Daily cybersecurity intelligence digest from CyberNetSec.io - August 24, 2026
π 8 threat intelligence reports covering vulnerabilities, exploits, threat actors, and security advisories.
1. Iran-Linked Hackers Shut Down UK Power Plant
A cyberattack attributed to hackers linked with Iran's Islamic Revolutionary Guard Corps (IRGC) successfully forced a small-scale UK power generator offline for four days in July 2026. While the incident did not disrupt the national grid, it represents a significant escalation in state-sponsored threats against UK critical infrastructure. Security experts believe the attack may have been a 'controlled test' to demonstrate capability. The UK government has since briefed energy sector leaders and issued new protective guidance.
2. Keycloak CVE-2026-18963 Account Takeover Flaw
A critical vulnerability, CVE-2026-18963, with a CVSS score of 9.1 has been patched in Keycloak, the open-source IAM solution. The flaw allows an unauthenticated remote attacker to bypass email verification during the password reset process, leading to a complete account takeover of any user, including administrators. Red Hat has released patches, and users are urged to update immediately. There is no evidence of in-the-wild exploitation.
3. Uber Receives β¬825M Dutch GDPR Fine
The Dutch Data Protection Authority has fined Uber β¬825 million for violating Article 22 of the GDPR. The regulator found that between 2018 and 2022, Uber used fully automated systems to suspend and deactivate driver accounts based on suspected fraud or low ratings without meaningful human review. This is the second-largest GDPR fine ever issued. Uber has stated the practices are no longer in use and plans to appeal the 'disproportionate' fine.
4. Apollo Global Management Data Breach
Private equity giant Apollo Global Management has disclosed a data breach that occurred in July 2026. Attackers used social engineering tactics, likely vishing, to gain access to some of the firm's cloud platforms. The breach exposed sensitive personal information of an undisclosed number of individuals, including names, Social Security numbers, and contact details. The incident is believed to be linked to a broader campaign by the threat group UNC6671 (BlackFile) targeting financial firms.
5. CISA Logging Reference Architecture (LRA)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released its Logging Reference Architecture (LRA), a new framework to guide federal agencies in modernizing their log management capabilities. Mandated by OMB Memorandum M-26-14, the guidance shifts focus from mere log collection to effective use of logs for threat detection, hunting, and incident response. It advocates for a tiered, federated data model to improve effectiveness and manage costs.
6. CISA Medusa Ransomware Advisory Update
In a joint advisory, CISA, the FBI, and HHS have updated their warning on Medusa ransomware, revealing it has now impacted over 500 organizations globally. Operating as a Ransomware-as-a-Service (RaaS), the group heavily targets the healthcare sector but also affects defense, IT, and finance. Medusa affiliates are known for rapidly exploiting newly disclosed vulnerabilities and using a double-extortion model, encrypting data and threatening to leak it on their dedicated site.
7. Exposed AWS Admin Keys Research
Research from Truffle Security reveals a widespread and persistent risk from publicly exposed Amazon Web Services (AWS) keys. Scans of public internet sources found over 9,300 leaked keys are still active. This includes 526 highly sensitive root keys and 242 IAM keys with full AdministratorAccess, many of which have been exposed for years. The findings highlight a critical failure in credential lifecycle management and the immense risk of account takeover.
8. SickKids Hospital Employee Data Breach
Toronto's Hospital for Sick Children (SickKids) has reported a data breach impacting the personal information of current and former employees and job applicants. The incident was caused by a vulnerability in an unnamed third-party software application, highlighting supply chain risks. Patient data and clinical systems were not affected. The hospital is investigating the scope and offering credit monitoring services to those potentially impacted.
π Subscribe to daily updates at CyberNetSec.io
All reports include detailed analysis, IOCs, mitigation strategies, and references.
