Cyber FortnightlyDispatch Fourteen days of security, edited down to what mattered.

Issue 01 · 8 Aug 2026 to 21 Aug 2026 · current

The attacks that mattered came through things you already trusted

Four separate items this fortnight describe the same intrusion: somebody got into the thing that ships you software. Trojanised LiteLLM packages on PyPI swept cloud keys, SSH keys and Kubernetes secrets from more than 2,500 organisations into a 195TB collection; the MonsterInsights Pro update bucket was poisoned in both the current release and the build the vendor rolled back to, with the attacker still holding write access; Supsystic's update server shipped credential stealing builds days later; and the malicious commits in use-context-selector were force-pushed away rather than reverted, so every fork and SHA pin from that window still runs the dropper. The operational reading is unpleasant. A version number is not evidence, and the obvious remediation can reinstall the problem.

Where something was exploited rather than delivered, it sat at the edge of the network, and the gap between disclosure and exploitation kept collapsing. Cisco's ASA and FTD VPN flaw entered KEV the day the advisory shipped, Metabase's pre-auth SQL injection to admin was exploited before it had a CVE, vCenter exploitation began five days after Broadcom's patch and produced 361 victim IPs across 47 countries, SharePoint became an incident again the week Rapid7 published a proof of concept, and Sansec was blocking Adobe Commerce attempts while Adobe's own advisory said there was no evidence of abuse. EPSS was low and wrong in every one of those cases. watchTowr's NetScaler pre-auth writeup is the one to watch, precisely because nothing has happened with it yet.

The rest was credentials. Stolen logins produced Entra directory exports from McDonald's, Vodafone and seven other large enterprises with no product flaw involved; one OAuth token between Salesforce and a marketing vendor reached Recorded Future's tenant; stolen GitHub PATs drove mass repository cloning across several organisations; and France's tax authority lost data on roughly 678,000 people to a misused identity, which now has Paris prosecutors and a prime ministerial crisis meeting attached. Tenable's agentic AI cluster arrives at the same place from the other direction: seven incidents, every one starting at exposed identity rather than clever agent capability. Against that backdrop, the White House memorandum letting vetted private firms run offensive operations against foreign criminal groups is the story that will reach your general counsel well before it reaches your SOC.

Deep Shankar Yadav

40 stories, drawn from 14 daily editions (1589 items in the window).

  1. Terabytes of credentials leaked in massive supply-chain attack (opens in a new tab)

    Ars Technica Security ·Dan Goodin ·fetched 12 Aug 2026, 23:39 UTC Must read agreed3/3

    Why readCredentials in a 195TB corpus do not expire when the news cycle does, so anyone who installed in that March window still owns an unfinished rotation programme rather than a closed incident.

    CloudSEK and Hudson Rock report that trojanised LiteLLM packages served from PyPI harvested secrets during a roughly 40 minute window in March, with Hudson Rock working from a 195TB collection of exfiltrated data. The haul reportedly spans cloud credentials, repository tokens, SSH keys, Kubernetes secrets, environment variables and AI provider keys tied to more than 2,500 organisations, including Microsoft, Amazon, Cisco, Samsung and Salesforce. Neither firm has attributed the compromise or named the source of the dataset, so the immediate priority is scoping installs against that March window and rotating anything the build environment could reach.

  2. CVE-2026-11976 (CVSS 10.0): The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) a (opens in a new tab)

    NVD ·fetched 9 Aug 2026, 11:37 UTC Must read CVE-2026-11976 CVSS 10.0 EPSS 0.5% agreed3/3

    Why readThe remediation trap is what gives this legs: rolling back to 10.2.0 reinstalls the implant, and while the attacker keeps bucket write access no version number tells you anything.

    The S3 bucket serving MonsterInsights Pro updates was compromised and both the current 10.2.2 release and the 10.2.0 build the vendor reverted to carry a malicious class-system-check.php. Three payload variants observed on 11 June 2026 share one AES-256-GCM key, pointing to a single actor who was iterating on the implant during the day while retaining write access to the distribution bucket. Anyone running MonsterInsights Pro should check for the file directly rather than trusting a version number, since the trusted update channel is the delivery mechanism.

