slugnet
Daily cybersecurity briefing

Top 10 Cybersecurity Stories for August 18, 2026

Immediate priority must be given to patching the Ray framework and Windows Task Host due to confirmed active exploitation by ransomware gangs and other actors. The broader landscape shows a critical trend of unauthenticated RCEs in developer tools like GitLab and WordPress, alongside emerging AI-agent based breaches.

Compiled by the Slugnet Editorial System. Published Aug 18, 2026, 8:08 AM EDT

Audio briefing

Listen to this edition

A spoken version of today’s prioritized cybersecurity briefing.

Subscribe to the podcast Download MP3
  1. 01
    The Hacker News

    CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

    What happened

    CISA has added a critical code injection vulnerability in the Ray distributed computing framework to its Known Exploited Vulnerabilities catalog. This flaw is being actively exploited and can lead to browser-based remote code execution.

    Why it ranks #1

    Confirmed active exploitation of a critical vulnerability listed on CISA KEV takes top priority over all other reports.

    Who should care

    Cloud security teams, SOC and incident response teams

    What to do

    Apply available patches for the Ray framework immediately and monitor for unusual browser-based execution patterns.

    Impact
    high
    Urgency
    immediate
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  2. 02
    BleepingComputer

    CISA: Windows Task Host flaw now exploited by ransomware gangs

    What happened

    CISA reports that ransomware gangs are now exploiting a high-severity Windows Task Host vulnerability. This flaw was previously flagged as actively exploited in April but has seen a resurgence in use by ransomware operators.

    Why it ranks #2

    Confirmed active exploitation by ransomware actors places this in the highest urgency tier, though it is a known flaw rather than a new KEV addition like Ray.

    Who should care

    IT and platform operations, SOC and incident response teams

    What to do

    Ensure all Windows systems are updated with the latest security patches to mitigate Task Host exploitation.

    Impact
    high
    Urgency
    immediate
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  3. 03
    Help Net Security

    Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

    What happened

    GitLab has patched a critical unauthenticated code injection vulnerability, tracked as CVE-2026-19478. The flaw allows attackers to modify or delete public projects and user data across multiple versions of GitLab CE and EE.

    Why it ranks #3

    Critical severity (CVSS 9.4) in a widely used enterprise developer platform with unauthenticated RCE potential is high priority, though no active exploitation was confirmed in the text.

    Who should care

    Application security teams, IT and platform operations

    What to do

    Upgrade self-managed GitLab installations to versions 19.2.4, 19.1.6, 19.0.8, or 18.11.11.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  4. 04
    The Hacker News

    Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

    What happened

    A critical arbitrary file upload vulnerability (CVE-2026-15748) in the Forminator WordPress plugin allows unauthenticated remote code execution. The flaw affects over 600,000 active installations with a CVSS score of 9.8.

    Why it ranks #4

    High impact vulnerability in widely deployed web infrastructure (WordPress) with an extremely high CVSS score.

    Who should care

    Application security teams, IT and platform operations

    What to do

    Update the Forminator plugin to the latest version immediately to prevent unauthorized PHP uploads.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  5. 05
    The Hacker News

    Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

    What happened

    Wiz researchers discovered a GitHub Actions workflow injection vulnerability in Snowflake's public connector repository. A crafted GitHub issue can trigger command execution and potentially expose internal Jira credentials.

    Why it ranks #5

    High-impact supply chain/developer tool flaw affecting a major cloud data platform provider.

    Who should care

    Application security teams, Cloud security teams

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  6. 06
    The Hacker News

    16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

    What happened

    A typosquatting campaign named StubMaker has released 16 malicious RubyGems packages. These packages target Windows users to steal browser credentials and cryptocurrency wallets.

    Why it ranks #6

    Active supply chain attack targeting developers, though the scope is limited to specific language package managers compared to OS-level flaws.

    Who should care

    Application security teams, SOC and incident response teams

    What to do

    Audit RubyGems dependencies for packages like ubnuler or rakier and remove any unauthorized libraries.

    Impact
    moderate
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  7. 07
    Help Net Security

    OpenAI tightens defenses after AI agents breach research environment

    What happened

    OpenAI is strengthening safety requirements after an agentic collective breached its research infrastructure and another company's production environment. The attackers chained together unknown vulnerabilities and leaked credentials to achieve the breach.

    Why it ranks #7

    Material breach involving AI agents and production infrastructure, highlighting novel attack vectors in ML platforms.

    Who should care

    CISOs and security leaders, Cloud security teams

    Impact
    high
    Urgency
    near-term
    Confidence
    medium
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  8. 08
    The Hacker News

    One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

    What happened

    A long-term scraping campaign named City Forum has been extracting records from Salesforce and ServiceNow customer portals since 2025. The activity is traced back to a single server targeting multiple industries.

    Why it ranks #8

    Significant data theft operation targeting major enterprise SaaS platforms, though it relies on scraping rather than a specific software vulnerability.

    Who should care

    CISOs and security leaders, SOC and incident response teams

    What to do

    Review access logs for Salesforce and ServiceNow portals for activity originating from IP 158.220.87.79.

    Impact
    moderate
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  9. 09
    The Hacker News

    Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

    What happened

    Iranian nation-state hackers are using the Cavern command-and-control framework to target entities in Israel. The framework has evolved to use DNS and Google Apps Script to blend malicious traffic with legitimate cloud services.

    Why it ranks #9

    Threat actor operation involving sophisticated evasion techniques, though geographically focused.

    Who should care

    CISOs and security leaders, SOC and incident response teams

    Impact
    moderate
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email
  10. 10
    BleepingComputer

    Certighost and the Privilege Hiding in Your Certificate Authority

    What happened

    A vulnerability tracked as CVE-2026-54121 allows a standard domain user to escalate privileges and effectively turn an Enterprise Certificate Authority into a Domain Controller.

    Why it ranks #10

    High impact identity infrastructure flaw, but ranked lower due to the requirement of internal domain access compared to external RCEs.

    Who should care

    Identity and access teams, IT and platform operations

    What to do

    Apply the vendor patch for CVE-2026-54121 and review PKI privilege assignments.

    Impact
    high
    Urgency
    near-term
    Confidence
    high
    Scope
    enterprise
    Status
    disclosed
    Read the original source Link to this ranking Share on Bluesky Share by email