The Lyceum: Cyber Intelligence Daily — Aug 11, 2026

The freshest intelligence has one theme: systems trusted because they sit “inside” the perimeter are becoming the route through it. A private cellular network connected attackers to a power plant, a trusted WordPress feed delivered backdoors, and remote-management software appears to have carried ransomware straight toward customer fleets.

• CVE-2026-58613 — Microsoft Windows Cloud Files Mini Filter Driver: patch status not established in the available Talos report; CVSS 8.8; a use-after-free flaw could permit code execution after memory corruption.
• CVE-2026-8037 — Progress LoadMaster: actively exploited and listed in CISA’s Known Exploited Vulnerabilities catalog; no CVSS score is assigned in the CVE backbone; an unauthenticated attacker can inject commands into exposed appliances.
• StormEncryptor: newly documented ransomware deployed by Storm-1175, a financially motivated actor previously associated with Medusa; Microsoft assesses that recent access likely involved N-able N-central vulnerability CVE-2026-18577.

CERT Polska’s newly published investigation reconstructs how an attacker crossed from a compromised wind farm into a combined heat-and-power plant serving roughly 50,000 residents. (A “Private” Mobile Network Became a Road Into a Power Plant)

The route was a private cellular access point name, or APN: a network assumed to be closed, but configured so equipment at separate facilities could communicate. CERT Polska found that the attacker reached a WAGO industrial controller using default administrator credentials, explored for about a week, then put three Siemens programmable logic controllers into STOP mode. A steam turbine and process-water treatment system were damaged, although operators restored service before customers lost heat or electricity.

CERT Polska says this is the first real-world incident it has documented in which an attacker reached industrial systems by moving laterally through a private APN. If operators respond by isolating APN clients, removing default credentials and allowing only explicitly required traffic into operational technology, the technique loses much of its leverage. If they do not, the warning sign will be simple and measurable: devices at unrelated sites will still be able to reach one another. (A “Private” Mobile Network Became a Road Into a Power Plant)

Wordfence says attackers compromised BdThemes infrastructure and poisoned a JSON feed used to display promotional banners inside WordPress administration pages. The payload executed in an administrator’s browser without modifying the installed plugin files—the very files many security scanners would inspect first.

Wordfence identified seven affected products, including Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit and Ultimate Store Kit. The malicious code created hidden administrators, installed a fake plugin containing a web shell and planted persistent “must-use” plugins.

That changes the cleanup decision: removing or updating the original plugin is not enough once the site has been altered. Administrators should hunt for usernames beginning with bd_, suspicious @wordpress.org accounts, emer-run.php, unfamiliar must-use plugins and the database options fz_emer_login_tokens and fz_emer_done_v1. If those artifacts continue appearing after remediation, either persistence survived or BdThemes has not yet found every compromised upstream component.

BleepingComputer reports that Microsoft Threat Intelligence has connected Storm-1175—a China-based, financially motivated actor previously associated with Medusa—to a newly documented ransomware strain called StormEncryptor.

Microsoft assesses that the recent intrusions likely began with CVE-2026-18577, an authentication bypass in self-hosted N-able N-central servers. After gaining access, Storm-1175 used administrative tools including AnyDesk and SimpleHelp, extracted credentials, stole data and encrypted files with the .encrypted extension.

N-central is designed to administer large numbers of downstream machines, so successful exploitation can turn one server into a route across an entire managed fleet. N-able’s corrective build is 2026.3.1.7, but patching alone cannot remove access established earlier. The decisive signal will be StormEncryptor appearing in an environment after the hotfix: that would point to pre-patch persistence or a second entry path, not a failed software update. (status.n-able.com)

CISA, the Federal Bureau of Investigation and South Korea’s National Police Agency say Gunra ransomware operators are exploiting Fortinet vulnerabilities CVE-2024-55591 and CVE-2025-24472 to obtain privileged network access. (Korean and U.S. agencies just put Gunra ransomware on the radar together)

The joint advisory—also supported by the National Security Agency, Defense Cyber Crime Center and U.S. Secret Service—draws on investigations involving healthcare, financial-services and government organizations. The agencies say Gunra steals data before encrypting systems and has issued demands exceeding $10 million. (therecord.media)

The practical disruption is to the patching playbook: an appliance can be fully updated and still contain accounts, configuration changes or tunnels created before remediation. Organizations should review administrator creation, VPN activity, configuration history and outbound transfers. If new Gunra cases keep tracing back to these older flaws, the observable failure is not patch availability; it is the absence of retrospective compromise hunting. (Gunra Is Turning Old Fortinet Flaws Into Eight-Figure Ransom Demands)

Russian-language publication Xakep reports that attackers are circulating malicious versions of iOS applications through Telegram. The report matters because installation outside Apple’s normal distribution path can strip away the provenance signals users rely on when deciding whether software is legitimate. For defenders, Telegram-delivered mobile applications now belong in the same intake controls as sideloaded enterprise software. Source: Xakep — Russian. No English-language coverage confirmed at time of publication.

Xakep reports that 77 extensions in Open VSX collected information about developers. Open VSX supplies extensions to code editors outside Microsoft’s official Visual Studio Marketplace, making developer workstations—and the credentials, repositories and cloud environments accessible from them—the real prize. The next meaningful signal will be evidence that collected information enabled repository access or follow-on compromise. Source: Xakep — Russian. No English-language coverage confirmed at time of publication.

Xakep reports that vulnerabilities in TP-Link Omada’s zero-touch provisioning process can lead to complete network compromise. Zero-touch provisioning is meant to configure devices automatically; if that trust process is subverted, attackers can inherit control before administrators ever begin normal monitoring. That risk is especially relevant as national cyber agencies increasingly warn utilities and manufacturers about ordinary networking equipment embedded inside operational environments. Source: Xakep — Russian. No English-language coverage confirmed at time of publication. (voakorea.com)

A wind farm opened a side door into a turbine, a WordPress banner quietly hired its own administrators, and remote-management software delivered ransomware like an especially hostile help desk.

Meanwhile, Steam’s stolen shipping records are waiting to turn “your parcel needs a €2.99 customs payment” into the most believable sentence in your inbox.

Check the trusted paths.

Forward this to the person who still thinks “private network” means private.