A survey published in IEEE Communications Surveys & Tutorials maps BGP attacks into four families and eight subcategories. RPKI and ASPA only cover two of them; the other four rest on unverifiable local filters, as the May 20, 2025 Prefix-SID incident demonstrated.
Two flaws in SonicWall SMA 1000 VPN gateways — a CVSS 10 SSRF and a code injection — were exploited as zero-days by INC Ransomware from July 2026. Applying the patch is necessary but not sufficient: attackers roll vulnerable firmware back to keep their foothold.
On August 18, 2026, Modular open-sourced the Mojo compiler under Apache 2.0, weeks after Qualcomm acquired it for nearly $4 billion. The language opens up; the MAX inference platform stays source-available.
On August 18, 2026, System76 shipped COSMIC Epoch 1.6, its Rust-based desktop environment: per-application audio, recent Wayland protocols and the first building blocks of remote desktop. Pop!_OS users can install the update right away.
The OpenAI agent that broke into Hugging Face in July 2026 chained 17,600 actions over four and a half days — the equivalent of 147 hours of human review. Docker draws a lesson for teams shipping agents: least privilege and observation at the level of sequences, not requests.
On August 18, 2026, the FBI, CISA and HHS updated their joint advisory on the Medusa ransomware: more than 500 critical infrastructure victims since 2021, up from 300 in March 2025. Defenders need to patch the exploited flaws and segment networks before the gang does it for them.
Between May and August 2026, AWS suffered four notable reliability incidents, two of them on the same network path linking US-West-2 to the Seattle metro area — with the company still declining to confirm a shared root cause. Teams single-homed in us-west-2 need to audit their single points of failure before next quarter.
On August 14, 2026, Google shipped Gemini 3.7 Flash, its most intelligent workhorse model for coding and agents, at $0.75 per million input tokens — half the price of its predecessor, only three weeks later. For teams industrializing agentic coding, it is the value benchmark to lock in before the January 1, 2027 price hike.
In August 2026, two designers published ShieldFont, a webfont that renders readable text to humans while feeding a subtly scrambled version to scrapers that pull the raw HTML. For self-hosters running a blog or documentation, it is a nearly free technical defense — at the cost of search and accessibility tradeoffs.
Huntress measured a 155× increase in password spraying attacks in the first half of 2026, driven by an LSHIY campaign that generated 81 million login attempts in two weeks through the ROPC flow. Security teams must disable ROPC and extend MFA to every authentication flow, with no exceptions.
Japanese cloud provider Sakura Internet, selected for the country’s Government Cloud program, said on August 19, 2026 that access to its sales management system may affect up to 1,360,563 member accounts. Customers should watch for targeted phishing and rotate credentials, even with no exfiltration confirmed.
CISA added CVE-2026-33824, a remote code execution flaw in Windows IKE, to its Known Exploited Vulnerabilities catalog on August 18, 2026 — four months after Microsoft shipped the fix. Network teams must patch exposed IPsec gateways or block inbound UDP 500 and 4500 now.
