On 30 August 2026 BleepingComputer reported Anthropic emails to affected Claude users: infostealer malware on already-compromised PCs stole active Claude login sessions, then used those sessions to access accounts and consume usage (including usage that appeared to refill then drain). Anthropic is signing affected users out, removing saved payment methods, and refunding charges it identifies as unauthorised. Anthropic says it has no reason to believe the malware was installed through Claude. It has identified Vidar, LummaC2, StealC, RedLine and Acreed on Windows, and Atomic Stealer (AMOS) on a small number of Macs. Signing out stops the stolen session; it does not remove the malware. No CVSS. No public Anthropic advisory page at the time of writing; the source is BleepingComputer quoting the company email.
Tixel, the Melbourne-based second-hand ticket marketplace, emailed users on the night of Friday 28 August 2026 to say their email address and mobile number may have been accessed after its third-party analytics provider, Metabase, was 'briefly accessed by an unauthorised party', 7NEWS reported on 29 August. Tixel said passwords, credit card and payment information and purchase history were not affected and that accounts, tickets and listings were unaffected, and warned users to watch for spam and phishing that pretends to come from Tixel. Metabase's own post-incident write-up (27 August) says a Metabase Cloud customer reported a suspicious API key on 3 August, that the attack used a previously unknown ('zero-day') vulnerability patched in releases on 6 August, that under 3% of its cloud customers were compromised (as were some open-source users and self-hosted customers with publicly accessible instances), and that Metabase believes the attack required significant large-language-model capabilities. Tixel has not said how many users are affected. Mathspace's breach of about 1.08 million Australian and New Zealand records through a self-hosted Metabase install is a separate card. Source: 7NEWS (29 Aug 2026), quoting Tixel's customer email. Correction (22 Oct 2026): an earlier version said Metabase put the attack on 3 August and the impact at just under three per cent of all its customers; Metabase's own post says 3 August is when a cloud customer reported suspicious activity and that under 3% of its cloud customers were compromised. (source: Metabase)
7NEWS — Data breach hits ticket resale website Tixel (29 Aug 2026)
JetBrains' Cadence incident post (opened 28 August 2026, last updated 1 September 2026 12:05 CEST) confirms unauthorized access to Cadence, a JetBrains-hosted cloud-compute service for PyCharm via an optional plugin that orchestrates work with TeamCity. The Cadence host api.cadence.jetbrains.com was vulnerable to CVE-2026-63077 (card cve-2026-63077) and was exploited; activity from 8 August to 24 August 2026; discovered 23 August; server taken offline 24 August. Confirmed: personal data extracted (usernames, real names, emails, last-login times, last IPs); a full 2024 Cadence server backup compromised (treat credentials/config/artifacts in that backup as exposed); multiple AWS IAM users/secrets used with Cadence compromised from that backup; files in JetBrains Cadence S3 buckets accessed; possible access to source synchronized from PyCharm. JetBrains says no evidence secrets were taken from the live environment beyond the backup path, invalidated Cadence plugin access tokens, and lists IoC IPs (150.109.230.104, 43.153.227.206, 62.210.127.48, 210.247.242.190, 15.235.225.205, 152.233.30.18). Users must rotate all credentials used in Cadence executions and treat inputs/outputs as untrusted.
Socket (28 August 2026) reports that ten versions of npm package @7nohe/openapi-react-query-codegen were published that day after a comment-triggered GitHub Actions trusted-publishing workflow was abused. An untrusted GitHub account could comment a publish trigger on a pull request and ship fork code under the repository OIDC identity. Versions named by Socket and Step Security are 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, plus two 0.0.0-sha prerelease tags. Stable releases ran obfuscated JavaScript 3FWCvzduYZg.js via binding.gyp and/or a preinstall hook. Socket describes Mini Shai-Hulud-consistent self-propagation. Install-time code targeted cloud credentials, package-registry credentials, GitHub Actions secrets and AI-agent configuration. All ten carried valid npm provenance. Pin known-good 0.5.3, 1.6.2, 2.2.0 or 3.0.2, isolate affected hosts, then rotate tokens. This Cyberstack does not attribute the package to TeamPCP; Socket and Step Security do not name that group.
