief, citing The Australian, reported that the attackers claimed to have customer details and demanded an unspecified ransom, and that Nick Scali hired an intermediary to negotiate; Nick Scali has not confirmed this in its ASX releases. CORRECTION (22 Oct 2026): this card earlier said customer-data access was not verified; Nick Scali has since told customers that sales-order details were affected (source: NZ Herald, 10 Sep 2026).
Google announced Gemini 3.7 Flash on 13 August 2026 as its current Flash workhorse for coding and agents, three weeks after 3.6 Flash. Gemini Spark for Google AI Pro and Ultra subscribers uses 3.7 Flash from that day. Google says the model ships with updated CBRN and cyber-offense safeguards. Introductory API pricing is listed as $0.75 per million input tokens and $3.75 per million output tokens through 31 December 2026.
WordPress 7.0.4 (12 August 2026) is a security release. An Author or anyone with upload_files can upload a malicious PostScript file and reach remote code execution, but only where Imagick and Ghostscript are both in use. WordPress credits pwn.ai. GitHub advisory GHSA-8vr3-7mxf-gx8w scores it 8.8 (CVSS 3.0). Fixed in 7.0.4, with backports through the 4.7 branch (6.9.7, 6.8.8, and the matching older branch builds). No exploitation claim on the WordPress or GitHub notices.
Palo Alto Networks 12 August 2026 advisory: local privilege-escalation bugs in the GlobalProtect app let a local user reach NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux, then run commands with administrative privileges. iOS, Android and Chrome OS are not affected. Vendor CVSS-BT is 5.9 (CVSS 4.0); the same advisory lists CVSS-B 8.5 without the exploit-maturity modifier. Palo Alto Networks says it is not aware of malicious exploitation. Same-day GlobalProtect app advisories cover CVE-2026-0295 (macOS race-condition LPE, CVSS-BT 4.1), CVE-2026-0296 (certificate-validation bypass of app traffic, not the VPN tunnel, CVSS-BT 4.5), CVE-2026-0297 (UDP tunnel handshake buffer overflow, CVSS-BT 5.2) and CVE-2026-0298 (Windows PLAP MitM code execution, CVSS-BT 5.2 / CVSS-B 7.7). Those sibling advisories show Updated 2026-09-12 on the PSIRT hub; Palo Alto Networks still says it is not aware of malicious exploitation. PAN-OS URL Filtering information disclosure CVE-2026-0301 (CVSS 1.7) was also published 12 August. Prisma Access Agent LPE CVE-2026-0294 (CVSS-BT 6.0; patch 26.3+) remains a related same-day PSIRT item.
MSRC CVE-2026-65660 (August 2026 CSPU) is a SharePoint Server code-injection RCE: an authorized low-privilege attacker can execute code over the network without user interaction. Microsoft scores CVSS 3.1 8.8 Important (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Viettel Cyber Security (Dinh Ho Anh Khoa) shows the bug in SafeControls/ToolPane Register-directive reconstruction (unescaped quotes → arbitrary .NET class load → XamlServices.Parse webshell) and notes Microsoft’s HTML advisory initially framed it as spoofing/CVSS 6.5 while the CVE record titles RCE. Affects SharePoint Server 2016, 2019, Subscription Edition (researcher also claims 2013 EOL). August 11 updates fix; can chain with already-patched auth bypass for pre-auth RCE only if that June fix was missed. UPDATE 25 Sep 2026: CISA added CVE-2026-65660 to KEV (dateAdded 2026-09-25; federal due date 28 Sep 2026) alongside WSO2/Adobe Magento KEV adds. UPDATE 27 Sep 2026: SecurityWeek reports Microsoft’s updated advisory states that as of 25 September 2026 Microsoft had reliable evidence of observed attacks exploiting this vulnerability; Previdian (formerly KEVIntel) saw exploitation attempts on 24 Sep and attempts to create a webshell backdoor on 25 Sep, appearing based on Viettel’s technical disclosure. UPDATE 1 Oct 2026 (added 13:00 Perth): WA SOC advisory 20261001001 (TLP:CLEAR) restates CVE-2026-65660 (CVSS 8.8 High) as an authenticated low-privilege code-injection RCE on SharePoint Server 2016/2019/Subscription Edition, notes CISA KEV listing, gives the build floors above, links MSRC, and states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing; recommends vendor patches within expected timeframes. (sources: MSRC; SecurityWeek)
MSRC — CVE-2026-65660 SharePoint Server RCE (Aug 2026)
Microsoft patched CVE-2026-62911 in the August 2026 Patch Tuesday cycle: authentication bypass by capture-replay in Exchange Server that lets an authorised attacker elevate privileges over the network and take over user mailboxes (send, read, download attachments). Affected products named in coverage include Exchange Server 2016, 2019 and Subscription Edition. On 1 September 2026 BleepingComputer reported Shadowserver observing 21,899 internet-exposed Exchange fingerprints still unpatched (largest counts in the United States and Germany), and relayed NCSC-NL guidance that exploit code is available and that Exchange 2016/2019 security updates require the Extended Security Updates programme. Germany's BSI separately warned that a large share of on-premises Exchange in Germany remained vulnerable. Cyberstack has not seen a CISA KEV listing for CVE-2026-62911 at write-up. NEW 8 Sep AU: iTnews cites Shadowserver counts of 382 Australian and 56 New Zealand Exchange hosts still vulnerable as of 31 August 2026; NCSC-NL (28 Aug) said public PoC exists and warned unauthenticated attackers could potentially achieve arbitrary code execution; ASD urges patching or network segmentation for legacy Exchange; coverage rates CVSS 3.1 as 8.0. Patch promptly; do not leave legacy Exchange on the public internet.
