Microsoft has started rolling out a Classic Outlook theme for users of Outlook on the web and the New Outlook for Windows. This new Outlook theme is rolling out as part of a targeted release beginning mid-August and expected to complete by the end of September. The theme will become generally available worldwide between late September and late October. "When enabled, the setting applies coordinated changes across the Outlook experience, including visual styling, layout, typography, icons, and selected interactions," Microsoft said in a Microsoft 365 Message Center update. Once rolled out, the feature will not override any existing administrator configurations and will not automatically migrate users from classic Outlook to the new Outlook. Microsoft also added that the new user interface style will be enabled by default for some users, but they can toggle it off to switch to the standard theme from Settings > General > Appearance.
Cisco patched nine critical flaws, including six rated CVSS 10.0, found during internal testing. None are known to be exploited. Cisco released another batch of security fixes for its Crosswork platforms and Secure Workload software, part of what it’s calling an ongoing internal security review, and the CVSS scores in this round are unusually severe. “As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.” reads the advisory. “These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class – Common Weakness Enumeration (CWE) – and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.” Four vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, all impacting these products regardless of how they’re configured: CVE-2026-20030 (CVSS score: 10.0) – an SQL injection vulnerability that lets an attacker manipulate database queries directly. CVE-2026-20357 (CVSS score: 10.0) – a missing authentication for critical function vulnerability, meaning a sensitive operation can be triggered without ever proving who you are. CVE-2026-20358 (CVSS score: 10.0) – an external control of file system vulnerability, letting an outside actor influence which files the system reads or writes. CVE-2026-20359 (CVSS score: 9.9) – an insufficiently protected credentials vulnerability, where stored login material isn’t locked down the way it should be. Seeing three CVSS 10.0 vulnerabilities in a single Cisco advisory is unusual. The four flaws affect Crosswork 7.2.1 and earlier, and Cisco fixed them in version 7.2.1-SP. Five more vulnerabilities got patched in Cisco Secure Workload, spanning both its cloud SaaS and on-premises deployments: CVE-2026-20231 (CVSS score: 9.9) – a set of improper neutralization of special elements vulnerabilities covering command, operating system, and argument injection, essentially several different ways to smuggle unintended commands into the system. CVE-2026-20315 (CVSS score: 10.0) – a set of improper access control vulnerabilities spanning authorization, authentication, privileges, and bypasses, a broad category that generally means the system doesn’t reliably enforce who’s allowed to do what. CVE-2026-20317 (CVSS score: 10.0) – a set of improper authentication vulnerabilities covering missing authentication, authentication bypass, and reliance on untrusted inputs, another maximum-severity cluster centered on identity verification failing outright. CVE-2026-20318 (CVSS score: 9.6) – a set of improper input validation vulnerabilities spanning input validation, path traversal, and external path control, the kind of flaw that lets crafted input reach files or directories it was never meant to touch. CVE-2026-20319 (CVSS score: 7.5) – a set of improper restriction of operations within the bounds of a memory buffer vulnerabilities spanning buffer overflows and out-of-bounds writes, lower severity than the rest but still a genuine memory-safety problem. The networking giant addressed five vulnerabilities in Secure Workload Release 3.10.9.1 for the 3.10 branch and earlier, and 4.0.4.16 for the 4.0 branch. The company found these vulnerabilities during internal testing; it is not aware of attacks in the wild exploiting this issue. “The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.” conctinues the advisory. “Cisco says it found the vulnerabilities through internal security testing that also used advanced AI models.” Nobody’s reported active attacks against any of these nine flaws yet, and Cisco’s own review process caught them before an outside researcher or attacker did. If your organization runs Crosswork or Secure Workload in any configuration, this isn’t a patch to schedule for next month’s maintenance window. Perfect CVSS scores tend to attract attention fast once a vulnerability’s technical details start circulating, and Cisco’s internal discovery only buys you a head start if you actually use it. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Cisco)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. TrueConf Server is designed for secure corporate messaging and video conferencing and, unlike cloud-based software like Zoom or Microsoft Teams, it operates inside an organization's local network (LAN). The most severe is a critical missing authentication security flaw (tracked as CVE-2026-72529) that allows attackers without privileges to remotely execute arbitrary scripts on unpatched servers. "A remote unauthenticated attacker connecting to TrueConf Server over 4307/TCP can invoke an undocumented critical function and execute an arbitrary script on the server," the TrueConf security team explains.
