Briefing — 26 August 2026

Security News CISA Warns of Exploited Gitea Vulnerability — CISA has issued an alert for an actively exploited vulnerability in the Gitea self-hosted Git service; organisations running Gitea should patch immediately. Alabama Launches Investigation Into OpenAI's Hack of Hugging Face — The state of Alabama is investigating allegations that OpenAI compromised Hugging Face infrastructure, in a significant and still-developing inter-company dispute. AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes — A Phishing-as-a-Service platform is using voice AI to call iPhone users, impersonate Apple Support, and extract device passcodes. 58 arrested in international cybercrime crackdown — Interpol coordinated a multi-continent operation resulting in 58 arrests across criminal cybercrime networks. Paylogix employee benefits platform hacked by Akira — Akira ransomware stole financial and health data from Paylogix, an employee benefits administration platform. Hospital operator Nutex Health says data stolen in cyberattack — US hospital operator Nutex Health confirmed patient data was stolen in a cyberattack, continuing the pattern of healthcare sector targeting. Massive DDoS attack disrupts Norway's government digital services — A large-scale DDoS attack caused widespread disruption to Norwegian government digital infrastructure with no confirmed attribution. Hackers abuse npm mirrors to host phishing redirect pages — Attackers are exploiting npm package mirror infrastructure to host phishing redirects, leveraging developer trust in the npm ecosystem. Hidden Prompts Trick AI Into False Email Summaries — Prompt injection attacks can manipulate AI email assistants into generating false summaries, potentially causing recipients to act on fabricated information. You could've applied all 1,449 Oracle patches and still been hit by this attack — An Oracle environment was successfully compromised via misconfiguration despite full patch compliance, illustrating the limits of patching-only security posture. NemoClaw: LLM Poisoning via Network in OpenClaw — A vulnerability in the OpenClaw open-source LLM framework allows network-based poisoning of model context, a novel attack vector against AI infrastructure. CVE-2026-70337 Microsoft PowerShell RCE — Remote code execution vulnerability in PowerShell; one of several high-severity Windows CVEs on the board this week alongside NTFS RCE (CVE-2026-50448) and Excel RCE (CVE-2026-55137). UK & Critical National Infrastructure ShadowByt3$ hits two UK targets simultaneously — The group posted both A-Plus Software Limited (technology) and Nottingham Trent University (education) within minutes on 25 August. The coordinated posting against a software firm and a large UK university may indicate a campaign rather than opportunistic compromise. NTU holds significant research data and student records. No new NCSC advisories in the past 48 hours. Check ncsc.gov.uk/news/alerts-advisories for the latest. Norway government DDoS — directly relevant for UK public sector defenders. The targeting logic for Scandinavian government services applies equally to UK equivalents. BleepingComputer Ransomware Victims (48h) 43 victims · 16 groups · 3 UK victims · Healthcare & CNI flagged Group Victim Country Sector akira WINTER Ingenieure DE Manufacturing akira Davis & Ferber — Professional Services arcusmedia Mark'Techno — Technology arcusmedia ManagementPro — Professional Services AuditTeam ma***up RU — blackwater www.ptesm.com PT — Booba Project Chernyy & Associates RU Professional Services Booba Project Davroc 🇬🇧 GB Technology Booba Project Country-Wide Insurance US Financial Services Booba Project Federis Abogados MX Professional Services chaos parkderochie.com NL Other chaos mswalker.com US Professional Services chaos copcp.com CN — Dark Project Pump Engineering Company US Manufacturing Dark Project ⚠️ Dentist in New Britain, CT US Healthcare Dark Project Jones, Little & Co., CPAs, LLP US Professional Services Dark Project The Liberty Group US — Dark Project Furnished Quarters US Hospitality Dark Project Design-Aire Engineering, INC US Manufacturing Deadlock SHAHEEN LAW GROUP PLC US Professional Services Deadlock FBC ZA — direwolf Studio Legale ESE IT Professional Services direwolf ⚠️ National Kidney Registry US Healthcare dragonforce Criba AR Technology dragonforce Frato BR Other dragonforce Wozair AE Other dragonforce Brookview Financial CA Financial Services Global Secret Group Tiseo Paving US Transportation Global Secret Group Johnson City Honda US Retail & E-Commerce Global Secret Group ⚠️ Lockheed Architectural Solutions, Inc. US Government & Defense majinahanashi PCA Group Sdn. Bhd. MY Other Panzer ⚠️ Government of Vojvodina RS Government & Defense qilin Brazosport College US Education qilin SC PaderTeG Cabluri Electrice RO Manufacturing qilin STRUCTURED SETTLEMENT CAPITAL LLC US Financial Services qilin AGROLAND S.A. RO Agriculture & Food qilin Consultores de Seguros — Financial Services qilin Coldfish Seafood CA Agriculture & Food safepay industry.airliquide.kr KR Manufacturing safepay lagegepesca.it IT Agriculture & Food ShadowByt3$ Sinar Mas Agribusiness (Golden Agri-Resources) ID Agriculture & Food ShadowByt3$ A-Plus Software Limited 🇬🇧 GB Technology ShadowByt3$ Knottingham Trent University 🇬🇧 GB Education