This roundup is going to be a strange one to write. Last week I read about an attack on a Polish combined heat and power plant that shut down a steam turbine on August 8, and we still do not know exactly what was breached. Around the same time, Fortinet and Palo Alto both pushed big security updates, and the vCenter and TeamCity stories from earlier in the month are still very much alive. Some of these I have covered before, but I want everything in one place this week because the combined picture is a pretty nervous one for anyone running infrastructure.
Poland: CHP plant attack, August 8
On August 8, 2026 at 19:20 local time, a steam turbine at a Polish combined heat and power plant was taken offline following a security incident. Sekurak has the story. The exact vector has not been officially published, but the comments and breadcrumbs point at edge devices: FortiGate, Palo Alto, or Sophos. It is a good prompt to audit your own perimeter rather than just chase CVEs for the next few days.
VMware vCenter: CVE-2026-59310, score 9.8
Unchanged from last week, and still active. A directory traversal in vCenter’s Syslog handling gives an unauthenticated attacker root. The campaign that started August 3 keeps dropping reverse_ssh backdoors and JSP webshells. Open reporting counts 360+ victims across 47 countries, and Check Point Research has confirmed an exploit chain was circulating within five days of the advisory. The same VMSA-2026-0006 advisory also covers CVE-2026-59309, an authentication bypass in the VMware Directory Service, also rated 9.8, so patch both at the same time.
No workarounds. The only sensible response is VMSA-2026-0006: vCenter 8.0 U3k and U2f, VCF/vSphere Foundation 9.1.0.0300 and 9.0.2.0100. If you cannot patch, isolate vCenter to the management VLAN and audit /etc/cron.d, user accounts and CROND logs. The same advisory also carries CVE-2026-47876, an out-of-bounds write in VMXNET3 (9.3), so ESXi is in scope too.
Sources: Broadcom advisory, NVD, Rapid7, tech-insider.
JetBrains TeamCity: CVE-2026-63077, unauthenticated RCE
Still very much relevant for anyone running TeamCity on-prem. An XStream deserialization flaw in the agent polling protocol gives remote code execution without credentials. CISA added it to KEV on August 5 and JetBrains has since confirmed attacks on unpatched servers. Rapid7 pointed out that TeamCity ships a permissive XStream allowlist, which materially widens the attack surface.
Fixes shipped in 2025.11.7 and 2026.1.3, and JetBrains has a security patch plugin for older installs back to 2017.1. In your logs, com.thoughtworks.xstream.converters.ConversionException is the tell for failed deserialization attempts that may have carried live exploits.
Sources: The Hacker News, Rapid7, NVD.
Fortinet: more than the August patch day
August’s Patch Day brought three Fortinet bulletins: CVE-2026-26035 (FortiWeb, 8.8), CVE-2026-70465 (FortiClient for Windows, DNS parsing buffer overflow, 7.3) and CVE-2026-70468 (FortiManager and FortiManager Cloud, FGFM authentication bypass, 7.3). Important, but in my view the bigger story sits elsewhere.
First, CVE-2026-35616 in FortiClient EMS (9.1, in KEV) was disclosed back in March but exploitation is still ongoing. Fortinet confirmed attackers were already inside affected environments at disclosure time. If you run FortiClient EMS and it is internet-reachable, patch now or cut it off. Second, FortiSandbox picked up its own critical bulletin, CVE-2026-39808 (OS command injection, FG-IR-26-100), which Arctic Wolf recommends treating as priority one.
On top of that, Mandiant is still tracking an active FortiManager campaign (50+ victims so far, exfiltrated FortiGate data including IPs, credentials and configuration). CISA keeps flagging the FortiCloud SSO bypass (CVE-2026-24858, 9.4) from earlier this year. If your FortiGate sits on an internet edge, this is the week to do a password and MFA audit.
Sources: CSA Singapore, H-ISAC, SecurityWeek, Arctic Wolf, Cybersecurity Dive.
Palo Alto: August 12 bulletin plus live CVE-2026-0257 exploitation
In my previous pass at this story I under-covered and partly mis-cited the Palo Alto picture, so let me redo it. CVE-2026-0257 (GlobalProtect authentication bypass, score 7.8) is still being actively exploited. Unit 42 and Rapid7 both observed scanning and login attempts, and CISA added it to KEV on May 29. The flaw shows up when the GlobalProtect portal or gateway uses the same certificate for HTTPS and for signing the authentication override cookies.
The August 12 bulletin does cover 11 items. The most important are: CVE-2026-0264 (heap buffer overflow in DNS Proxy/DNS Server, unauthenticated RCE, 7.2), CVE-2026-0288 (buffer overflow in the User-ID Terminal Server Agent, 7.2) and CVE-2026-0301 (information disclosure in URL Filtering, 1.7, but it touches Cloud NGFW and Prisma Access on AWS and Azure so it is still worth patching). On top of that, PAN-SA-2026-0011 carries the monthly Chromium update for Prisma Browser.
If your users run GlobalProtect on laptops, audit the portal configuration and make sure the TLS certificate is not the same one used for authentication cookies. Update PAN-OS to the latest hotfix for your branch; the full version matrix lives at security.paloaltonetworks.com.
Sources: Unit 42, Palo Alto advisory, PAN-SA-2026-0011, Canadian Centre for Cyber Security.
Smaller items worth knowing
- Cisco Secure FMC carries CVE-2026-20316, a hardcoded password bug described as a zero-day with active exploitation. If you run FMC, check the Cisco advisory and patch urgently.
- Google Chrome got its monthly round of fixes on August 21. Make sure auto-update is on and force a browser restart on managed workstations.
What to do today
- vCenter: apply VMSA-2026-0006 now. If you cannot, isolate vCenter to the management VLAN and audit
/etc/cron.d, accounts and CROND logs. - TeamCity on-prem: update to 2025.11.7 or 2026.1.3, or install the security plugin. Review XStream logs.
- Fortinet: patch FortiWeb (8.0.3, 7.6.7, 7.4.12 or 7.2.13), FortiManager, FortiClient EMS (CVE-2026-35616) and FortiSandbox 4.4.9. Reset FortiCloud SSO passwords and enforce MFA. If FortiManager is exposed publicly, take it offline and review the logs.
- Palo Alto: audit GlobalProtect for CVE-2026-0257, patch DNS Proxy and User-ID TSA (CVE-2026-0264 and 0288), and force PAN-OS updates for your branch.
- Polish incident follow-up: audit your perimeter (FortiGate / Palo Alto / Sophos), review admin rules and access, and verify your configuration backups.
