Forminator just shipped 1.57.1. Update the plugin today
If your WordPress site still runs Forminator Forms below 1.57.1, the contact form on the front page is not just a lead tool. On older builds an attacker can forge an upload field and drop …
Cyber news you can act on
Short briefs. One blast radius. What to do in the next 15 minutes.
WordPress 7.1 is out. Take it for the Author upload fix
WordPress 7.1 “Mary Lou” landed on 19 August 2026. Take it for more than the new editor toys. The security floor underneath is the Author-level upload fix that shipped in 7.0.4 a week earlier. On …
CareCloud says 3.7 million patient records were stolen. Freeze credit
CareCloud told patients that roughly 3.76 million records were caught up in a spring intrusion into one AWS electronic health record environment. Names, Social Security numbers, medical details, and financial data are in the mix …
Dahua cameras got a backdoor named p2pwn. Check yours
Hunt.io published Operation CameraSwarm on 18 August 2026: more than 14,000 Dahua cameras abused in a mid-year campaign, with nearly 1,900 carrying a persistent backdoor account named p2pwn. The password on that account is p2password. …
ASOS US reported a customer data breach. Freeze credit now
ASOS US Sales LLC dated customer notices 21 August 2026 after credential stuffing hit accounts on 28 and 29 July. This was not a dump of full card numbers from ASOS systems. Attackers used login …
The Tapo C200 still needs 1.4.6
The white dome on the shelf is watching the hallway, the register, or the front porch. TP-Link’s August advisory says some Tapo C200 cameras will hand an admin session to someone already on your Wi-Fi …
Brave just absorbed Chrome’s .173 set. Take 1.93.138
Brave is the Chromium browser a lot of people keep for Shields and the cleaner defaults. On 21 August 2026 Brave shipped 1.93.138 and folded in Google’s Thursday Chromium train, 151.0.7922.173. That set closes a …
The home ASUSTOR still needs ADM 4.3.3.RWC1
The ASUSTOR under the desk is the house. AS-2026-019 says ADM will let a signed-in user walk a path out of the VPN certificate folder, the wallpaper folder, and the IHM log path. That is …
VirtualBox 7.2.14 is in the August Oracle patch. Take 7.2.16
VirtualBox is the host that keeps the lab VMs and the shop test box on one PC. Oracle’s August Critical Patch Update named Oracle VM VirtualBox 7.2.14 in the Core component. The fix you want …
Java 8 still needs Update 503
Java 8 is the leftover runtime that still opens the bank applet, the printer queue, and the old shop tool. Oracle’s August 2026 Critical Security Patch Update closed holes in JSSE, Networking, and Install on …
Someone in the Zoom call can run code on your PC. Update to 7.1.0
You join a Zoom call. Someone else is already in it. Zoom’s annotator, the drawing tools that appear when you share a screen, had a hole that let that person send a crafted message and …
A page in Edge can run code. Take 151.0.4129.101
Edge is the browser Windows opens when you click a link in Mail. Microsoft shipped an Edge-specific heap overflow, then folded in this month’s Chromium fixes. A page you visit can run code in the …
A Word file can own the PC. Update Office to 2607
Office is how a file from email becomes a document on the PC. Microsoft’s 11 August security update for Microsoft 365 Apps closes a pile of Word and Office remote-code bugs. You do not need …
The August Pixel update closes a video-chip hole. Take the 5 August patch
Google’s August Pixel bulletin adds a High bug in the video chip’s driver. A use-after-free: the phone frees a piece of memory and code can still touch it. Google says it can lead to remote …
A page you open can punch through Chrome’s sandbox
Chrome is the tab that stays open: mail, the bank, the shop booking page. Google’s Tuesday stable update closed two Critical holes in the graphics stack. A page you visit can write past a block …
Someone on the Wi-Fi can sit at your Mac. Patch Screen Sharing
Screen Sharing is the Mac’s built-in remote desktop. Leave the toggle on, and someone on the same Wi-Fi can try to sit at your keyboard without the password you thought they needed. Apple shipped a …
Your Galaxy is a month behind. Install the August security update
Samsung’s August maintenance release is on the phone. It closes eight Critical Android bugs plus 16 Galaxy-only holes, including a clipboard service that let a local app read what you copied. Open Settings, Software update, …
Install this Windows update. CISA says the socket driver is already being used
A program that already runs as you can become the PC. That is the Windows socket driver this month. CISA put the bug on the Known Exploited list on 11 August. The update has been …
