--- title: 24th August – Threat Intelligence Report | daily.dev description: Weekly threat intelligence roundup covering major breaches at Latvia's CSDD (1.2M records), Sakura Internet (1.36M accounts), SickKids hospital, and Berlin... canonical: https://daily.dev/posts/24th-august-threat-intelligence-report-8vriywver twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 24th August – Threat Intelligence Report | daily.dev og:description: Weekly threat intelligence roundup covering major breaches at Latvia's CSDD (1.2M records), Sakura Internet (1.36M accounts), SickKids hospital, and Berlin... og:url: https://daily.dev/posts/24th-august-threat-intelligence-report-8vriywver og:image: https://api.daily.dev/og/posts/8vriywVer.png og:image:alt: 24th August – Threat Intelligence Report og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 24th August – Threat Intelligence Report **[Check Point Research](https://daily.dev/sources/cpresearch)** · 4 min read · 0 upvotes · 0 comments ## Summary Weekly threat intelligence roundup covering major breaches at Latvia's CSDD (1.2M records), Sakura Internet (1.36M accounts), SickKids hospital, and Berlin government ministries. AI-related threats include an autonomous agent exploiting a GitHub Actions flaw in Snowflake's repo, AI-assisted attacks on Siemens S7 PLCs, and an uncensored AI platform 'Kriminal' aiding cybercrime. Critical vulnerabilities patched this week include GitLab's CVE-2026-19478 (CVSS 9.4 code injection), nine Cisco Crosswork/Secure Workload flaws (six at CVSS 10.0), Citrix NetScaler CVE-2026-19489/19490, and a NASA/JPL AIT-GUI RCE flaw fixed in version 2.5.2. Additional research covers a WordPress-based StopAndProtect malware campaign, a repurposed Windows Defender BTR.sys driver, rising education-sector attacks, and a Cl0p extortion campaign exploiting CVE-2026-12569 in PTC Windchill/FlexPLM. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-19478 in GitLab and how severe is it? CVE-2026-19478 is a critical unauthenticated code injection vulnerability affecting GitLab self-managed Community and Enterprise editions, rated CVSS 9.4. It allows remote attackers to alter or delete public projects and user data. GitLab released out-of-band fixes, and exploitation attempts were observed in the wild after the flaw was disclosed. _Teams patching GitLab instances can track fast-moving vulnerability disclosures like this on daily.dev._ ### What are the Citrix NetScaler vulnerabilities CVE-2026-19489 and CVE-2026-19490? CVE-2026-19489 is a critical authentication bypass affecting NetScaler ADC and NetScaler Gateway that lets unauthenticated attackers access appliances configured with SAML authentication. CVE-2026-19490 is a separate flaw that can cause denial of service. Citrix published patches for both and urged administrators to apply them as soon as possible. _Admins juggling multiple Citrix advisories can follow patch guidance like this on daily.dev._ ### How did an AI agent exploit a vulnerability in Snowflake's GitHub Actions workflow? Researchers demonstrated an autonomous AI agent exploiting a GitHub Actions flaw in Snowflake's public repository, gaining read access to the company's internal Jira system and exfiltrating tokens within seconds without human steering. Snowflake patched the workflow and rotated credentials after the demonstration. _Developers assessing AI-driven CI/CD risks can follow cases like this on daily.dev._ ## Similar posts on daily.dev - [5th October – Threat Intelligence Report](https://daily.dev/posts/5th-october-threat-intelligence-report-ptoq8lctm) · Check Point Research · 0 upvotes · 0 comments - [21st September – Threat Intelligence Report](https://daily.dev/posts/21st-september-threat-intelligence-report-o1dlvtvb0) · Check Point Research · 0 upvotes · 0 comments - [7th September – Threat Intelligence Report](https://daily.dev/posts/7th-september-threat-intelligence-report-fdycnrc54) · Check Point Research · 1 upvotes · 0 comments - [3rd August – Threat Intelligence Report](https://daily.dev/posts/3rd-august-threat-intelligence-report-y3hw57hhz) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach), [#gitlab](https://daily.dev/tags/gitlab) [View this post on daily.dev](https://daily.dev/posts/24th-august-threat-intelligence-report-8vriywver) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"24th August – Threat Intelligence Report","url":"https://daily.dev/posts/24th-august-threat-intelligence-report-8vriywver","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/24th-august-threat-intelligence-report-8vriywver"},"datePublished":"2026-08-24T14:13:01.903Z","dateModified":"2026-08-24T14:13:26.507Z","description":"Weekly threat intelligence roundup covering major breaches at Latvia's CSDD (1.2M records), Sakura Internet (1.36M accounts), SickKids hospital, and Berlin...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Check Point Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Check Point Research","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7e3b130555214df2bf737ee6c764fa42","url":"https://daily.dev/sources/cpresearch"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/24th-august-threat-intelligence-report-8vriywver","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach,gitlab","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Check Point Research","item":"https://daily.dev/sources/cpresearch"},{"@type":"ListItem","position":3,"name":"24th August – Threat Intelligence Report"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/24th-august-threat-intelligence-report-8vriywver#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-19478 in GitLab and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-19478 is a critical unauthenticated code injection vulnerability affecting GitLab self-managed Community and Enterprise editions, rated CVSS 9.4. It allows remote attackers to alter or delete public projects and user data. GitLab released out-of-band fixes, and exploitation attempts were observed in the wild after the flaw was disclosed. Teams patching GitLab instances can track fast-moving vulnerability disclosures like this on daily.dev."}},{"@type":"Question","name":"What are the Citrix NetScaler vulnerabilities CVE-2026-19489 and CVE-2026-19490?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-19489 is a critical authentication bypass affecting NetScaler ADC and NetScaler Gateway that lets unauthenticated attackers access appliances configured with SAML authentication. CVE-2026-19490 is a separate flaw that can cause denial of service. Citrix published patches for both and urged administrators to apply them as soon as possible. Admins juggling multiple Citrix advisories can follow patch guidance like this on daily.dev."}},{"@type":"Question","name":"How did an AI agent exploit a vulnerability in Snowflake's GitHub Actions workflow?","acceptedAnswer":{"@type":"Answer","text":"Researchers demonstrated an autonomous AI agent exploiting a GitHub Actions flaw in Snowflake's public repository, gaining read access to the company's internal Jira system and exfiltrating tokens within seconds without human steering. Snowflake patched the workflow and rotated credentials after the demonstration. Developers assessing AI-driven CI/CD risks can follow cases like this on daily.dev."}}]} ```