Top 5 Cybersecurity Headlines to Know this Month
BARR Advisory Senior Consultant Kevin Lewis has picked out five security and compliance headlines from the past month that you need to know.
Take a look to find out what our consulting team has been reading this August—plus, scroll to see Kevin’s CISO Pick of the Month to learn about a more streamlined path to FedRAMP.
Iran Targeting Local Utilities, US Officials Say
A coordinated wave of cyberattacks linked to Iran recently hit water and wastewater facilities across at least seven U.S. states. Rather than using complex zero-days, attackers simply picked off “low-hanging fruit” by targeting decades-old operational technology left exposed to the open internet with default usernames and passwords, NPR reported. While quick manual overrides kept the pumps running—and saved a small Minnesota town’s annual Pie Day celebration—the incident highlights how easily basic credential neglect can threaten critical infrastructure.
➡️ Read more
‘Vishing’ Attack Triggers Data Leak
Extortion group ShinyHunters dumped 1.6 million RingCentral customer records online after the communications platform refused to pay a ransom demand following a July breach. The attackers didn’t need a fancy exploit to get inside—they simply voice-phished an employee into handing over their password. RingCentral managed to contain the intrusion quickly, but the stolen haul still included customer names, physical addresses, phone numbers, and email addresses. It’s a sobering reminder that social engineering remains one of the easiest ways past your digital perimeter, making regular vishing awareness training and strict access controls essential.
➡️ Read more
Apple Patches Screen Sharing Vulnerability
A newly disclosed logic flaw in macOS Screen Sharing allows remote attackers to execute commands with complete administrator control when legacy VNC password access is turned on. Because older VNC logins don’t connect to a specific user account, the background tools that handle file transfers mistakenly run with full system authority instead of restricted access. Attackers can exploit this loophole to remotely create privileged access files and take over the system without needing complex memory exploits. Apple patched the vulnerability in macOS Tahoe 26.6 and Sonoma 14.8.8.
➡️ Read more
Microsoft Scrambles to Patch New Zero-Day
Security researcher “Nightmare Eclipse” has publicly disclosed a new Microsoft Defender zero-day that completely bypasses Microsoft’s previous patch. Called “ShieldBreak,” the flaw allows low-permission attackers to gain full SYSTEM privileges across Windows 10, 11, and Server devices with Defender enabled. The exploit was released without prior warning amid an ongoing dispute over Microsoft’s bug bounty practices, joining several other unpatched zero-days dropped by the same researcher. Microsoft is currently working on an official security update.
➡️ Read more
New Linux Botnet Uncovered
A new Mirai-derived Linux botnet called Evooo1Bot is picking off unpatched edge devices like routers, firewalls, and IP cameras to turn them into SOCKS5 proxies. Active since July, the malware weaponizes known vulnerabilities to run stealthy scripts that erase Bash history and mask command traffic inside standard HTTPS port 443 traffic. Once installed, it allows attackers to hide malicious activity, bypass geo-restrictions, and pivot directly into internal corporate networks. If your organization relies on internet-facing edge hardware, this is your cue to audit your inventory and patch known vulnerabilities immediately.
➡️ Read more
CISO Pick of the Month:
A More Streamlined Path to FedRAMP
Is FedRAMP on your organization’s compliance roadmap? 🗺️
FedRAMP 20x is a new option that streamlines the certification process with more automation, less manual documentation, and greater flexibility for cloud providers.
The goal isn’t less security—it’s a more efficient way to show it. Our cybersecurity consulting practice leader, Aaron Hamlin, shares more in this short video. 👀
Get The Scoop
Want to get these insights straight to your inbox? Subscribe to Take5, our monthly newsletter featuring top security and compliance headlines, events, and resources—brought to you by CISOs from BARR’s cybersecurity consulting team.