grc-scanSecurity & governance
← Back to homethe latest digest →
News digest28 August 2026Archived edition

Cybersecurity News

This edition was published on 28 August 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest digest for the current picture.

The takeaway

Almost nothing this week needed a clever new attack: criminals used a valid login, an internet-facing service nobody had switched off, or a flaw that was patched years ago.

  • Ask your IT provider for a list of everything in your business reachable from the internet, and switch off what you don't use.
  • Protect email, banking and admin accounts with a passkey or hardware key, so a stolen code or session cookie isn't enough.
  • Check anything you've quietly stopped updating — an old server, plugin or app stays exploitable indefinitely.

Cybersecurity News — 2026-08-28

Generated: 2026-08-28 | Week in review | Sources: The Register, The Hacker News, BleepingComputer, SecurityWeek, Help Net Security, CISA, Have I Been Pwned, Malwarebytes, The Record, Computing, Rapid7

1. Three of the week's biggest break-ins used a valid login, not a broken piece of software

RingCentral lost the details of 1.6 million customers because a criminal phoned an employee and talked them into handing over a password. A group calling itself ExfilSquad took roughly 740,000 records from the Department for Education and a police legal database by getting into a help-desk support portal. And researchers described a phishing kit called Mirage2FA that has compromised some 4,532 Microsoft 365 accounts across 3,518 organisations — it works by sitting invisibly between you and the real Microsoft login page (a technique called adversary-in-the-middle), letting you type your password and complete your two-factor prompt normally, then stealing the "session cookie" Microsoft hands back. That cookie is the wristband that proves you're already logged in, so the attacker walks in behind you without ever needing your password or your code again. None of the three needed a software flaw.

Why it matters for your business: the accounts that really matter — email, banking, your website admin — should be protected by a passkey or a physical security key rather than a code from an app or text, because a code can be relayed in real time and a passkey can't. And learn where the "sign out of all sessions" button is in your email settings: if a session cookie is stolen, changing the password alone doesn't kick the attacker out.

2. Every flaw attackers used to get a foot in the door was in something facing the public internet

CISA confirmed active exploitation of a critical flaw in Gitea, a self-hosted service businesses run to store their own source code — and because Gitea ships with self-registration switched on by default, an attacker could simply sign up, create a repository and run commands on the server, in observed cases dropping a cryptocurrency miner. The same week it added a Citrix NetScaler flaw, in the remote-access gateway staff use to reach the office network from home. Those sit alongside last week's set: the Windows VPN component, Mac Screen Sharing left reachable from the internet, and self-hosted SharePoint. The pattern is not that these are unusually badly written products — it is that they were the only parts of the estate a stranger could reach at all.

Why it matters for your business: ask whoever runs your IT for a plain list of everything in your business that answers a connection from the internet — website, mail server, VPN, remote desktop, any self-hosted tool — and turn off whatever isn't genuinely needed. An internet-facing service you'd forgotten about is worth more to an attacker than a serious flaw in something they can't reach.

3. The system that leaked was rarely the one with the brand on it

Trezor had to warn nearly 14,000 customers that their names, phone numbers and home addresses were exposed — not by Trezor, but by ShipMonk, the company that packs and posts its orders. More than 40 organisations, including household engineering names, appeared on the Cl0p extortion group's leak site in one campaign, because they all ran the same internet-exposed product-design software from PTC (Windchill and FlexPLM) and a single unauthenticated flaw in it was enough. And the UK government records went through a help-desk portal bolted onto the main service rather than the service itself. In each case, the security of the brand people trusted was set by a supplier or a side system they'd never thought about.

Why it matters for your business: write down every outside company that holds or handles your customers' details — fulfilment, booking, payments, email marketing, your support desk — and ask each one the same two questions you'd ask about your own systems: is multi-factor authentication on for staff accounts, and how quickly would you tell us if you were breached? You inherit their security whether you've looked at it or not.

4. Extortion now means publication, not encryption

Carhartt confirmed this week that 12.9 million people's details were exposed after the ShinyHunters group dumped roughly 50GB of stolen data — and the detail worth knowing is that the criminals' own claimed figure was about twice the truth, because the dump had been padded out with millions of fabricated records to make it look bigger. RingCentral's 280GB archive was published on the same group's leak site for the same reason: the company wouldn't pay. Cl0p's Windchill campaign didn't scramble anyone's files at all — it simply took the data and emailed the victims. Across all three, nobody's systems were locked; the leverage was the threat to publish.

Why it matters for your business: good backups protect you from files being locked, but they do nothing about files being published — so the useful defence is holding less in the first place. Delete customer records you no longer have a reason to keep, and remember that under UK data-protection rules a theft of personal data is a reportable breach whether or not anything was encrypted, and whether or not you pay.

5. Five of the six flaws added to the exploited list on Wednesday were fixed years ago

When CISA published its 26 August batch of vulnerabilities confirmed to be under active attack, only one was from 2026 (the Citrix NetScaler flaw). The other five were patched long ago: two Red Hat components from 2015, Microsoft SQL Server from 2019, a .NET library from 2021 and a Linux kernel flaw from 2022. These aren't new discoveries — they're evidence that attackers keep finding machines where the fix was never applied, often on a server somebody set up years ago and quietly stopped maintaining.

Why it matters for your business: patching isn't only about this month's update sitting in the tray. Make a list of anything in your business that has quietly stopped receiving updates — an old server in a cupboard, a website plugin nobody has touched, a phone or laptop past its support date — and either update it, replace it, or take it off the internet. An unpatched machine doesn't become safer with age; it becomes easier.

Sources

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.