Today’s stories are less about new breaches than about the clock — a vendor’s device-trust controls buying just enough time to block a credential theft in progress, and two federal patch deadlines landing on the same day for flaws attackers are already using. Here’s what’s new since yesterday’s digest.
Breach watch: ReliaQuest blocks a ShinyHunters-linked social engineering attack after an employee handed over SSO credentials
Security vendor ReliaQuest disclosed that attackers registered a lookalike company domain, stood up a counterfeit SSO portal behind a CDN, and placed vishing calls to multiple employees while impersonating named members of its own security team. One employee was convinced to enter their password on the fake portal and approve an MFA push, handing the attackers a live session for ReliaQuest’s internal identity dashboard. The access was view-only — no customer data was touched, and every attempt to pivot from the dashboard into ReliaQuest’s actual applications was blocked because those systems require a trusted, company-managed device before an authenticated identity can reach them. The ShinyHunters group subsequently claimed a breach on its leak site, but researchers at SOCRadar found no validated data samples, ransom demand, or evidence of customer impact behind the claim. The Register · BleepingComputer
Credentials plus MFA approval is no longer a high enough bar on its own — this attack cleared both and still failed only because device trust was enforced as a second, independent gate. If your SSO flow lets a valid session reach production the moment MFA is satisfied, this is a good prompt to check whether device posture or managed-device enrollment sits in that path too, not just password and push.
Vulnerability watch: A Zimbra flaw under active exploitation hits its CISA-mandated patch deadline
CISA added CVE-2026-73570, a critical unauthenticated remote-code-execution flaw in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities catalog on August 21 and set a compressed remediation deadline of August 24 for federal civilian agencies — reflecting CISA’s move earlier this year to a three-day patching window for actively exploited critical bugs. The flaw lets an attacker execute arbitrary commands as the zimbra user on any instance with SNMP notifications enabled, a configuration turned on by default in vulnerable builds; no valid credentials are required. Zimbra shipped a fix in version 10.1.20 back on July 20, but CERT Polska confirmed active in-the-wild exploitation this month, well after the patch was available — a gap researchers describe as a shrinking window between disclosure and mass scanning. BleepingComputer · Security Affairs · The Hacker News
A patch that sat available for a month before exploitation caught up with it is exactly the pattern SNMP-adjacent, default-on services tend to produce — nobody flips the setting off because nobody remembers it’s on. If you run Zimbra Collaboration Suite, confirm you’re on 10.1.20 or later and check whether SNMP trap notifications are enabled on your instances even if you never turned them on deliberately.
Vulnerability watch: A critical Everest Forms bug opens 100,000+ WordPress sites to unauthenticated takeover
A newly disclosed flaw in the Everest Forms WordPress plugin, tracked as CVE-2026-19598 with a CVSS score of 9.8, sits in the plugin’s file-upload handling — specifically insufficient validation of file type and path in its upload field class. An unauthenticated attacker can submit a crafted request to any public form using the vulnerable upload feature and drop a PHP web shell directly on the server, no WordPress account needed. The plugin is active on more than 100,000 sites. Affected installs should update to version 3.0.9.5 or later immediately; sites that can’t patch right away should disable public-facing upload forms in the meantime. Cyber Security News
Unauthenticated file-upload bugs in widely deployed plugins tend to move from disclosure to automated mass-scanning within days, not weeks. If Everest Forms sits anywhere in your web properties — including a marketing site you don’t consider part of your security perimeter — treat this as a same-day patch, not a backlog item.
Also noted: Federal agencies hit today’s deadline to patch an actively exploited Windows kernel driver flaw
CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) reachable from any low-privilege account, was already under active exploitation when Microsoft shipped a fix on August 11 as part of that month’s cumulative updates (KB5121003 for Windows 11, KB5120249 for Windows 10 ESU). CISA added it to the KEV catalog the same day and set today, August 25, as the remediation deadline for federal civilian agencies under Binding Operational Directive 26-04. Because the fix replaces a kernel driver, installing the patch alone doesn’t complete remediation — affected endpoints also need a reboot to load it. Qualys · SOC Prime
If your patch process tracks “update installed” as the finish line, this one is a reminder to check for “endpoint rebooted” too — a privilege-escalation fix sitting unloaded in memory is functionally the same as no fix at all.
Final thought
Every story today is a variant of the same race: a vendor’s second control catching what the first one missed, and two federal deadlines landing on flaws that were already being exploited before the clock even started. The lesson holds across all three — assume the patch window is shorter than it used to be, and make sure your own controls don’t depend on any single gate holding by itself. If you want help mapping where your detection coverage has single points of failure, see our how-to guides or book a discovery call.