[{"data":1,"prerenderedAt":213},["ShallowReactive",2],{"publication:en:D202608":3},{"meta":4,"copy":18,"relatedArticles":168,"terms":205,"term":206,"resourceParent":207,"glossaryParent":210},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"D202608","\u002Fblog\u002Fvulnerability-digest-2026-08","article","Website vulnerability digest for August 2026","Cybersecurity digest for August 2026","August 2026: vulnerabilities, breaches and cyber incidents","August 2026 security digest: software vulnerabilities, incidents involving Chubu Electric Power and SickKids, sources and practical checks for businesses.",[13,14,15],"\u002Fblog","\u002Fblog\u002Fvulnerability-digest-2026-07","\u002Fblog\u002Fvulnerability-digest-2026-09","2026-09-03","2026-11-06",{"intro":19,"sections":20,"checklistTitle":126,"checklist":127,"faq":130,"sources":140,"links":150,"cta":163},"August's selection separates two WordPress security releases and an OpenSSL QUIC fix. The WordPress cases have different prerequisites: victim interaction at login, or an uploader account with particular image-processing software. The OpenSSL entry concerns its own QUIC server implementation. The issue also covers incidents involving Chubu Electric Power and SickKids, with the reported impact and checks relevant to a business using similar services.",[21,45,60,75,84,103,112,121],{"title":22,"paragraphs":23,"table":26},"Selected events and fix thresholds",[24,25],"This retrospective covers 2026-08-01 to 2026-08-31. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.","For the selected items, this review confirms the disclosure or security release and its stated conditions. Active exploitation and historical CISA KEV or EPSS status are not asserted here. Missing exploitation evidence remains unknown.",{"caption":27,"headers":28,"rows":32},"Selected disclosures and security releases for August 2026",[29,30,31],"Event date","Product and advisory","Fix thresholds by branch",[33,37,41],[34,35,36],"2026-08-06","WordPress | CVE-2026-64638","7.0.3",[38,39,40],"2026-08-12","WordPress | CVE-2026-65640","7.0.4",[42,43,44],"2026-08-25","OpenSSL | CVE-2026-18798","4.0.2 \u002F 3.6.4 \u002F 3.5.8",{"title":46,"paragraphs":47,"sources":50},"WordPress: reflected XSS on the login screen (CVE-2026-64638)",[48,49],"A crafted third-party page can exploit reflected XSS on the login screen. Escalation to PHP code execution requires successful social engineering, explicit victim interaction and additional conditions. The vendor advisory lists fixed releases for individual branches, including 7.0.3.","Update core and verify the branch-specific fix. Remind editors to open the known admin address directly and check login and account recovery after the release.",[51,54,57],{"label":52,"url":53},"wordpress 7 0 3 release","https:\u002F\u002Fwordpress.org\u002Fnews\u002F2026\u002F08\u002Fwordpress-7-0-3-release\u002F",{"label":55,"url":56},"CVE-2026-64638 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-64638",{"label":58,"url":59},"WordPress advisory GHSA-52p2-r8wf-jcrf","https:\u002F\u002Fgithub.com\u002FWordPress\u002Fwordpress-develop\u002Fsecurity\u002Fadvisories\u002FGHSA-52p2-r8wf-jcrf",{"title":61,"paragraphs":62,"sources":65},"WordPress: media processing with Imagick and Ghostscript (CVE-2026-65640)",[63,64],"A user with Author-level upload permissions or higher can trigger code execution through a malicious PostScript upload when Imagick and Ghostscript are in use. The release event was on 12 August; the CNA record was published on 17 August.","Check both server components and upload permissions, then apply the correct core fix. Test ordinary image and document previews on a staging copy with harmless files.",[66,69,72],{"label":67,"url":68},"wordpress 7 0 4 release","https:\u002F\u002Fwordpress.org\u002Fnews\u002F2026\u002F08\u002Fwordpress-7-0-4-release\u002F",{"label":70,"url":71},"CVE-2026-65640 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-65640",{"label":73,"url":74},"WordPress advisory GHSA-8vr3-7mxf-gx8w","https:\u002F\u002Fgithub.com\u002FWordPress\u002Fwordpress-develop\u002Fsecurity\u002Fadvisories\u002FGHSA-8vr3-7mxf-gx8w",{"title":76,"paragraphs":77,"sources":80},"OpenSSL: QUIC initial-packet handling (CVE-2026-18798)",[78,79],"A malformed QUIC INITIAL packet can cause a double free when connection creation fails. OpenSSL describes heap corruption and denial of service, without evidence that this issue enables code execution. The affected branches are 4.0, 3.6 and 3.5 before their respective fixes.","Determine whether the service uses OpenSSL's QUIC server implementation. Update its actual library package and test connection establishment and availability, including the relevant UDP ingress rules.",[81],{"label":82,"url":83},"CVE-2026-18798 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-18798",{"title":85,"paragraphs":86,"table":88},"Breaches and cyber incidents reported this month",[87],"These cases were publicly reported during August 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.",{"caption":89,"headers":90,"rows":94},"Incident notices: August 2026",[91,92,93],"Organization","Public notice","Incident",[95,99],[96,97,98],"Chubu Electric Power","2026-08-04","Unauthorized account access",[100,101,102],"SickKids","2026-08-20","Supplier incident",{"title":104,"paragraphs":105,"sources":108},"Chubu Electric: misused credentials and possible email exposure (2026-08-04)",[106,107],"On 2026-08-04, Chubu Electric reported misuse of credentials identified after a July 29 alert. Emails and group contact information may have been accessed. It reported no power-supply disruption or confirmed leakage of electricity and gas customer