This briefing covers 20 cybersecurity and geopolitics stories published around Tuesday, August 18, 2026, and 8 disclosed vulnerabilities (CVE-2025-62593, CVE-2026-54121, CVE-2026-65640, CVE-2026-66795 and others). Each entry links to the original reporting.
Kaspersky identified new components of the Cavern C2 framework used by Iranian nation-state actors against Israeli targets, blending malicious traffic through DNS and Google Apps Script since December 2025.
Ukraine's military intelligence disrupted Wildberries, Russia's largest e-commerce platform, coordinating the cyberattack with simultaneous drone strikes on the company's physical infrastructure.
The United States and Iran failed to reach a nuclear deal by the agreed 60-day deadline, leaving the conflict's end conditions unresolved. The collapse reopens escalation pathways and puts allied commitments to the memorandum framework under immediate strain.
Tajikistan is finalizing an oil import agreement with Iran after sanctions pressure degraded Russia's capacity as its primary fuel supplier. The deal expands Iran's economic influence in Central Asia at the direct expense of Russian leverage.
The U.S. reduced joint military exercises with South Korea as a concession to North Korea amid renewed diplomatic outreach by the Trump administration. The rollback weakens a core deterrence signal to Pyongyang while undermining confidence in U.S. alliance commitments across the Indo-Pacific.
Just Security argues Washington should test Chinese AI models for security risks and apply targeted restrictions rather than outright bans or unguarded adoption. The debate mirrors earlier semiconductor export battles and signals AI models are now treated as a national-security-grade technology category.
Beijing is enacting laws that extend Chinese legal jurisdiction extraterritorially, forcing Western companies operating in China to choose between compliance with U.S. and EU sanctions or Chinese counter-measures. The framework weaponizes market access, giving China a structural tool to blunt Western economic coercion.
Researchers identified Evooo1Bot, a new Linux botnet built on leaked Mirai source code that converts internet-facing edge devices into SOCKS5 proxies for traffic anonymization and DDoS operations.
Unknown attackers exploited a flaw in SafePal's order-tracking plugin to steal personal data on nearly 40,000 customers. The breach continues a pattern of supply-chain and plugin-layer attacks against crypto hardware wallet vendors, undermining user trust in hardware-as-security model.
SafePal disclosed a data breach Sunday affecting nearly 40,000 customers, with personal and order data exfiltrated in the incident. The breach is the latest in a string of hits against crypto hardware wallet companies, raising questions about backend security posture across the sector.
Hackers breached third-party logistics provider CEVA Logistics and stole personal and order data belonging to Pokémon Center customers in the UK and Germany. The incident illustrates how a single logistics-layer compromise propagates across multiple consumer brands simultaneously.
Microsoft is developing a fix for CVE-2026-69414, a zero-day dubbed ShieldBreak disclosed publicly by researcher Nightmare Eclipse, with no patch yet available. Public disclosure before a patch exists leaves all unmitigated Windows Defender deployments exposed during the remediation window.
CISA added CVE-2025-62593, a critical code-injection vulnerability in the Ray distributed AI computing framework, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Widespread AI/ML workload deployments running Ray create a large attack surface for remote code execution at scale.
CISA added CVE-2025-62593, a code-injection flaw in Ray exploitable via Firefox and Safari, to the KEV catalog under BOD 26-04, requiring immediate mitigation. Active exploitation of an AI infrastructure framework signals adversaries are targeting the ML development pipeline, not just production systems.
CVE-2026-75094, a CVSS 9.1 OS command injection flaw in COMFAST CF-N1-S 2.6.0.1 routers via the CGI mbox-config interface, is remotely exploitable with a public proof-of-concept already available.
A flaw in search-v2-operator's search-serviceaccount grants cluster-wide impersonation rights; any attacker reaching one of four affected pods can escalate to system:masters. CVSS 8.8 means this is exploitable without physical access and threatens any Red Hat ACM deployment running the component unpatched.
managedcluster-import-controller's CSR auto-approver skips signer-name validation and PEM decoding, letting a privileged spoke-cluster service account submit a malicious certificate request to escalate privileges on the hub.
All WordPress versions are vulnerable to RCE via malicious Postscript file upload when Imagick and Ghostscript are active; version 7.0.4 patches the flaw. Author-level access is a low bar for many CMS deployments, making exploitation likely in shared-hosting and media-heavy environments before patching completes.
Authenticated hub administrators or Search CR editors can inject shell commands or SQL into acm-search-v2-rhel9 by supplying a malicious WORK_MEM value, due to absent input validation in a bash script pipeline.
CVE-2026-54121 allows an ordinary domain user to elevate a misconfigured Enterprise CA to Domain Controller equivalence, effectively handing over Tier 0 identity infrastructure. The flaw exposes how standing privilege and implicit PKI trust convert routine user accounts into full Active Directory takeover vectors.