Cyber Security News

Hacking Editorial Brief — August 7, 2026

Active Exploitation of N-able and SonicWall Vulnerabilities

CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog following active exploitation targeting N-able N-central remote monitoring and management systems. The flaw functions as an incomplete patch for a previous vulnerability, allowing attackers to bypass authentication and pivot from compromised servers into managed endpoints across customer networks. Separately, the INC Ransomware group is exploiting recently disclosed SonicWall SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410, which permit unauthenticated remote attackers to escalate privileges to root level. Both campaigns demonstrate threat actors' continued focus on network management appliances that provide broad access to enterprise environments.

Chinese Threat Groups Accelerate Exploitation Timelines

China-nexus threat actors Vault Panda and Genesis Panda demonstrated sub-24-hour exploitation of the React2Shell vulnerability, a critical web application flaw enabling unauthenticated remote code execution. The rapid weaponization reflects systematic capability development by Chinese groups targeting newly disclosed vulnerabilities. In a parallel iOS-focused campaign, an unidentified Chinese-speaking actor deployed over 100 fake AWS and Apple credential harvesting pages hosting the publicly leaked DarkSword exploit kit, deploying GHOSTBLADE malware on compromised devices. Meanwhile, researchers documented a sophisticated Oracle database attack where threat actors exploited SQL injection to compile the khunt post-exploitation toolkit directly inside the database as Java objects, achieving SYSTEM-level code execution without writing files to disk—a technique enabling credential theft and lateral movement while evading traditional file-based detection.

Sources: The Hacker News · SecurityWeek · Infosecurity Magazine · BleepingComputer