Attackers aren’t sticking to the usual playbook. |
Today’s threats cross enterprise platforms, developer ecosystems, AI environments, and mobile devices… sometimes in minutes.
Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Shell Hit in Cl0p PTC Data Theft Campaign |
Shell is investigating Cl0p’s claim that it stole 89 GB of sensitive engineering and project data. The company was among 43 organizations reportedly targeted through internet-facing PTC Windchill and FlexPLM systems vulnerable to CVE-2026-12569. |
While Shell has not confirmed details, Cl0p claims the stolen data includes engineering drawings, facility reports, photographs, and project plans.
Patch affected PTC systems, restrict internet exposure, enforce strong access controls, monitor for compromise, and rotate exposed credentials. |
SAP Commerce Cloud RCE Flaw Exploited in Attacks |
Threat actors are exploiting a SAP Commerce Cloud flaw that enables unauthenticated remote code execution. CVE-2026-58231 is a CVSS 10.0 flaw that allows attackers to execute arbitrary code without authentication or existing privileges.
Defused security detected exploitation attempts just three days after SAP released a patch, despite no known public proof-of-concept exploit. Patch SAP Commerce Cloud, monitor for exploitation, rotate potentially compromised credentials, and test IR plans. |
LiteLLM Attack Exposes Credentials at 2,500 Organizations |
A LiteLLM package compromise may have exposed credentials from 2,500 organizations and thousands of CI/CD pipelines. Attackers compromised LiteLLM’s PyPI account and published malicious versions that stole cloud keys, repository tokens, SSH keys, Kubernetes secrets, and other credentials. The attack shows how one compromised dependency can expose cloud platforms, code repositories, and development environments. Search software inventories and CI/CD logs for impacted LiteLLM versions, then revoke and rotate every credential accessible to affected environments rather than only removing the malicious package. |
|
|
|
Claude Agents Create Self-Replicating Malware |
Claude agents sabotaged each other and created self-replicating malware during an Anthropic experiment. Agents sharing the same environment killed competing processes, planted malicious code, and used lockout tactics despite malware not being part of the task. |
The findings show that shared access to files and system commands can enable destructive behavior when autonomous agents have conflicting goals.
Rethink AI agent trust with isolated identities, workspaces, and credentials that limit cross-agent interference. |
Android Malware Turns Bank Calls Into NFC Fraud |
Threat actors turned a fake bank call into live NFC fraud in just 13 minutes. Attackers used the SpyNote RAT to control victims’ phones and install WindRelay for remote NFC transactions.
The malware chain combined social engineering and device takeover to enable unauthorized loans and contactless payment fraud. Block app sideloading, monitor suspicious Accessibility permissions, and use phishing-resistant MFA to protect accounts from follow-on compromise. |
|
|
|
Modern employees expect seamless access from anywhere, while IT teams are expected to deliver more with fewer resources. Cloud-first workspace strategies are becoming essential, not optional.
TechRepublic partners with Nerdio on August 19 at 1:00 PM ET to share practical guidance for simplifying cloud migrations, improving security, and reducing operational overhead. |
|
|
|
Are Your Software Dependencies Putting You at Risk? |
Software supply chain attacks can exploit trusted dependencies, build tools, and third-party packages to steal credentials or compromise critical systems. |
How to reduce supply chain risk: |
-
Maintain an SBOM, pin dependency versions, and verify package integrity before deployment.
-
Leverage DevSecOps tools, isolate CI/CD environments, and enforce least-privilege access across build systems.
- Use short-lived credentials, monitor for suspicious activity, and quickly rotate secrets after a compromise.
|
The goal is to ensure a compromised dependency remains an isolated security event rather than a pathway into critical systems and data. |
|
|
|
Security Tools You Can Use |
|
|
|
When threat actors claim a breach, what’s your first reaction? |
|
|
|
Yesterday's Pulse Check Results |
If private cybersecurity firms are allowed to hack back, how far should they be allowed to go? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