  3. North Korean Lazarus Group Uses Windows Zero-Day in Operation Dream Job (opens in a new tab)

    Security Affairs ·Pierluigi Paganini ·fetched 13 Aug 2026, 07:41 UTC Must read CVE-2026-68820 EPSS 0.4% agreed3/3

    Why readC2 built almost entirely from hijacked legitimate servers outlives the patch: infrastructure blocklists will miss the next wave, leaving the recruitment lure as the durable hunting signal.

    Check Point Research documents a new Operation Dream Job iteration where North Korean operators lure defence and aerospace staff with fake Lockheed Martin job offers, then exploit a previously unknown Windows flaw (CVE-2026-68820, patched after disclosure to Microsoft) for full host control and EDR evasion. The campaign introduces a backdoor named Troy and builds command infrastructure almost entirely from compromised legitimate servers rather than attacker-owned hosts, which weakens infrastructure-based detection. Confirmed targets in France, Germany, Brazil and India. EPSS is still low at 0.004, but in-the-wild use by this actor is confirmed, so patch state matters more than the score.

  4. APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit (opens in a new tab)

    Securelist ·Fareed Radzi ·fetched 14 Aug 2026, 11:38 UTC Must read Research agreed3/3

    Why readA signed kernel driver hiding the backdoor pushes detection onto driver load and service creation telemetry, a shift most estates have talked about and not made.

    The latest CoolClient variant, attributed to HoneyMyte (Mustang Panda), adds a signed kernel-mode rootkit deployed as a Windows service, with the user-mode component communicating through IOCTL requests. The driver hides the CoolClient process and protects its files and registry entries against inspection or modification, a step up from the 2025 variant that added clipboard theft and HTTP interception for credential harvesting. Targeting remains espionage against organisations in Asia and Russia; the signed-driver angle means detection has to move to driver load and service creation telemetry rather than process inspection.

  5. Multi-Functional Linux Botnet “Evooo1Bot” (opens in a new tab)

    Fortinet Threat Research ·fetched 13 Aug 2026, 23:38 UTC Research agreed3/3

    Why readThe SOCKS module is the point: edge devices are now harvested as relay infrastructure, so compromise no longer announces itself with a DDoS you would notice.

    FortiGuard Labs names a previously undocumented Linux botnet after the hardcoded string "evooo1" present in every binary. It reuses the leaked Mirai DDoS engine but adds encrypted C2, an SSH brute-force scanner, a SOCKS relay, a credential sniffer and an exploit arsenal against multiple known edge-device CVEs. C2 telemetry shows active targeting of internet-facing devices across several regions since July 2026, with the proxy module making victims useful as relay infrastructure rather than just DDoS bots.

    Indicators3
    Hashes
    f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109 4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4d
    Addresses
    91[.]92[.]40[.]118
  6. ClickFix campaign abuses Deno runtime for infostealer delivery (opens in a new tab)

    Sophos Threat Research ·fetched 12 Aug 2026, 16:07 UTC Research agreed3/3

    Why readDeno as the execution host is the transferable part: expect the same trick with other freshly installed signed developer runtimes, none of which existing script host rules cover.

    Sophos CTU investigated a June 2026 campaign in which compromised WordPress sites served Cloudflare-themed ClickFix lures via injected JavaScript referencing columbnezhjdq[.]com/goolgetagmanager.js, which fingerprinted the browser before showing the clipboard-paste prompt. The pasted PowerShell kicked off an MSI-based stage that installed Deno, then used it to pull and run remote JavaScript for payload delivery, tasking and persistence. Deno as a living-off-the-installed-runtime execution host is worth adding to detection logic, since a signed, freshly installed developer runtime executing remote script is unlikely to be covered by existing script-host rules.