JFrog's 28 August 2026 advisory rates CVE-2026-82329 Critical (CVSS 3.1 9.8): under default configuration, an unauthenticated attacker with network access may obtain administrative privileges on self-managed Artifactory. BleepingComputer reported on 2 September 2026 that researchers at watchTowr observed the flaw being exploited by "attackers minting themselves admin tokens"; BleepingComputer says an attacker forging their own admin tokens can enumerate users, groups and federated topologies, read artifacts, change security configurations and poison existing packages (source: BleepingComputer). Self-hosted patches: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20; JFrog says cloud was already fortified. Access tokens are independent credentials — upgrading the binary does not by itself revoke minted tokens, so rotate/revoke tokens and hunt anomalous admin activity after patching. CISA added CVE-2026-82329 to the KEV catalog on 2 September 2026. UPDATE 10–11 September 2026 (Wiz / THN): Wiz also saw CVE-2026-82329 abused in the wild alongside a separate 42018→42016 chain (15 Aug–8 Sep) that yields admin and drops Rust C2 / Groovy plugins. Correction (29 Oct 2026): exploitation details are now credited to BleepingComputer's linked report; removed details that only SecurityWeek gave (backdoor users, a small set of IPs, no mass scanning, a 'phantom' join key), internal cross-references and a duplicate JFrog link. (sources: JFrog; BleepingComputer)
JFrog security advisories (CVE-2026-82329, 28 Aug 2026)
Confiant (28 August 2026; figures as of 25 August) tracks HexMage, a Magecart cluster that injects a fake Google Tag Manager block into compromised storefronts (mostly WooCommerce), loads ethers.js, and reads a Sepolia testnet contract to obtain a disposable skimmer host (EtherHiding). Confiant observed 40+ impacted sites across at least 15 countries since about April 2026; 25 storefronts mapped, including Australian site protocoffee[.]com[.]au (a blockchain-free loader variant pointing at stylerightnoww[.]com). One owner wallet (0x88361C914Bb0942da9a1b7Bb396a7513C1917aee) had deployed 144 contracts by 21 July 2026. The skimmer overlays the payment form, harvests PAN/expiry/CVV, then restores the DOM so the purchase completes. Fake-GTM detection: the injected block never fetches googletagmanager[.]com/gtm.js. Cyber Security News carried the story on 31 August. Defanged names only on Cyberstack — not live links.
Microsoft Threat Intelligence (Security blog dated 28 August 2026; JSON-LD published 29 August) describes TerminalFix, a ClickFix variant that uses compromised websites and a fake Cloudflare CAPTCHA overlay to trick users into pasting a PowerShell command in Windows Terminal or PowerShell rather than the Run dialog. The command downloads a ZIP with a legitimate LockScreenContentServer.exe binary and a malicious dui70.dll for DLL sideloading. Later stages pull payloads hidden in PNG images, persist via Registry Run keys and scheduled tasks, run Active Directory reconnaissance, and deploy a Python reverse-tunnel implant that proxies TCP over an encrypted WebSocket. Microsoft says it did not observe the later hands-on-keyboard steps (privilege escalation, defence tampering, ransomware) in the analysed chain, but treats affected hosts as potential network pivot points. (sources: Microsoft; The Hacker News)
Hasbro has disclosed that attackers accessed the personal and financial information of an undisclosed number of employees, BleepingComputer reported on 28 August 2026. According to BleepingComputer, Hasbro filed data breach notification letters with the Massachusetts Attorney General's Office but did not disclose the total number of people affected or when the incident was detected. BleepingComputer quotes the letters: "The information involved varied by individual but may have included your name and one or more additional personal information elements such as email, address, phone number, national ID number, or financial information," and "Hasbro implemented containment and remediation measures, including disabling the compromised employee account, terminating unauthorized access, and deploying additional safeguards designed to help prevent a similar incident from occurring in the future." Citing the Massachusetts