Google tracks three Russia-linked espionage clusters using phishing and legitimate authentication tools to target researchers, diplomats and defense staff. Google’s Threat Intelligence Group tracked three separate suspected Russia-linked cyber espionage clusters. All three focus on the same thing: abusing authentication features that are supposed to protect accounts to access them instead. Threat actors target researchers, academics, government officials, think-tank analysts, and defense sector personnel across Europe and the United States. The three clusters are tracked as UNC6293, UNC7005, and UNC5976, and while they operate differently and with different tools, Google published them together for a reason. “These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms.” reads the report published by GTIG. “Because these operations abuse legitimate authentication flows which may not immediately seem like phishing attempts to users, GTIG is raising awareness about these social engineering campaigns targeting individuals so that targets can more readily recognize malicious outreach.” UNC6293 is the oldest of the three and the most precisely attributed. Google assesses with moderate confidence that it’s a sub-cluster of ICE RELIC, the group also tracked as APT29, responsible for initial access operations. Its operations are narrow by design: typically fewer than five targets at a time, with themes built around diplomatic events and upcoming conferences. Since it was first documented in June 2025, UNC6293 has consistently impersonated US State Department officials to run app password phishing. The technique is simple but effective. The attacker convinces a target to set a specific app password on their account, one that the attacker already knows, and then uses it to log in without triggering two-factor authentication. By October 2025, UNC6293 was still reusing screenshots from its June phishing lures, including the ms.state.gov reference, while only changing the surrounding text. By June 2026, the group had added OAuth phishing. After logging in to a legitimate service, victims were asked to share a URL or “verification code,” allowing attackers to obtain valid access tokens. The trick works because the login itself is legitimate, while the attackers hide the malicious step elsewhere. UNC7005, tracked by Microsoft as STORM-2945, is a related but separate cluster first identified in February 2026. Google assesses it’s also connected to ICE RELIC, but notes it operates with lower technical sophistication and worse operational security than UNC6293. It compensates with a wider toolkit. UNC7005 runs app password phishing, device code phishing against both Microsoft and WhatsApp, malware distribution, and OAuth phishing operations, sometimes in the same month. “UNC7005 also conducts device code phishing operations for both Microsoft and WhatsApp accounts.” continues the report. “The themes of these phishing waves often involve invitations for calls with individuals from notable organizations related to the target’s field or, most recently, invitations to diplomatic events and conferences. “ The GLOBSEC conference spoof is a useful illustration of how UNC7005 works. The actor built a landing page mimicking an invitation to the legitimate GLOBSEC forum in May 2026, collected detailed registration information from targets including, not for the first time in ICE RELIC-linked operations, a wine selection for a fictional dinner, and then presented a Microsoft device code for the target to enter. The registration form still contained a reference to “Embassy security policy” rather than GLOBSEC, a leftover from the previous lure template that the actor hadn’t cleaned up. When Google flagged the page quickly, UNC7005 revised the template within days, citing “technical difficulties” to explain the change to anyone still watching. UNC7005 also used WhatsApp phishing pages to trick victims into linking their accounts to an attacker-controlled device. The fake pages offered options such as joining a call, opening an encrypted chat or downloading a file. If victims chose the call option, malicious JavaScript asked for microphone and camera access, recorded them, and sent the footage to the attackers. In late May 2026, UNC7005 ran a broader phishing wave targeting US-based academics, diplomats, and Russia researchers. The lure was a fake “Summit Companion App” to read a document supporting Ukraine. “In May and June 2026, UNC7005 conducted social engineering operations spoofing WhatsApp. The phishing pages distributed by the attacker lure targets into linking their WhatsApp accounts with an attacker controlled device in order to join a secure WhatsApp call, chat, or document share.” states the report. “The attacker also attempts multiple other methods of compromise after the device is linked.” Windows users who downloaded it received VIDAR, an off-the-shelf infostealer sold as a service that pulls saved credentials, cookies, and payment data from browsers. Mac users received ATOMIC, also known as AtomicStealer, a macOS infostealer operating the same business model. Neither is custom tooling. The actor’s email address in this operation was nearly identical to one used by UNC6293 a year earlier. The hospitality captive portal campaign, previously reported by Reliaquest and Microsoft and attributed to Midnight Blizzard, connects directly to UNC7005. Google traces the infrastructure back to April 2026: domains spoofing Microsoft authentication resources, which Google added to Safe Browsing blocklists as they appeared. By mid-July 2026, those same domains were receiving redirects from captive portals at hotels and conference centers. The IP resolution trail links the captive portal infrastructure to the GLOBSEC device code phishing operation and to ENGINELIGHT, a Go-based malware used in a separate limited UNC7005 operation in May 2026. CHERRYPIE, also known as ChocoShell, is a PowerShell infostealer that adds another interesting detail. Google found comments and code references that appear consistent with AI-generated code, suggesting the attackers may be using an LLM to develop malware. The data it targets overlaps with the commercial infostealers already used by UNC7005, leading Google to suspect that CHERRYPIE could be a customized version of a malware-as-a-service tool. UNC5976 is the third cluster and the most distinct. It focuses on military, aerospace, defense industrial base, and NGO targets, concentrating geographically on Ukraine and Armenia. Instead of residential proxies for post-compromise access, as UNC6293 