Cyber Security Trends 2026: Social Engineering, Old Vulns, New Risks

The 2026 Threat Landscape: What's Actually Happening

As we close out August 2026, the threat landscape reveals three critical trends that every business owner and IT manager needs to understand: social engineering attacks are evolving faster than defenses, attackers are weaponizing decade-old vulnerabilities at scale, and the attack surface keeps expanding in unexpected ways. Let's break down what's happening right now and what you need to do about it.

Social Engineering 3.0: TerminalFix and the New ClickFix Variants

Microsoft just disclosed details of TerminalFix, a new ClickFix variant that uses fake Cloudflare CAPTCHAs to trick users into running malicious commands directly in Windows Terminal or PowerShell. This isn't your typical phishing email with a suspicious attachment—it's a sophisticated social engineering attack that exploits user trust in legitimate services.

Here's why this matters: TerminalFix represents the evolution of social engineering beyond simple credential theft. Instead of trying to bypass technical controls, attackers are convincing users to actively execute malicious code themselves. The fake CAPTCHA looks legitimate, the instructions seem reasonable, and the victim becomes an unwitting accomplice.

What to do:

• Train your team to never paste commands into terminals or PowerShell from web pages, even if they appear to come from trusted services like Cloudflare
• Implement application whitelisting to prevent unauthorized PowerShell execution
• Deploy endpoint detection and response (EDR) tools that can flag suspicious terminal activity
• Consider disabling PowerShell for users who don't need it for their daily work

The Old Vulnerability Problem: Why Legacy Flaws Still Matter

CISA's Known Exploited Vulnerabilities catalog tells a troubling story this week. Among the recently added CVEs are vulnerabilities from 2015, 2019, and 2021—some over a decade old—that are now under active exploitation:

• CVE-2015-3246 and CVE-2015-5287: Red Hat Libuser and ABRT vulnerabilities from 2015
• CVE-2019-1068: Microsoft SQL Server RCE from 2019
• CVE-2021-23758: Ajax.NET Professional deserialization flaw from 2021

Attackers aren't always chasing zero-days. They're scanning the internet for organizations that haven't patched known vulnerabilities, and they're finding plenty of targets.

The ownCloud improper authentication vulnerability (CVE-2023-49105) added to CISA's list this week is a perfect example. This is a critical flaw in widely-deployed file sharing infrastructure that gives attackers unauthorized access—and organizations are still running vulnerable versions.

What to do:

• Inventory all your systems, including legacy applications and forgotten servers
• Cross-reference your software versions against CISA's KEV catalog monthly
• Prioritize patching KEV-listed vulnerabilities immediately—these are confirmed as actively exploited
• If you can't patch, isolate vulnerable systems or implement compensating controls
• Consider decommissioning end-of-life systems that no longer receive security updates

WordPress and Plugin Security: The Supply Chain You Forgot About

This week brought news of five critical WordPress plugin and theme flaws affecting WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These vulnerabilities enable authentication bypass and remote code execution—complete site takeover territory.

WordPress powers over 40% of all websites, and most organizations don't think of their WordPress plugins as part of their supply chain. But that's exactly what they are. Each plugin is a third-party component with its own security posture, development practices, and vulnerability history.

What to do:

• Audit all WordPress installations across your organization, including marketing sites and forgotten blogs
• Remove unused plugins immediately—every plugin is attack surface
• Enable automatic updates for plugins where possible, but test in staging first
• Subscribe to security advisories for your critical plugins
• Consider WordPress-specific security plugins or web application firewalls

Privacy and Data Handling: The Compliance Reality Check

An Ars Technica investigation this week tested 100 companies' responses to data access requests under privacy laws like GDPR and CCPA. The results? Confusion, dead ends, and in some cases, companies simply deleted the data instead of providing it. This reveals a fundamental problem: many organizations still don't have proper data governance processes in place.

For security professionals, this matters because you can't protect data you don't know you have. Poor data governance creates security risks, compliance violations, and incident response nightmares.

What to do:

• Document where personal data lives in your systems—databases, backups, logs, and third-party services
• Implement data retention policies and actually enforce them
• Test your data access request process before a regulator does
• Ensure your incident response plan includes data breach notification procedures
• Review third-party data processing agreements annually

Emerging Threats: What's Coming Next

Several 2026 CVEs in CISA's KEV catalog point to actively exploited zero-days discovered just this month:

• CVE-2026-53362: Linux Kernel vulnerability
• CVE-2026-66384: JFrog Artifactory path traversal
• CVE-2026-8452: Citrix NetScaler ADC/Gateway memory buffer flaw
• CVE-2026-60004: Gitea code injection
• CVE-2026-21962: Oracle HTTP Server/WebLogic access control issue

The speed from disclosure to active exploitation continues to shrink. The window for defensive action is measured in days, not weeks.

Building Resilience: The 2026 Security Posture

The threat landscape of 2026 demands a layered defense strategy:

1. Assume breach: Design your network assuming attackers are already inside
2. Prioritize ruthlessly: You can't fix everything—focus on CISA KEV vulnerabilities and internet-facing systems first
3. Human firewall: Your users are both your biggest vulnerability and your best sensor network—train them well
4. Visibility matters: You can't defend what you can't see—comprehensive asset inventory and logging are foundational
5. Test your defenses: Regular penetration testing reveals gaps before attackers do

The good news? Most successful attacks exploit known vulnerabilities and rely on social engineering. These are preventable with consistent execution of security fundamentals.

If you need help assessing your current security posture or want to test your defenses against 2026's threat landscape, Vici Tech Solutions offers comprehensive penetration testing and security assessments tailored to your specific risk profile.