Attorney General's Office 2026 Data Breach Notification Report, BleepingComputer says the Social Security numbers, financial account information, credit/debit card numbers and driver's licence information of 436 Hasbro employees in Massachusetts were affected. Hasbro did not link this breach to the cyberattack that hit its systems on 28 March, according to BleepingComputer. Correction (28 Oct 2026): the Massachusetts letter and breach-list pages return HTTP 403 to Cyberstack, so their links, the letter number and the 'no customer impact' line were removed; the details above are credited to BleepingComputer, which quotes the letters. (source: BleepingComputer)
BleepingComputer — Toy-making giant Hasbro disclose data breach affecting employees (28 Aug 2026)
Patchstack (28 August 2026) and CVE-2026-82222 describe an unauthenticated PHP object injection chain in GiveWP through 4.16.7.1 that reaches remote code execution. On 4.16.5.1 and below a default install with one published donation form and an active gateway is enough. On 4.16.6–4.16.7.1 reachability narrows but a legacy give_forms post without formBuilderSettings (including draft/trashed) re-arms the chain. The plugin's give_action=user_register path ignores WordPress users_can_register, so an attacker can obtain an account even when registration is disabled. Patchstack rates CVSS 10.0. Vendor fixed in GiveWP 4.16.7.2 (27 August 2026), which breaks the chain at several layers and migrates serialized object payloads already in the database. Patch to 4.16.7.2 or later.
Sharp Motor Group, a Tweed Heads-based car dealership, has confirmed a third-party cyber incident, according to Cyber Daily (28 August 2026). Storm claimed the attack, according to Cyber Daily. (source: Cyber Daily) Correction (30 Oct 2026): removed material from the login-only part of Cyber Daily's report; the card now carries only what the readable part states. (source: Cyber Daily)
Cyber Daily — Sharp Motor Group confirms third-party cyber incident in wake of ransomware claims (28 Aug 2026)
McKesson's Form 8-K (dated 28 August 2026) says that on 25 August 2026 it discovered a cybersecurity incident affecting its information systems, that its investigation is in its early stages, and that information and updates are available at www.mckesson.com/cybersecurity. As of the filing date, McKesson had not determined that the incident is material or that it has had, or is reasonably likely to have, a material impact on the company, including its financial condition or results of operations. (source: McKesson Form 8-K) Correction (24 Oct 2026): removed a reference to an extortion group's unconfirmed claims about patient records and access methods; McKesson's notice and 8-K do not confirm them. (source: McKesson Form 8-K) Correction (29 Oct 2026): a bare link credit was replaced with a named credit. (source: McKesson Form 8-K) Correction (29 Oct 2026): McKesson's cybersecurity web page could not be read (the address redirects to an empty page), so the details that only that page gave have been removed: the 28 August customer notice, the involvement of third-party applications and data exfiltration, and the 29 August operations update. The card now rests on McKesson's Form 8-K, and the title has been changed to match. (source: McKesson Form 8-K)
WatchGuard PSIRT published a cluster of advisories on 27 August 2026 covering Fireware OS (iked / epm) and WatchGuard Dimension. Five issues are rated 9.3 on the vendor page: iked heap overflow CVE-2026-19313, iked stack overflow CVE-2026-19318 and iked type confusion CVE-2026-19315 (unauthenticated remote code execution via crafted traffic); epm stack overflow CVE-2026-13086 in the deprecated Mobile Security feature; and Dimension CVE-2026-78174, session-ID and CSRF token exposure that can let a low-privileged administrator take over a super-admin session. SecurityWeek (Ionut Arghire, 1 September) matches those five at CVSS 9.3. Patch to Fireware OS 2026.2.2, 12.12.2 or 12.5.20 and Dimension 2.3.1. WatchGuard also shipped additional high- and medium-severity fixes in the same wave (iked denial-of-service and Dimension SQL injection, CSRF, SSRF and related issues among them); this card does not list every CVE. The vendor is not aware of exploitation of these defects.