Your Nighthawk will take a command from the next room until you update it
The Nighthawk on the shelf is the house. NETGEAR’s August advisory says some of those boxes, and some Orbi mesh kits, will take a command from someone who is already on your Wi-Fi or Ethernet …
An image can run code on your iPhone. Install 26.6.1
The iPhone turns files into pictures all day. A preview in Messages. A photo in Mail. A page in Safari. Monday’s iOS 26.6.1 closes an ImageIO bug where processing an image can run code on …
A page can walk out of Firefox’s sandbox. Version 154 closes it
Firefox keeps a fence around a tab so a nasty page cannot reach the rest of the profile. On 18 August 2026 Mozilla shipped Firefox 154 and closed a high-severity sandbox escape in the Remote …
Thunderbird 154 closes the same sandbox hole as Firefox
Thunderbird is the inbox that stays open: invoices, the school thread, the shop mailbox. On 18 August 2026 Mozilla shipped Thunderbird 154 and closed the same high sandbox hole they closed in Firefox 154. A …
Your Archer AXE75 can take a crafted VPN file. Install 1.5.6
The Archer AXE75 on the desk is the house. TP-Link’s July advisory says that box will take a command from someone who is already on your Wi-Fi, already signed in as admin, and who can …
Your GeForce driver can raise privileges. Install 596.36
The GeForce driver that paints Windows can also raise privileges. NVIDIA closed a local race in the Windows display driver: the driver checks a thing, then uses it, and a racing program can swap the …
Safari on Sonoma and Sequoia still needs 26.6.1
Safari is the tab Mail still opens on a Mac that never installed Chrome. On 18 August 2026 Apple shipped Safari 26.6.1 for macOS Sonoma and macOS Sequoia. The notes say a crafted page can …
A Lightroom file can run code. Update Classic to 15.5
Lightroom Classic is how a shoot becomes a catalog on the PC. Adobe’s 11 August 2026 bulletin APSB26-94 closes a High hole in that desktop app: a crafted file can run code as you. You …
Your Archer C20 can take a command from the admin page. Install 0.9.1
The cheap AC750 on the desk is the house. TP-Link’s August advisory says Archer C20 hardware V6 will take a command from someone already on your Wi-Fi, already signed in as admin, who can submit …
Tahoe still needs 26.6.2. A photo can run code
macOS Tahoe 26.6.1 closed Screen Sharing. 26.6.2 is the next train, and it is already sitting in Software Update. Apple shipped it on 17 August 2026 for Tahoe only. The lead bug is in ImageIO: …
The iPhone XS still needs 18.7.10
The iPhone XS still lives on the 18 train. It cannot run iOS 26. Monday’s iOS 18.7.10 is the security drop for that phone, the XS Max, the XR, and the 7th-generation iPad. A crafted …
OneDrive on the Mac can raise privileges. Take 26.095.0519.0003
OneDrive on the Mac is the cloud in the menu bar: Desktop, Documents, the shop’s shared files. On 11 August 2026 Microsoft closed a local privilege hole in that Mac client. An authorized person already …
The Orbi mesh still needs V6.3.8.11
The Orbi tower in the living room is the house. NETGEAR’s August advisory says that mesh kit, the RBR760 router and its RBS760 satellite, will take a command from someone who is already on your …
Thunderbird ESR 140.14 Email Security Update Fixes Multiple High-Risk Flaws
Thunderbird ESR is the inbox shops pin and leave: invoices, parts lists, the shared mailbox on the counter PC. On 18 August 2026 Mozilla shipped Thunderbird 140.14 and closed a high-impact set of Gecko bugs, …
Heights Finance Data Breach Exposes SSNs and Sensitive Bank Information
Heights Finance Holdings Co. posted an 11 August 2026 notice after it found, on 7 May 2026, that an unauthorized actor had reached a third-party cloud used to store certain customer data. The company says …
Firefox ESR 140.14 Browser Security Update Fixes Multiple High-Risk Flaws
Firefox Extended Support Release is the slow train. A lot of home PCs and Linux installs still show 140 in Help, About Firefox because that is the ESR major, not a leftover Rapid Release. On …
Microsoft Office for Mac 16.112 Security Update Fixes Several Serious Flaws
Office on the Mac is how a file from Mail becomes a document on the laptop. Microsoft’s 11 August security drop for Office for Mac is Version 16.112 (Build 26081010). It closed holes in Excel, …
Google Chrome 151.0.7922.173 Update Fixes Seven Serious Security Flaws
Chrome is the tab that stays open: mail, the bank, the shop booking page. Google posted another Stable on Thursday, 20 August 2026, seven new security fixes after Tuesday’s 169 train. The Critical hole is …