information.","Separate business email and address-book access from operational and customer systems. Review account activity and revocation paths, and keep suspected exposure distinct from information that the investigation has actually confirmed as leaked.",[109],{"label":110,"url":111},"Chubu Electric Power: incident notice","https:\u002F\u002Fwww.chuden.co.jp\u002Fenglish\u002Fcorporate\u002Freleases\u002Fpressreleases\u002F1218170_5163.html",{"title":113,"paragraphs":114,"sources":117},"SickKids: a careers website and personnel information (2026-08-20)",[115,116],"SickKids' 2026-08-20 notice linked unauthorized access to employee information and disruption of its external careers website to a third-party application vulnerability. The review also considered former employees and job applicants. The notice concerned personnel information, not a confirmed hospital-wide patient-record breach.","Treat recruitment forms and HR applications as separate stores of sensitive data. Inventory their suppliers, patch ownership and retention rules, including information about unsuccessful applicants and former staff.",[118],{"label":119,"url":120},"The Hospital for Sick Children: incident notice","https:\u002F\u002Fwww.sickkids.ca\u002Fen\u002Fnews\u002Farchive\u002F2026\u002FSickKids-employee-information-impacted-by-cybersecurity-incident\u002F",{"title":122,"paragraphs":123},"Coverage and editorial record",[124,125],"This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.","The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.","Checks to assign to the maintainer",[49,64,79,128,129],"Record the installed package or image, the applicable condition and the person responsible for the change.","Agree backup, restart and rollback steps, then check enquiries, login and affected integrations using controlled data.",[131,134,137],{"question":132,"answer":133},"Should we install the old version listed in the table?","The numbers identify the historical fix in each branch. Select a release that is supported at deployment time, or a distributor package whose security notice confirms the backport. Record the actual installed revision.",{"question":135,"answer":136},"Does an update prove that a site was never compromised?","An update closes the affected software path. If logs, accounts or files show suspicious changes, investigate that evidence separately and verify recovery. A successful update alone does not resolve an incident.",{"question":138,"answer":139},"Why can the date of an attack differ from the digest month?","This section groups public notices by the month in which they were issued. The text states an earlier discovery date when the source provides one. A later investigation or a newly released old database is not silently presented as a new attack.",[141,142,143,144,145,146,147,148,149],{"label":52,"url":53},{"label":55,"url":56},{"label":58,"url":59},{"label":67,"url":68},{"label":70,"url":71},{"label":73,"url":74},{"label":82,"url":83},{"label":110,"url":111},{"label":119,"url":120},[151,153,155,158,161],{"path":14,"label":152},"Previous issue: July 2026",{"path":15,"label":154},"Next issue: September 2026",{"path":156,"label":157},"\u002Fblog\u002Fvulnerability-prioritization","How to prioritize vulnerabilities",{"path":159,"label":160},"\u002Fservices\u002Fsecurity-audit","Plan a website security review",{"path":13,"label":162},"All articles",{"title":164,"description":165,"button":166,"type":167},"Check which updates apply to your website","Send the website URL and the hosting or application details you know. We will agree applicability, the maintenance scope and checks after the change.","Discuss the update scope","check",[169,181,190,198],{"id":170,"path":14,"title":171,"description":172,"category":173,"artwork":174,"order":175,"publishedOn":176,"period":177,"related":178},"D202607","Cybersecurity digest for July 2026","July 2026 security digest: software vulnerabilities, incidents involving Coca-Cola \u002F fairlife and Origin Energy, sources and practical checks for businesses.","digest","vulnerability-digest",4,"2026-08-03","2026-07",[179,6,156,180],"\u002Fblog\u002Fvulnerability-digest-2026-06","\u002Fblog\u002Fwhy-website-updates-matter",{"id":182,"path":15,"title":183,"description":184,"category":173,"artwork":174,"order":185,"publishedOn":186,"period":187,"related":188},"D202609","Cybersecurity digest for September 2026","September 2026 security digest: software vulnerabilities, incidents involving Gyazo \u002F Helpfeel and Elekta, sources and practical checks for businesses.",2,"2026-10-03","2026-09",[6,189,156,180],"\u002Fblog\u002Fvulnerability-digest-2026-10",{"id":191,"path":156,"title":192,"description":193,"category":194,"artwork":195,"order":196,"publishedOn":197},"P083","Vulnerability prioritization for small business: decide what to fix first","Prioritize vulnerabilities by applicability, exposure, exploitation evidence, business impact and repair. Record an owner, decision and acceptance check.","operations","security",82,"2026-10-22",{"id":199,"path":180,"title":200,"description":201,"category":202,"artwork":202,"order":203,"publishedOn":204},"updates","How to Update WordPress Safely","To update WordPress safely, check theme, plugin and PHP compatibility, back up files and the database, and prepare a recovery procedure before changing versions. After the update, test login, forms and checkout. Pause when a critical dependency is incompatible or recovery has not been prepared.","websites",107,"2026-04-21",[],null,{"path":208,"label":209},"\u002Fresources","Website security resources and templates",{"path":211,"label":212},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058182]