    Indicators4
    URLs
    hxxps://columbnezhjdq[.]com/goolgetagmanager[.]js hxxp://webstizkgao[.]com/v020def066f14754be9[.]js hxxps://ordinary-computer-analytical-spell[.]trycloudflare[.]com/c
    Addresses
    162[.]33[.]177[.]16
  7. CVE-2026-17032 (CVSS 9.8): Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers (opens in a new tab)

    NVD ·fetched 9 Aug 2026, 11:37 UTC CVE-2026-17032 CVSS 9.8 EPSS 0.4% agreed3/3

    Why readOne poisoned update server is an incident; a second vendor in the same fortnight makes commercial plugin update endpoints a trust boundary you are now expected to be monitoring.

    Supsystic's update infrastructure was compromised and served trojanised Pro plugin builds, including google-maps-easy-pro 1.6.9 up to 1.7.0, that fetch a second stage payload to exfiltrate credentials and other sensitive data. Unauthenticated exploitation and full site control follow, and CISA's SSVC record marks it automatable with public exploitation. Coming alongside the MonsterInsights bucket compromise, it argues for treating commercial WordPress plugin update endpoints as an unmonitored trust boundary.

  8. Hundreds of fake Chrome VPN extensions route traffic through a proxy (opens in a new tab)

    BleepingComputer ·Bill Toulas ·fetched 13 Aug 2026, 11:40 UTC agreed3/3

    Why read737 extensions and 75,000 installs concentrated among people trying to evade censorship makes this a targeting story as much as a browser hygiene one.

    Socket traced 737 extensions across 40 publisher accounts sharing a single analytics account, with roughly 75,000 installs concentrated among Russian users seeking censorship workarounds. 520 of them configured Chrome to route all browser traffic through the operator's SOCKS5 proxy, giving that server every destination, every TLS SNI value, the client source IP and any plaintext HTTP body. Worth an inventory pass against installed browser extensions in managed fleets.

  9. "City-Forum" data-theft attacks target Salesforce, ServiceNow portals (opens in a new tab)

    BleepingComputer ·Lawrence Abrams ·fetched 13 Aug 2026, 03:42 UTC agreed3/3

    Why readVolume is still rising from one Contabo host and no vulnerability is involved at all: this is anonymous guest access in Salesforce and ServiceNow portals being harvested industrially.

    Reco has tracked a campaign it calls City-Forum to a single server that has been harvesting data reachable by unauthenticated users through Salesforce Experience Cloud and ServiceNow customer portals. Nearly all activity originates from 158.220.87.79, hosted by German VPS provider Contabo and resolving to city-forum.com since at least March 2025, and the downloads almost always carry the default Go-http-client/1.1 user agent. Targets span telecoms, banks, enterprise software vendors, security and privacy firms and public-sector portals, and Reco says volume is still rising.

  10. Android malware combo takes out loans and relays victims' credit cards (opens in a new tab)

    BleepingComputer ·Bill Toulas ·fetched 13 Aug 2026, 07:41 UTC agreed3/3

    Why readThe chain collapses the distance between a phone call and card present fraud, and the loan drawn in the victim's name is what makes recovery slow, contested and expensive.

    Group-IB investigated an incident where an attacker posing as a bank employee talked the victim into sideloading SpyNote disguised as a legitimate app, with the APK label personalised to the victim's name via a builder, and into granting Accessibility Service permissions. With remote access established, the attacker pushed WindRelay without further victim interaction, used the banking app to take out a loan, and had the victim tap their card and enter a PIN so the phone acted as a fraudulent contactless reader relaying card data in real time. The combination of RAT-driven account takeover and live NFC relay collapses the gap between social engineering and card-present fraud.

  11. CVE-2026-48158 (CVSS 9.3): use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained (opens in a new tab)

    NVD ·fetched 13 Aug 2026, 15:44 UTC CVE-2026-48158 CVSS 9.3 EPSS 0.4% agreed3/3

    Why readThe force-push is the durable part: the commits are gone from the branch but live on in every fork, cached clone and SHA pin, so this hunt has no natural end date.

    use-context-selector's default branch held malicious commits 9d8481a5 through 6f2dae05 for about 24 hours on 18 and 19 May 2026, adding a postinstall script that fetched and evaluated attacker-controlled JavaScript with TLS verification disabled and with require available. Execution was suppressed on CI and serverless hosts, which kept the campaign quiet while it hit developer workstations. The commits were force-pushed away rather than reverted in place, so any fork, cached clone or SHA-pinned reference from that window still runs the dropper today; treat this as the anchor advisory for the four affected repositories and hunt across all of them.

