Week of August 10, 2026: Ralph Lauren and Tricentis hire CISOs, and a Metabase zero-day exposes customer data

What mattered to security leaders in the week of August 10, 2026? Ralph Lauren hired John Opala and Tricentis hired Erika Dean as chief information security officers, while a zero-day in the Metabase business intelligence service let attackers reach customer data at laptop maker Framework, Tally Forms and Kilo Code. US and South Korean agencies also issued a #StopRansomware advisory on Gunra, and Microsoft's August release fixed a Windows driver flaw exploited by North Korean attackers.

Ralph Lauren and Tricentis name new CISOs

SecurityWeek's industry moves column for the week of August 10 reported two CISO appointments. John Opala joined Ralph Lauren as chief information security officer after serving as VP of IT and global CISO at Hanesbrands and at McCormick & Company. Tricentis appointed Erika Dean, formerly CSO and CISO at Robinhood, who also led security programs at Capital One. Both arrive with prior CISO experience. The records are on CISO Tribune: Opala and Dean. (SecurityWeek)

A Metabase zero-day exposes Framework, Tally and Kilo Code customers

Framework told customers that attackers exploited a zero-day in the Metabase business intelligence service to reach its cloud instance and take names, email addresses, phone numbers, physical addresses and login IP addresses, but not payment data. Tally reported exposed email addresses and password hashes, and Kilo Code said customer Slack access tokens were taken and invalidated. CISA added the flaw, CVE-2026-72898, a Metabase SQL injection bug, to the KEV catalog on August 11. BI tools often hold standing credentials to production databases, which is what made this one so damaging. (Help Net Security, CISA)

Joint #StopRansomware advisory profiles Gunra

On August 10 CISA, the FBI, the NSA, the Secret Service, the Defense Department's Cyber Crime Center and a South Korean partner released a joint advisory on Gunra, a ransomware-as-a-service variant used against healthcare, financial services, government and nonprofit organizations. Affiliates get in by exploiting CVE-2024-55591 and CVE-2025-24472 in internet-facing devices, then steal and encrypt data and threaten to publish it if victims do not pay within five to seven days. Both CVEs are old enough that exposure to them signals a patching gap on the perimeter. (CISA)

August Patch Tuesday fixes an AFD.sys zero-day used by North Korean attackers

Microsoft's August 2026 release covered more than 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock that lets a low-privileged local attacker reach SYSTEM. Check Point researchers said North Korean attackers used it to install a kernel-mode rootkit in a new wave of the Operation Dream Job campaign, and CISA listed it as exploited on August 11. Three other flaws had been publicly disclosed before the patches shipped. With 400-plus fixes in one month, triage by exploitation status matters more than ever. (Help Net Security, CISA)

Attackers knock Cisco firewalls offline with an unauthenticated request

Cisco confirmed that attackers were exploiting CVE-2026-20349, a high-severity flaw in the Remote Access SSL VPN service of Secure Firewall ASA and Firewall Threat Defense software, to make appliances reload and deny service. Devices are exposed when IKEv2 remote access VPN with client services, SSL VPN or ZTNA is enabled, and no authentication or user action is needed. Cisco's PSIRT learned of the exploitation in August 2026; federal agencies had until August 14 to fix it. A firewall that can be rebooted at will is also a VPN outage for every remote worker. (Help Net Security)

Valve notifies European Steam hardware buyers after a CEVA Logistics breach

Valve began emailing European customers on August 10 about a cyberattack between July 29 and August 1 on CEVA Logistics, which ships Steam hardware in Europe. Valve learned on August 7 that delivery details were likely taken: names, street addresses, phone numbers, Steam account email addresses and the type and price of hardware ordered. CEVA keeps such data for up to 90 days after an order and has no access to payment details or passwords. Shipping partners hold customer data that rarely shows up in vendor risk reviews. (Help Net Security)