A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

A collection of August 2026 cybersecurity reports covering active exploitation, ransomware, supply-chain compromises, credential and cryptocurrency theft, AI-agent prompt injection and data exfiltration, critical infrastructure intrusions, malicious developer packages and extensions, authentication bypasses, and high-impact product vulnerabilities. Notable incidents include an actively exploited unauthenticated Metabase SQL injection zero-day, CISA KEV-listed Kemp LoadMaster command injection CVE-2026-8037, ransomware attacks against critical infrastructure, malicious npm and WordPress supply-