CyberNews: 24/08/2026 Edition

Today’s roundup

Summary

Red Hat and the Keycloak project patched CVE-2026-18963 (CVSS 9.1), a critical flaw in the open-source identity and access management server that lets an unauthenticated remote attacker take over any user account by forcing a password reset.

Researchers detailed UAT-10147, a Chinese-speaking cybercrime group using AI to scale attacks on Windows and Linux web servers in the education, media, technology and gaming sectors, mostly in Brazil, Bolivia, China, Canada and Vietnam. The group deploys the SPECTRE toolkit with an EDR bypass and a Linux rootkit; the activity came to light after the discovery of an open directory.

Experts say the Iranian cyber-attack that shut down a UK power plant exposes the fragility of the country's critical national infrastructure.

Seqrite Labs uncovered Operation QUICSILVER, an espionage campaign against Myanmar's government and IT sectors that uses graduation ceremony invitation lures to deliver QUICAgent, a Go backdoor. The activity is attributed with moderate confidence to a China-nexus threat actor.

Want to dig deeper?

Vulnerabilities