Cyber Threat Brief — August 18 2026
⚠️ This report is AI-generated. Always validate findings.
1. Ray AI Framework Browser-Based RCE — CVE-2025-62593
TL;DR: CISA added CVE-2025-62593 (CVSS 9.4) to KEV on August 17 with an August 20 federal deadline. RondoDox DDoS botnet and ShadowRay 2.0 cryptomining campaigns actively exploiting unpatched Ray instances via DNS rebinding + User-Agent bypass.
What’s New:
- CISA KEV addition August 17, three-day federal remediation deadline (August 20)
- RondoDox botnet incorporated exploit two days before November 2025 public disclosure (per BitSight March 2026 report)
- ShadowRay 2.0 campaign turns NVIDIA GPU clusters into self-replicating cryptomining botnets
- Attack vector: malicious website or ad triggers DNS rebinding against developer’s local Ray instance via Firefox/Safari — User-Agent header check (starts with “Mozilla”) is trivially bypassed
- Exploitation targets unauthenticated endpoints
/api/jobsand/api/job_agent/jobs/— no auth ever implemented
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| /api/jobs, /api/job_agent/jobs/ | Endpoint (unauthenticated) | T1190 | Ray dashboard logs, web proxy | Block external access, audit internal access |
| DNS rebinding pattern (short TTL A record flip) | Technique | T1071.001 | DNS logs | Hunt for rapid A-record changes targeting internal IPs |
| User-Agent header manipulation (non-Mozilla prefix) | Bypass indicator | T1036 | Ray access logs | Audit Ray API access with modified UA strings |
| XMRig / cryptominer processes on GPU nodes | Post-exploitation | T1496 | Process monitoring, GPU utilization | Alert on unexpected GPU compute |
| Ray port 8265 (dashboard) exposed to internet | Misconfiguration | T1190 | Shodan/Censys, firewall rules | Block internet exposure immediately |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | Need Ray API abuse detection; GPU cryptomining process anomaly |
| Elastic | None | Need Ray dashboard unauthenticated access rule |
| Sigma | None | Need DNS rebinding detection (rapid TTL flip + internal IP resolution) |
Sources: CISA KEV Alert · The Hacker News · SecurityAffairs · GHSA-q279-jhrf-cc6v
2. Forminator WordPress Plugin Pre-Auth RCE — CVE-2026-15748
TL;DR: CVSS 9.8 unrestricted file upload in Forminator Forms (600K+ active installs) enables unauthenticated PHP webshell upload and full site takeover. No login or user interaction required — only needs a form with File Upload + Select fields.
What’s New:
- Disclosed August 17 by researcher “daroo” via Wordfence
- Attack chains Select field sanitization gap to smuggle a forged Upload field record with attacker-controlled config, bypassing file type restrictions
- Prerequisite: target form must contain both a File Upload field and a Select field
- No confirmed ITW exploitation yet, but trivial exploitation path (no PoC needed — just a crafted multipart POST)
- Patched in Forminator 1.56.2
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| POST to /wp-admin/admin-ajax.php with action=forminator_submit_form_* | Exploit request | T1190 | WAF, web access logs | Monitor for multipart uploads with nested Select field abuse |
| .php files in wp-content/uploads/forminator/ | Webshell indicator | T1505.003 | File integrity monitoring | Alert on any .php in upload dirs |
| Unexpected file extensions in Forminator upload dirs | Post-exploitation | T1505.003 | FIM, directory listing | Audit upload roots for executable files |
| Forms combining File Upload + Select fields | Attack surface | N/A | WordPress admin | Audit and restrict or update plugin |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Web Shell Indicator (generic) | Need Forminator-specific upload path rule (wp-content/uploads/forminator/) |
| Elastic | Webshell Detection: Script Process Child (generic) | Need WordPress plugin upload abuse detection |
| Sigma | webshell_detection_file_creation.yml (generic) | Need path-specific variant for Forminator upload directories |
Sources: The Hacker News · SecurityOnline · NVD
3. GitLab GraphQL Code Injection — CVE-2026-19478
TL;DR: CVSS 9.4 unauthenticated code injection via GraphQL directive in GitLab CE/EE allows remote deletion or modification of public projects and user data. Patched August 17 — no ITW exploitation yet, but high weaponization likelihood for self-managed instances.
What’s New:
- Patched in GitLab 19.2.4, 19.1.6, 19.0.8, 18.11.11 (released August 17)
- Affects all self-managed CE/EE versions from 18.2 through unpatched current branches
- GitLab.com and GitLab Dedicated already patched — self-managed instances at risk
- Companion CVE-2026-19650 (high-severity CSRF in GraphQL multiplex) patched in same release
- No PoC or ITW exploitation observed yet — integrity impact (data destruction) makes this high-priority
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| POST /api/graphql with malicious directive payloads | Exploit request | T1190 | GitLab nginx access logs, WAF | Monitor for unusual GraphQL mutations from unauthenticated sessions |
| Unexpected project deletions or modifications | Post-exploitation | T1485 | GitLab audit logs (gitlab-rails/audit_json.log) | Alert on public project state changes without authenticated session |
| GET-based GraphQL mutations (CVE-2026-19650) | CSRF exploit | T1189 | GitLab nginx access logs | Block GraphQL mutations via GET requests |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | Need GitLab GraphQL abuse detection (unauthenticated mutations) |
| Elastic | None | Need GitLab audit log correlation for unauthorized project modifications |
| Sigma | None | Need GitLab-specific GraphQL injection signature |
Sources: The Hacker News · CybersecurityNews · SecurityAffairs · GBHackers
Status Updates
- CVE-2026-59310/59309 (VMware vCenter): QUIRSO China-nexus attribution and Babuk ransomware deployment covered yesterday; 361 victims across 47 countries; exploitation ongoing. Aug 17 brief.
- CVE-2026-58231 (SAP Commerce Cloud): Exploitation ongoing since August 14 via patch-diffed Data Hub Adapter endpoint; no public PoC. Aug 16 brief.
- CVE-2026-50656 (Windows Defender ShieldBreak): Still UNPATCHED. ShieldBreak bypass of July patch uses Cloud Filter API callbacks; 100% success on Win11 25H2/Server 2025. WDAC/AppLocker primary mitigation. Aug 16 brief.
- CVE-2026-68820 (Windows afd.sys / Lazarus FudModule): CISA KEV deadline August 25 approaching; Lazarus Dream Job campaign ongoing; no new IOCs. Aug 12 brief.
- CVE-2026-55040/63520 (SharePoint pre-auth RCE): Active exploitation ongoing since August 12 after Rapid7 PoC; 8,500+ internet-exposed instances. Aug 16 brief.
- CVE-2026-72898 (Metabase): Federal CISA KEV deadline passed August 14; active exploitation ongoing; no new artifacts. Aug 12 brief.