24th August – Threat Intelligence Report
Major vendors including GitLab, Cisco, and Citrix have released urgent patches for critical vulnerabilities that are already seeing exploitation or carry maximum severity scores. Notably, GitLab fixed CVE-2026-19478 in its Community and Enterprise editions, a CVSS 9.4 code injection flaw, while Citrix addressed authentication bypass issues CVE-2026-19489 and CVE-2026-19490 in NetScaler ADC and Gateway.
These fixes coincide with significant breach disclosures affecting Latvia's CSDD and Japan's Sakura Internet, as well as warnings regarding active AI-assisted attacks on Siemens S7 PLCs and a new Cl0p extortion campaign targeting PTC Windchill via CVE-2026-12569.
For the latest discoveries in cyber research for the week of 24th August, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- Latvia’s Road Traffic Safety Directorate (CSDD) has confirmed a breach affecting payment records of more than 1.2 million people – roughly two-thirds of the country’s population – as well as 200,000 organizations. The stolen data included identification numbers, license plates, payment amounts, dates and addresses. Attackers reportedly exploited a vulnerability in an internet-facing system.
- Sakura Internet, a Japanese cloud and hosting provider, has disclosed unauthorized access involving rental server environments and a separate sales management system. Up to 1.36 million customer accounts may have been exposed. Attackers also accessed hundreds of rental server accounts and installed malware on affected environments.
- The Hospital for Sick Children, Canada’s largest pediatric hospital, has disclosed data theft involving a third-party application. The incident affected its careers website and exposed information belonging to employees, applicants and staff at related organizations. The hospital stated that clinical systems and patient information were not affected.
- Berlin authorities isolated the city’s urban development and mobility ministries from government IT networks following a security breach. The measure disrupted email and internet access, forcing employees to use alternative communication channels and delaying several public services while the ministries remained disconnected.…