Briefing — 25 August 2026

Security News US sanctions Iranian cyber actors as UK discloses power plant attack (The Record) — Iran-linked actors caused an operational shutdown of a UK power generation facility; US responded with sanctions against the responsible Iranian cyber operators. You don't want this Sleepwalker backdoor on your Windows machine (The Register) — A new stealthy Windows backdoor using advanced persistence mechanisms to evade standard detection tools; no patch currently available. CVE-2026-50661: Windows BitLocker Security Feature Bypass (MSRC) — A vulnerability allowing attackers to bypass BitLocker disk encryption protections, with implications for device theft and data recovery attacks. CVE-2026-47292: VS Code MSSQL Extension Remote Code Execution (MSRC) — RCE vulnerability in the Visual Studio Code MSSQL database extension affecting developers using VS Code with SQL Server tools. Exploited Zimbra Flaw Highlights Shrinking Window to Patch (Dark Reading) — Active exploitation of a Zimbra vulnerability demonstrates the narrowing gap between disclosure and attacker exploitation across the industry. Unpatched Calix flaw lets hackers bypass NAT to expose internal devices (BleepingComputer) — An unpatched vulnerability in Calix networking equipment allows attackers to bypass network address translation and reach internal devices directly from the internet. Hackers target WordPress sites in miniOrange auth bypass attacks (BleepingComputer) — Active exploitation of an authentication bypass in the miniOrange WordPress plugin is allowing attackers to gain access without valid credentials. ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited (SecurityWeek) — ShinyHunters successfully breached cybersecurity firm ReliaQuest, though the company says the attempted data theft was ultimately unsuccessful. Nvidia senior manager linked to Supermicro scheme smuggling AI servers to China (Ars Technica) — A senior Nvidia employee is implicated in a scheme to illegally export Supermicro AI servers to China in violation of US export controls. AliExpress caught fingerprinting visitors via inaudible audio sounds (Ars Technica) — AliExpress was found fingerprinting website visitors using inaudible audio signals to uniquely identify devices and track users across sessions even after clearing cookies. WordlistLoader Disguises Malware as Ordinary Text (Dark Reading) — A new malware loader evades detection by disguising its payload as ordinary wordlist text files commonly used by security tools. LLMs could control host machines by exploiting inference engines (Boyd Kane) — Research argues that language models could potentially take control of their host machines by exploiting vulnerabilities in the inference engine runtimes executing their workloads. UK & Critical National Infrastructure Iran-linked cyberattack disrupts UK power plant — An Iran-linked threat actor caused an operational shutdown of a UK power generation facility. The US has sanctioned the responsible Iranian cyber actors. This is a rare public admission of physical operational impact from a cyberattack on UK critical national infrastructure. UK CNI operators — particularly in energy — should treat this as an active threat signal. The Register | The Record No new NCSC advisories published in the past 48 hours. Check ncsc.gov.uk/news/alerts-advisories for the latest. Also relevant for UK defenders: the metaencryptor ransomware group hit Weber Water Resources (US water utility) — a reminder that water and utilities remain in scope for ransomware actors as well as state-sponsored groups. Ransomware Victims (48h) 54 victims · 20 groups Group Victim Country Sector akira Bihl DE Other arcusmedia Mark'Techno — Technology arcusmedia ManagementPro — Professional Services Barracuda ⚠️ Skyline Implants & Periodontics US Healthcare Barracuda Namyang Industrial Co., Ltd. KR Manufacturing Barracuda ⚠️ Clinical Associates of the Finger Lakes (CAFL) US Healthcare blackwater www.ptesm.com PT — Booba Project Chernyy & Associates RU Professional Services Booba Project Davroc 🇬🇧 GB Technology Booba Project Country-Wide Insurance US Financial Services Booba Project Federis Abogados MX Professional Services coinbasecartel Westwing Group SE DE Retail & E-Commerce Dark Project Jones, Little & Co., CPAs, LLP US Professional Services Dark Project The Liberty Group US — Dark Project Furnished Quarters US Hospitality Dark Project Design-Aire Engineering, INC US Manufacturing Deadlock SHAHEEN LAW GROUP PLC US Professional Services Deadlock FBC ZA — dragonforce Criba AR Technology dragonforce Frato BR Other dragonforce Wozair AE Other dragonforce Brookview Financial CA Financial Services emperador FRUCASTRO SL ES Agriculture & Food kazu ⚠️ PappyJoe: Healthcare Management System US Healthcare kazu ⚠️ Instituto Ferrero de Neurología y Sueño AR Healthcare kazu ⚠️ Brazil Mobilemed: Cloud PACS Platform BR Healthcare kazu Canada Yocale: Appointment Management System CA Professional Services kazu ⚠️ PawlyClinic: Digital Veterinary Care Platform US Healthcare kazu ⚠️ Dr Akbar Niazi Teaching Hospital PK Healthcare kazu ⚠️ Centro Médico Especializado OSI MX Healthcare kazu ⚠️ Meducar: Telemedicine and Patient Management BR Healthcare kazu ⚠️ ConsultorioMovil: Telemedicine and Healthcare System MX Healthcare krybit resi.com DE Retail & E-Commerce lockbit5 adt.com US Professional Services majinahanashi PCA ***** — — metaencryptor Woodlore International Inc. CA Other metaencryptor Trailer Transit Inc US Transportation metaencryptor ⚠️ Weber Water Resources US Energy & Utilities metaencryptor ⚠️ MPA Pharma GmbH DE Healthcare metaencryptor Aquamar Inc US Agriculture & Food metaencryptor Corona Corporation JP Other metaencryptor FactoryFive US Manufacturing Panzer ⚠️ Government of Vojvodina RS Government & Defense Panzer Senvibe — Technology qilin Coldfish Seafood CA Agriculture & Food qilin A&E + SMA Design AE Professional Services qilin S.E.M.P. s.r.l. IT Manufacturing qilin Clear Align US Professional Services qilin Difor CL Technology qilin Black Cat Engineering & Construction WLL QA Manufacturing safepay lagegepesca.it IT Agriculture & Food shinyhunters CyrusOne, LLC. US Technology Storm ⚠️ City of Mitchell US Government & Defense Storm Sharp Motor Group AU Transportation