Microsoft's 11 August 2026 Patch Tuesday fix (MSRC CVE-2026-63520) addresses improper input validation in on-premises SharePoint that lets an unauthorised attacker execute code over the network. NVD scores it 8.1 (CVSS 3.1, High, attack complexity High). Rapid7, which co-disclosed with Microsoft, says the bug is unsafe .NET type instantiation in Business Connectivity Services and that chaining it with the July auth bypass CVE-2026-55040 yields unauthenticated RCE. August security updates cover SharePoint Server Subscription Edition (KB5002893), SharePoint Server 2019 (KB5002894 / KB5002896), and SharePoint Enterprise Server 2016 (KB5002905 / KB5002906). Public PoC material for the RCE half appeared around 24 August; Defused later reported honeypot probes of the 55040+63520 chain (JWT bypass exercised, BCS probing, no code execution observed in that report). Microsoft had not labelled 63520 as exploited in the wild at last magazine check. Prefer the August updates; do not leave on-prem SharePoint internet-facing without need.
Microsoft's 11 August 2026 security update for CVE-2026-68820 fixes a use-after-free in the Windows Ancillary Function Driver for WinSock. A locally authenticated attacker who wins a race with a crafted application can elevate to SYSTEM. Microsoft rates it Important, CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and marks Exploitation Detected. CISA added it to the Known Exploited Vulnerabilities catalog on 11 August 2026 with the same-day Cisco ASA/FTD and Metabase KEV batch. Apply the August 2026 cumulative update for your Windows build and reboot so the kernel driver replacement takes effect.
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability. Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Microsoft's UFO repository published GitHub security advisory GHSA-24fq-m9rr-g3mm (rated Critical) on 10 August 2026 (05:24 UTC; 1:24 pm Perth) for CVE-2026-73296 in its open-source UFO automation framework. The advisory says the Mobile Model Context Protocol (MCP) data-collection and action servers, on TCP ports 8020 and 8021, expose ADB-backed Android functionality without authentication, so that when they are run in the documented remote configuration bound to 0.0.0.0, any network client that can reach them can retrieve screenshots, UI hierarchy data and device metadata and inject taps, swipes, text, key events, app launches and control clicks into an ADB-connected device; the default CLI host is localhost. It rates the flaw CVSS 3.1 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) under CWE-306 and CWE-862. The advisory describes a proposed remediation in which both servers require a bearer credential read from UFO_MCP_API_KEY and startup fails closed when the key is absent. The CVE record (GitHub CNA) says the issue is fixed in UFO 3.0.8, and CISA's enrichment lists proof-of-concept exploitation. Until patched, keep Mobile MCP on localhost and block TCP 8020/8021. (sources: GitHub advisory; CVE record) Correction (27 Oct 2026): the card now rests on the advisory in Microsoft's UFO repository and the CVE record, not on Cyber Security News, which does not serve its pages to Cyberstack; that link and credit are removed, the advisory link now points at the repository advisory (the global advisory page returned 404), and the description of UFO 3.0.8's authentication change is now given as the advisory states it, a proposed remediation. The card date has moved from 31 August to 10 August 2026, the Perth date of the advisory. (source: GitHub advisory GHSA-24fq-m9rr-g3mm; CVE.org)
GitHub — microsoft/UFO advisory GHSA-24fq-m9rr-g3mm (10 Aug 2026)
Progress LoadMaster Command Injection Vulnerability. Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
