# Archive
Browse past daily curated stories
Saturday, August 08, 2026
-
1The Hacker News generalSnowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People
Connor Riley Moucka, 26, of Kitchener, Ontario pleaded guilty in Seattle federal court to computer fraud, wire fraud, aggravated identity theft, and conspiracy stemming from the 2024 Snowflake customer account breaches. The intrusions compromised at least 165 organizations, exposed records of 100 million+ people, and netted Moucka personally at least $495,000. This guilty plea closes a major chapter in one of the largest cloud data breach campaigns on record.
-
2The Hacker News general18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
An 18-year-old use-after-free vulnerability in Linux's SCTP networking stack — present since 2008 — has been weaponized by Tencent researchers to achieve full root privilege escalation and container escape to the underlying host. Fixed in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148 released August 3, 2026, any environment running older kernels with SCTP reachable is at active risk and should patch immediately.
-
3SecurityWeek generalHackers Start Exploiting Recent JetBrains TeamCity Vulnerability
Active exploitation has begun against CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity. As a widely deployed CI/CD platform, TeamCity has historically been a high-value target for threat actors including state-sponsored groups, and unauthenticated RCE makes unpatched instances immediately exploitable without credentials.
-
4The Hacker News generalNew WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
WordPress has patched CVE-2026-64638 (CVSS 8.9), a pre-authentication reflected XSS flaw in the login screen affecting every version of the CMS that requires no attacker privileges. Under specific conditions the bug chains into server-side PHP code execution, making it critical for the hundreds of millions of WordPress deployments worldwide to apply the patch immediately.
-
5SecurityWeek generalBelarusian Ransom Cartel Mastermind Gets 16 Years in Prison
Maksim Silnikau, the Belarusian creator and administrator of Ransom Cartel ransomware, was sentenced to 16 years in U.S. prison after being active in cybercrime since at least 2005 and running Ransom Cartel from 2021 until his 2023 arrest. Silnikau was also linked to the Angler Exploit Kit distribution network, representing one of the longest-running cybercriminal careers to result in a U.S. conviction.
-
6The Hacker News generalNew Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs
MIT CSAIL researchers Danielël Trujillo and Mengjia Yan disclosed INTERRUPT INJECTION, a new technique that bypasses existing Spectre v2 defenses on Intel and AMD CPUs by timing a hardware interrupt to land in the window between branch predictor sanitization and kernel use, allowing re-poisoning after defenses have run. Demonstrated on AMD Zen 2 running Linux 6.14 with all default Spectre v2 mitigations enabled, the attack undermines assumptions that current kernel mitigations fully close the Spectre v2 attack surface.
-
7BleepingComputer generalMetabase SQLi zero-day exploited in customer data-theft attacks
A critical zero-day SQL injection vulnerability in Metabase was actively exploited in attacks against customer instances to steal data, with confirmed impact on Framework and Tally deployments. As Metabase is widely used for business intelligence dashboards with direct database connectivity, SQLi exploitation can expose sensitive organizational data at scale.
-
8The Hacker News generalClaude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
Novee Security researchers demonstrated at Black Hat USA on August 5 that a GitHub issue opened by an unprivileged account was sufficient to execute code on the CI runners of Anthropic's (Claude Code) and Google's (Gemini CLI) own repositories, and to hijack the next agent run on OpenAI's infrastructure — all using default vendor configurations. The vulnerabilities were reported to all three vendors in late 2025 and early 2026 but remain unpatched, exposing the systemic prompt-injection risk in AI coding agents operating with CI/CD permissions.
-
9CyberScoop generalDespite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online
An internet scan of industrial control systems found 4,400 exposed programmable logic controllers (PLCs) connected directly to the internet, including 22 in cities that have recently been targeted in water system cyberattacks. This persistence of exposed OT infrastructure — despite repeated federal warnings — underscores the gap between policy guidance and operational security in the water utility sector.
-
10The Hacker News generalNew Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts
CVE-2026-64561, dubbed Zapscape, is a new Linux kernel vulnerability in KVM/x86's shadow MMU that allows an attacker with kernel privileges inside an L1 guest VM to escape KVM isolation and execute code on the host when nested virtualization is exposed to untrusted guests. The flaw is particularly relevant to cloud and virtualization providers where untrusted workloads run in nested VM configurations.