and UNC7005 use, it runs dedicated infrastructure. Its OAuth phishing is more automated: the actor registers file-sharing-themed domains, creates Google Cloud projects behind them, and uses cloud-hosted scripts to collect authentication tokens from targets who log in through what looks like a Google sign-in prompt on a fake file-sharing page. Within three months of Google disrupting this infrastructure, UNC5976 had built at least twelve new domains and was already migrating toward non-Google hosting providers. In April 2026, UNC5976 also distributed HEADRUSH, a malicious Excel plugin, through a domain impersonating a Ukrainian research institute, potentially targeting a Ukrainian aerospace and imaging company. HEADRUSH eventually leads to an HTA downloader, though Google wasn’t able to recover the full infection chain. The defender challenge that runs through all three clusters is the same one Google names directly. ” The accounts these groups target are often personal, rather than corporate domain-joined accounts, creating a visibility gap for monitoring compromise from an organizational perspective. The likely use of encrypted messenger applications instead of email for initial outreach also presents a challenge to defenders hoping to track and remediate abuse.” concludes the report. “The combination of these tactics not only enables the attacker to conduct quick-turnaround exfiltration operations, but also presents opportunities for the attacker to further phish targets of interest from compromised, legitimate accounts. “ Security teams watching corporate email and endpoint telemetry won’t see the initial contact. By the time a compromised personal account starts being used to phish the target’s contacts, the original access event is already cold. Google’s practical guidance for individuals: don’t set app passwords for anyone who asks, revoke existing ones you don’t recognize, check WhatsApp’s linked devices list, and treat any OAuth authorization prompt from an unsolicited message as suspicious regardless of how polished the surrounding page looks. High-risk individuals should consider Google’s Advanced Protection Program, which blocks app password creation entirely. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Russia)
Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks.
Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. MalwareHunterTeam observed this unusual technique in July in an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands. FTP banners are text strings the server uses as a greeting message for connecting hosts before they log in. By embedding commands in the initial response sent when a compromised system connects to an FTP server, a malware stager can receive instructions from a remote server. After discovering FTP banners being used to deliver malicious commands during an investigation, researchers at threat intelligence platform SOCRadar expanded their hunt and found that the technique remains in use.
GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects. WatchTowr researchers warn of active exploitation of critical GitLab flaw CVE-2026-19478 (CVSS score of 9.4). This week, GitLab pushed out an emergency patch to address this flaw, which could let an attacker with zero credentials remotely modify or delete public projects and user data. “GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.” reads the advisory. GitLab issued an emergency patch on August 17, five days after its regular update. The vulnerability impacts only self-managed installations, users should upgrade to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. There’s a gap worth flagging for anyone still sitting on an older release. The available patches don’t cover the 18.2 through 18.10 branches, even though those versions technically fall inside the affected range. If you’re running anything in that window, staying put isn’t really an option; you’ll need to upgrade to a patched branch entirely rather than waiting for a fix that isn’t coming for your current one. hiimguardian reported the flaw through the company HackerOne bug bounty program. Organizations should urgently patch internet-facing GitLab servers. Until they can update, they should restrict unauthenticated access to /api/graphql, disable public repositories where possible, and check logs for requests containing @gl_introduced. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-19478)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-72529 (CVSS score of 9.3) TrueConf Server Missing Authentication for Critical Function Vulnerability CVE-2026-72530 (CVSS score of 9.5) TrueConf Server Code Injection Vulnerability TrueConf Server is an on-premises video conferencing and unified communications platform developed by TrueConf. Organizations can deploy it on their own infrastructure to provide secure video meetings, voice calls, messaging and collaboration without relying entirely on a cloud service. It is typically used by businesses, government organizations and other institutions that want to keep communications and related data under their own control. CVE-2026-72529 is a remote code execution vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to execute arbitrary scripts by calling an undocumented function. The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. An attacker who can reach the vulnerable service could potentially compromise the server and use it as an entry point into the affected network. CVE-2026-72530 is a sandbox escape vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to break out of an isolated environment and execute arbitrary code on the underlying host. The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. By sending a specially crafted script, an attacker could escape the restricted environment and gain code execution on the host system, potentially leading to a full server compromise. In the context of CVE-2026-72529 and CVE-2026-72530, the concern is that vulnerable TrueConf Server installations exposed on TCP port 4307 could provide attackers with a path to execute code on the server. Vyacheslav Kopeytsev from Kaspersky ICS CERT discovered both vulnerabilities. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 2nd. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal security review. Four of the security vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, regardless of the device configuration. A brief description of each of the flaws is below -
A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring
Confirm this action.
Leaving now will discard your changes.