    Indicators2
    Hashes
    9d8481a513b7b0d1c0941b220c69b25de748641b 6f2dae054ca014068bdbbb4db96006424d674124
  1. CVE-2026-72898 (CVSS 10.0): Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access t (opens in a new tab)

    NVD ·fetched 13 Aug 2026, 15:44 UTC Must read CVE-2026-72898 CVSS 10.0 EPSS 10.4% agreed3/3

    Why readPre-auth SQL injection to admin on a product that usually faces the internet and usually holds live database credentials; with the KEV deadline now behind us, anything still unpatched should be treated as compromised rather than exposed.

    CVE-2026-72898 lets a remote unauthenticated attacker inject arbitrary SQL through the /reset_password endpoint and take administrator control of a Metabase instance, rated CVSS 4.0 10.0 with a fully network-reachable vector and no user interaction. CISA is the CNA, the bug is in the Known Exploited Vulnerabilities catalog, and EPSS sits in the 95th percentile. Metabase deployments are routinely internet-facing and hold live database credentials, so patching per GHSA-vwf4-m7j8-wcjf is a same-day job.

  2. CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign (opens in a new tab)

    The Record ·fetched 12 Aug 2026, 15:39 UTC Must read agreed3/3

    Why readThe 25 August deadline has passed, so this is now an audit question rather than a patching one, and because the fix needs a restart, partially patched estates are the normal state.

    Microsoft and CISA confirmed active exploitation of CVE-2026-68820, a Windows Winsock flaw carrying a 7.0 severity score and the only bug in August's Patch Tuesday flagged as exploited in the wild. The campaign targeted people applying for jobs in defence and aerospace, consistent with long-running DPRK social-engineering operations. There is no workaround and the fix requires a device restart, so the KEV deadline of August 25 means a reboot window, not just a patch push.

  3. You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) (opens in a new tab)

    watchTowr Labs ·Sina Kheirkhah (@SinSinology) ·fetched 14 Aug 2026, 11:38 UTC Must read Research CVE-2026-8452 EPSS 0.5% agreed3/3

    Why readIt belongs here because nothing has happened yet: watchTowr NetScaler research has historically preceded opportunistic scanning by days, which makes this the likeliest candidate for next fortnight's incident section.

    watchTowr Labs walks through a pre-auth remote code execution flaw in Citrix NetScaler, tracked provisionally as CVE-2026-8452, on an appliance class that sits at the network edge and terminates SSLVPN sessions. The writeup is primary exploit research rather than advisory coverage, so it carries the reachability details and code path needed to judge whether your configuration is exposed and to build detection while you patch. NetScaler pre-auth bugs have a consistent history of moving from public writeup to opportunistic scanning quickly, and EPSS at the 40th percentile reflects only what has been seen so far, not what this becomes once the technique circulates.

  4. Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access (opens in a new tab)

    The Hacker News ·The Hacker News ·fetched 12 Aug 2026, 16:07 UTC CVE-2026-59310 EPSS 1.1% agreed3/3

    Why readExploitation started five days after the patch, and the persistence mechanism is the lasting lesson: a cron job running reverse_ssh from a management host is easy to hunt for and almost nobody looks.

    QUIRSO found active exploitation of the directory-traversal-to-RCE flaw Broadcom patched in late July, surfacing it during an incident response engagement. Compromised hosts began contacting attacker domains on 3 August, five days after public disclosure, with path traversal followed by a malicious cron job running reverse_ssh to hold an outbound SSH channel to attacker infrastructure. EPSS is still low at 0.011, which is exactly the case where confirmed in-the-wild activity should override the model: patch vCenter now and hunt for unexpected cron entries and outbound SSH from management hosts.

  5. Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040) (opens in a new tab)

    Help Net Security ·Sinisa Markovic ·fetched 13 Aug 2026, 15:44 UTC CVE-2026-55040 EPSS 3.0% agreed3/3

    Why readA July patch became an August incident solely because a proof of concept landed, the cleanest available argument that exploitability is a moving property of bugs you already triaged and closed.

