slugnet
Daily cybersecurity briefing

Top 10 Cybersecurity Stories for August 11, 2026

Immediate priority must be given to patching SonicWall SMA1000 and Fortinet/Schneider Electric devices due to active ransomware exploitation. The broader landscape shows a rise in sophisticated supply chain attacks on CMS plugins and novel exfiltration techniques targeting AI coding agents.

Compiled by the Slugnet Editorial System. Published Aug 11, 2026, 8:07 AM EDT

Audio briefing

Listen to this edition

A spoken version of today’s prioritized cybersecurity briefing.

Subscribe to the podcast Download MP3
  1. 01
    BleepingComputer

    CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

    What happened

    CISA has confirmed that ransomware gangs are actively exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery flaw. This exploitation provides an immediate entry point for ransomware deployment within enterprise networks.

    Why it ranks #1

    Confirmed active exploitation of critical infrastructure by ransomware groups takes top priority under the rubric's first tier.

    Who should care

    IT and platform operations, SOC and incident response teams

    What to do

    Apply all available SonicWall SMA1000 security patches immediately.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  2. 02
    The Hacker News

    Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

    What happened

    U.S. and South Korean agencies warn that Gunra ransomware is targeting critical infrastructure, including healthcare and financial services. The attackers are specifically exploiting known flaws in Fortinet and Schneider Electric devices to breach networks.

    Why it ranks #2

    Active exploitation of widely used enterprise edge and industrial hardware by a named ransomware threat actor falls into the highest urgency tier.

    Who should care

    CISOs and security leaders, IT and platform operations, SOC and incident response teams

    What to do

    Audit and patch all Fortinet and Schneider Electric internet-facing assets.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  3. 03
    The Hacker News

    China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

    What happened

    Microsoft has identified a new ransomware strain called StormEncryptor being deployed by the China-linked threat actor Storm-1175. The group is suspected of using N-central vulnerabilities to facilitate these attacks.

    Why it ranks #3

    Material breach and malware campaign involving a nation-state linked actor targeting enterprise software (N-central) fits tier three.

    Who should care

    IT and platform operations, SOC and incident response teams

    What to do

    Ensure N-central systems are fully patched against known vulnerabilities.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  4. 04
    The Hacker News

    BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

    What happened

    A supply chain attack targeting the WordPress plugin vendor BdThemes has been discovered. Attackers poisoned a remote JSON feed to create rogue administrator accounts without modifying source code in the official repository.

    Why it ranks #4

    Supply-chain compromise with immediate enterprise exposure (rogue admins) is a high-priority tier three event.

    Who should care

    Application security teams, IT and platform operations

    What to do

    Audit WordPress administrator accounts and disable BdThemes plugins until verified.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  5. 05
    BleepingComputer

    Cisco warns of high-severity ClamAV flaws with public exploits

    What happened

    Cisco has warned of two high-severity vulnerabilities in the Secure Endpoint Connector affecting ClamAV. Public exploits exist that allow unauthenticated attackers to cause a denial-of-service by crashing the scanning process.

    Why it ranks #5

    High-impact vulnerability in widely used security infrastructure with public exploits falls into tier two.

    Who should care

    IT and platform operations, SOC and incident response teams

    What to do

    Update Cisco Secure Endpoint Connector to the latest version.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  6. 06
    Help Net Security

    Locking your ssh-agent exposed local-only keys until OpenSSH 10.5

    What happened

    A flaw in OpenSSH 10.4 allows local-only keys to be exposed when the ssh-agent is locked, as it disables checks for remote forwarded connections. This issue has been resolved in OpenSSH version 10.5.

    Why it ranks #6

    Critical vulnerability in a foundational identity and access tool (OpenSSH) fits tier two.

    Who should care

    Identity and access teams, IT and platform operations

    What to do

    Upgrade to OpenSSH 10.5.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  7. 07
    The Hacker News

    Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

    What happened

    Researchers demonstrated a method to achieve full SYSTEM privileges on Windows 11 by abusing Plug and Play to execute signed vendor software. This attack can be triggered via Remote Desktop if USB redirection is enabled.

    Why it ranks #7

    High-impact vulnerability in the most common enterprise OS with a clear path to privilege escalation fits tier two.

    Who should care

    IT and platform operations, SOC and incident response teams

    What to do

    Disable unnecessary USB redirection on Remote Desktop sessions.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  8. 08
    The Hacker News

    Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets

    What happened

    New research reveals that malicious Model Context Protocol servers can trick AI coding agents into exfiltrating secrets. By splitting requests into routine-looking fragments, attackers can bypass safety filters to steal SSH keys and source code.

    Why it ranks #8

    Novel technique targeting AI agent infrastructure with clear operational consequences for developers fits tier four.

    Who should care

    Application security teams, Cloud security teams

    What to do

    Restrict the permissions and tool access granted to AI coding assistants.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  9. 09
    Help Net Security

    An AI tool found 84 flaws in 5G network software and 23 of them still have no fix

    What happened

    AI agents identified 84 security flaws in 4G and 5G network software, with 23 remaining unpatched. The most severe flaw allows attackers to hijack subscriber data sessions and redirect traffic.

    Why it ranks #9

    Substantial research into critical infrastructure vulnerabilities using AI tools fits tier four.

    Who should care

    CISOs and security leaders, IT and platform operations

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  10. 10
    SecurityWeek

    Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities

    What happened

    A malicious Chrome extension designed to steal AI chat data has returned to the store after a previous ban. The extension had previously amassed over 300,000 installs before its initial removal.

    Why it ranks #10

    Malware campaign targeting users of AI tools fits tier three; ranked lower due to consumer-centric nature compared to enterprise infrastructure.

    Who should care

    Individual users, SOC and incident response teams

    What to do

    Audit browser extensions and remove any unauthorized AI chat assistants.

    Impact
    low
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email