Cybersecurity briefing — August 26, 2026.

Check Point reports blocking a large-scale “debt relief” and “financial hardship” phishing campaign spanning roughly 14 days and reaching users across more than 9,000 organizations. Instead of relying on classic malicious links or attachments, the scheme pushed victims to call attacker-controlled numbers, turning routine financial conversations into the initial compromise pathway. The key takeaway for defenders: email security controls must account for social-engineering flows, not just URL and attachment scanning.

Source: Checkpoint Blog

Multiple outlets report that CISA has added CVE-2026-21962 (Oracle WebLogic Server Proxy Plug-in) to the Known Exploited Vulnerabilities catalog, emphasizing it is actively exploited. The implication is straightforward for security teams: “deadline-driven” patching matters, because attackers are already operationalizing the flaw at scale—often faster than typical internal change windows. If you run WebLogic in any exposed role, treat this as a near-term remediation item and verify compensating controls where patching is delayed.

Source: SecurityWeek

Shadowserver-linked reporting says at least a couple hundred internet-facing Zimbra Collaboration Suite instances have been compromised via CVE-2026-73570-style exploitation patterns. The operational risk is that Zimbra commonly sits at the center of identity and messaging workflows, so successful intrusion can cascade into credential theft, persistence, and lateral movement. The lesson: internet exposure + unpatched middleware + readily weaponized RCE = predictable attacker success.

Source: Help Net Security

Cato Networks research highlights a sponsored-search campaign using a fake OpenAI Codex download page to trick macOS users into executing a malicious command manually (a ClickFix variant). This shifts the kill chain from “open attachment/click link” to “socially engineered self-execution,” which many standard controls are less effective at detecting. For security programs, browser protections won’t be enough—user training, command-line monitoring, and blocking suspicious Terminal behaviors become essential.

Source: Help Net Security

VentureBeat’s summary of recent OWASP-adjacent analysis reiterates why prompt injection is hard to catch with conventional vulnerability metrics: the attack hides instructions inside trusted content flows, and the agent makes tool calls using credentials it legitimately holds. The practical security guidance is to treat model prompts as untrusted input and enforce authorization gates outside the model—so an injected instruction can’t translate into real-world action. In short: focus on control planes, tool boundaries, logging, and adversarial testing of deployed agent behavior.

Source: VentureBeat Sec

The Linux Foundation announced TRACE, a hardware-backed runtime attestation and compliance evidence approach for AI agents and confidential workloads. As organizations deploy more autonomous agentic systems, “proving what happened at runtime” becomes a governance bottleneck—especially for regulated data handling and policy enforcement. TRACE’s emphasis on a standard evidence layer could help convert governance claims into auditable records, rather than relying on assumptions.

Source: Help Net Security

Meta rolled out new WhatsApp account security features, including support for multiple passkeys and stronger two-step verification, alongside more contextual information for calls from unknown numbers. While not a “server vulnerability” story, it matters because account takeover remains one of the highest-volume practical threats for criminals. The security signal: modern authentication patterns (passkeys + better caller context) reduce the usefulness of common social-engineering lures.

Source: SecurityWeek