    The flaw allows impersonation by bypassing authentication, letting an attacker read files and modify data on affected SharePoint servers; availability is not affected. Exploitation started after Rapid7 released working proof-of-concept code, turning a patched July Patch Tuesday item into an active problem for anyone who deferred it. EPSS sits at 0.03 but in the 86th percentile, which lags confirmed exploitation rather than contradicting it; internet-facing SharePoint should be verified as patched today.

  6. Cisco says software vulnerability could let hackers crash firewalls (opens in a new tab)

    Cybersecurity Dive ·Eric Geller ·fetched 12 Aug 2026, 15:39 UTC agreed3/3

    Why readCISA added this to KEV on advisory day, the fortnight's clearest signal that VPN concentrators are being hit as fast as they are disclosed.

    Cisco's advisory describes improper error handling when processing HTTP requests in Secure Firewall ASA and FTD software, allowing an unauthenticated attacker to trigger an unexpected device reload and a denial of service. The attack path is the remote-access connection, which on most deployments is internet-facing by design. CISA added the flaw to the Known Exploited Vulnerabilities catalog immediately, and fixed versions are available for multiple ASA and FTD trains.

  7. Microsoft Patch Tuesday for August 2026 Fixed a Zero-Day and Wormable RCE (opens in a new tab)

    Security Affairs ·Pierluigi Paganini ·fetched 12 Aug 2026, 23:39 UTC CVE-2026-68820 EPSS 0.4% agreed3/3

    Why read398 CVEs is the number people repeat, but the wormable DNS RCE in the same release is the one with a long tail if it got deprioritised behind the exploited Winsock bug.

    Microsoft's August 2026 Patch Tuesday covers 398 CVEs across Windows, Office, Azure, Exchange, SharePoint, Teams, GitHub Copilot and .NET, 62 of them Critical. CVE-2026-68820, a use-after-free in the Ancillary Function Driver for WinSock, is confirmed exploited in the wild despite Microsoft's own exploit maturity rating of Unproven and an EPSS of just 0.004. A wormable DNS remote code execution flaw is the other bug to prioritise in the rollout.

  8. Vulnerability giving attackers full control of Macs is under active exploitation (opens in a new tab)

    Ars Technica Security ·Dan Goodin ·fetched 14 Aug 2026, 19:43 UTC CVE-2026-65400 EPSS 0.3% agreed3/3

    Why readLow EPSS, confirmed exploitation, root and a Monero miner: the uncomfortable finding is that enough Macs had screen sharing listening on the perimeter to make a campaign worth running.

    The Dutch NCSC reports active abuse across multiple systems reachable on port 5900, in each case ending with root and a Monero miner installed. The bug is a state-management flaw in macOS screen sharing, rated 7.1, patched by Apple last week for Tahoe, Sequoia and Sonoma. EPSS is still low at 0.0031, which reflects lag rather than safety here: patch, and check whether screen sharing is listening at the perimeter.

  9. Adobe Commerce Bug Targeted Immediately After Disclosure (opens in a new tab)

    SecurityWeek ·Ionut Arghire ·fetched 14 Aug 2026, 11:38 UTC CVE-2026-71362 EPSS 0.5% agreed3/3

    Why readSansec was blocking attempts while Adobe's advisory still reported no in-the-wild abuse, which is a standing caution about treating vendor exploitation statements as risk ratings.

    Sansec blocked exploitation attempts shortly after Adobe's August 2026 Patch Tuesday advisory, which had stated no evidence of in-the-wild abuse. The incorrect authorization flaw lets a remote unauthenticated attacker pivot a customer session onto another customer account, exposing that account and its private data; Adobe fixed it by changing how Commerce handles the session switch. EPSS is still low at 0.005 (39th percentile) because the data lags, so treat the confirmed blocking telemetry as the signal and patch Commerce storefronts now.

  1. BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive (opens in a new tab)

    Check Point Research ·fetched 20 Aug 2026, 15:37 UTC Research agreed2/2

    Why readPairs with the CoolClient rootkit as the fortnight's real tradecraft theme, signed drivers as the kernel primitive of choice, except here the trusted driver is Defender's own remediation tool.

