Cybersecurity Radar — 2026-08-20
CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including a critical macOS authentication flaw rated CVSS 9.8. Separately, ransomware operators are reportedly impersonating recovery firms to pressure previous victims into paying additional extortion demands.
Cybersecurity Radar — 2026-08-20
🔴 Critical Alerts
CISA flags actively exploited macOS authentication vulnerability
CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog. One identified flaw, CVE-2026-65400, affects Apple macOS and carries a CVSS score of 9.8; it may allow a network attacker to authenticate to Screen Sharing without valid credentials. Organizations using affected macOS systems should prioritize vendor updates, restrict Screen Sharing exposure, and review authentication logs.
Ransomware-linked actors reportedly pose as recovery firms
A group identified in the report as Ransom Busters is reportedly presenting itself as a ransomware recovery service and demanding as much as $60,000 from victims. The reported tactic combines impersonation, pressure against organizations already dealing with an intrusion, and alleged reuse of stolen data for a second extortion attempt. Potential victims should independently verify recovery providers, avoid sharing additional sensitive information, and preserve communications for incident-response investigators.
Threat Landscape
No additional recent, independently detailed threat-campaign or APT reporting was available in the supplied research results within the required coverage window.
Vulnerabilities & Patches
CVE-2026-65400 — Apple macOS Screen Sharing authentication flaw
- Product: Apple macOS
- CVE: CVE-2026-65400
- CVSS: 9.8
- Status: Added to CISA’s KEV catalog as actively exploited
- Recommended action: Apply the applicable Apple security update, restrict Screen Sharing to trusted networks, and investigate unexpected remote-authentication activity.
No additional vulnerability disclosures with sufficiently verified publication dates and complete CVE/CVSS details were available in the supplied research results.
Breaches & Incidents
No recent confirmed breach reporting with sufficient scope, impact, and response details was available in the supplied research results within the required coverage window.
Industry & Policy
No recent regulatory, funding, law-enforcement, or major vendor-policy announcement was available in the supplied research results within the required coverage window.
What to Watch
- Whether organizations begin reporting exploitation or compromise linked to the newly expanded CISA KEV entries.
- Additional extortion attempts that impersonate ransomware-recovery providers.
- Vendor guidance and remediation details for the other three vulnerabilities referenced in CISA’s latest KEV update.
Reader Action Items
- Patch and triage macOS systems: Identify internet- or partner-accessible Screen Sharing services and apply the relevant Apple security update.
- Review remote-access telemetry: Search for unusual Screen Sharing authentication attempts, new remote sessions, and access from unfamiliar network locations.
- Verify recovery vendors independently: Confirm provider identities through trusted channels, avoid sending additional credentials or data, and preserve all extortion communications for investigators.
This content was collected, curated, and summarized entirely by AI — including how and what to gather. It may contain inaccuracies. Crew does not guarantee the accuracy of any information presented here. Always verify facts on your own before acting on them. Crew assumes no legal liability for any consequences arising from reliance on this content.
Powered by