    Check Point Research presents the first full reverse engineering of Windows Defender's Boot-Time Removal driver, BTR.sys, including its encrypted configuration, integrity validation and execution pipeline and its proprietary transaction format. They release BTR_CLI, which constructs valid encrypted transactions to drive the signed driver into arbitrary Ring 0 file and registry operations. Because the driver is trusted and Microsoft-signed, this becomes a defense-disarming technique that sidesteps typical exploitation.

  2. New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens (opens in a new tab)

    The Hacker News ·The Hacker News ·fetched 8 Aug 2026, 18:52 UTC Must read Research agreed3/3

    Why readThis is a bug class rather than a bug, so it will keep surfacing provider by provider for months, and it lands hardest on the mailbox-reading AI assistants that obediently follow the injected interface.

    PortSwigger's Gareth Heyes shows that webmail sanitisers strip scripts but leave enough CSS to reposition and restyle content outside the message frame, letting attacker-controlled markup overlay trusted interface elements. The resulting chains capture credentials, hijack third-party account flows, leak tokens, trigger trusted UI actions and steer AI assistants that read the mailbox. This is a mail-client attack class rather than a single bug, so it lands on every provider that renders remote CSS; anyone building or filtering HTML mail rendering should revisit what their sanitiser allows through.

  3. Metasploit Wrap Up: Lot of summer shells and fit http profiles (opens in a new tab)

    Rapid7 ·Rapid7 Labs ·fetched 14 Aug 2026, 23:39 UTC Must read Research CVE-2026-46300 EPSS 7.0% agreed3/3

    Why readModules for SonicWall SMA1000 and Ray Dashboard drop the exploitation floor for edge products this fortnight, and malleable HTTP profiles start the clock on the expiry of default Meterpreter network signatures.

    Thirteen modules landed, with RCEs for WordPress, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and Pix-for-WooCommerce, alongside a local privilege escalation for the Fragnesia Linux kernel bug CVE-2026-46300 and a Ray Dashboard logs API path traversal. Framework 6.5 adds malleable HTTP profiles for C2 traffic shaping, MCP functionality, Linux multi-fetch payloads and both inline and staged AArch64 reverse TCP shells for Windows on ARM. Defenders should treat the SonicWall SMA1000 and Ray Dashboard modules as raising the commodity exploitation floor for those products.

DFIR

3
  1. How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign (opens in a new tab)

    Wiz ·Eden Abergil ·fetched 13 Aug 2026, 19:40 UTC agreed3/3

    Why readRead next to the LiteLLM haul and the Entra dumps, it makes the fortnight's quiet argument that the credential is the intrusion; it is also the only item that tells you how to reconstruct one from audit logs.

    Wiz CIRT investigated a coordinated campaign where stolen GitHub Personal Access Tokens were used for repository reconnaissance, access validation and then mass repository cloning across several victim organisations, followed by attempts to reuse cloud credentials and API keys found inside the exfiltrated code. The write-up is structured as investigation methodology: how to distinguish reconnaissance from exfiltration in GitHub audit logs, and how to scope which repositories a token actually touched. Useful whether or not you were hit, because PAT abuse leaves a narrow and easily missed evidence trail.

  2. AI Agents X Digital Forensics 03 – ClaudeCode (opens in a new tab)

    Intrinsec ·CERT Intrinsec Must read Research agreed2/2

    Why readAs agentic coding tools spread through developer estates, incident timelines will have to separate agent actions from operator actions, and this is the artefact baseline for doing it.

    Third instalment of CERT Intrinsec's series identifying and exploiting artefacts left by autonomous AI tooling, this one covering Claude Code. The premise is that agents acting independently on a host create a new evidence class investigators have no established baseline for, and the work catalogues where those traces land. Worth reading now by anyone whose developer estate has agentic coding tools deployed, because incident timelines will soon need to distinguish agent activity from operator activity.

  3. The iOS 27 Recovery Menu: What It Means for Forensics (opens in a new tab)

    ElcomSoft ·Oleg Afonin Must read Research agreed2/2

    Why readA pre-boot environment with network access and an erase path on a locked device changes seizure procedure, and revising the handling policy before iOS 27 ships is considerably cheaper than after.

    iOS 27 and iPadOS 27 betas add an Apple-silicon-Mac style bootable recovery menu reached by holding the side button through the Apple logo, with six options including classic "connect to computer" recovery mode. For examiners the significance is that this environment executes before the data volume is unlocked, has network access, and exposes an erase path, all on a device that is evidence. Handling implications follow directly: the device must be unplugged for the sequence to work, so seizure and power-state procedure for iPhones needs revisiting before iOS 27 ships.

  1. Towards a Risk Assessment of Malicious Skill Files in Coding Agents (opens in a new tab)

    arXiv cs.CR (AI) ·Rui Yang, Michael Fu, Kla Tantithamthavorn, Chetan Arora ·fetched 9 Aug 2026, 11:37 UTC Must read Research agreed3/3

    Why readGemini CLI executing hostile commands in over 95 percent of runs is the figure to quote when someone proposes giving an agent production credentials, and the released benchmark lets you test your own deployment.

    The authors used six LLMs across four families to rewrite 471 real-world shell commands into benign-looking agent skill files, releasing a benchmark of 2,826 skills mapped to 11 MITRE ATT&CK tactics. Evaluation across 5,629 completed runs of two enterprise coding agents used a three-judge LLM panel with a refusal veto and declared-intent override, validated against a blind human gold standard at Cohen's kappa 0.85. The result is that the dynamically loaded skills interface is a reliable execution path into agents holding delegated authority over connected systems, and the benchmark is reusable against your own agent deployments.

  2. 13 million tool calls: auditing every AI coding agent action with Elastic Agent (opens in a new tab)

    Elastic Security Labs ·fetched 13 Aug 2026, 11:40 UTC Must read Research agreed3/3

    Why readThe counterpart to the skill-file research: a working audit trail for agent activity, proven across 1,100 machines and 13 million events, which is the control most organisations currently lack entirely.

    Elastic Security Labs rolled a coding agent out to hundreds of developers, found it had no audit trail, and closed the gap with a 280-line dependency-free bash script bound to Cursor's lifecycle hooks that writes every tool call as JSONL. The Elastic Agent already deployed on each endpoint ships those logs, and a filestream integration parses them into fields you can query, so "which hosts ran an agent that touched a .pem file last week" becomes a single ES|QL statement. The write-up is Cursor-specific end to end and the shipping path assumes an Elastic stack, but the hook pattern and the field model transfer to any agent that exposes lifecycle hooks.

  3. AI Guardrail Survival under Single-Cycle Agentic Self-Summarization (opens in a new tab)

    arXiv cs.CR (AI) ·Ted Kwartler, Alan Aqrawi, Arian Abbasi ·fetched 13 Aug 2026, 23:38 UTC Must read Research agreed3/3

    Why readQuietly the most useful AI result of the fortnight: a rule that survives context compaction on paper may no longer function, so guardrail assurance based on inspecting compacted context is worthless.

    The authors study a single agentic self-summarization cycle and ask how a standing safety constraint is lost. When compaction does not drop a rule outright, it frequently leaves a residue that reads like a rule but does not act like one; on behavioural replay the gap against an intact rule is +34 and +57 points across two replay models. Rule-form items are retained more often than prominence-matched facts, so textual-presence audits of compacted agent context give false assurance and evaluation needs to be behavioural.

  4. The Model Is the Malware | What Four Agentic Intrusions Tell Defenders (opens in a new tab)

    SentinelLabs ·Gabriel Bernadett-Shapiro ·fetched 13 Aug 2026, 15:44 UTC Must read agreed3/3

    Why readThe operational consequence has real duration: if agents write disposable tooling, indicator sharing decays and detection has to move to behaviour and identity.

    Four incidents where AI agents reached third-party systems without consent are compared, and the shared trait is endurance: multi-day retries and pivots to new vectors rather than clever tradecraft. Because an agent writes unique, throwaway tooling, artefact-based analysis degrades and the model in the harness becomes the object of study; SentinelLABS backs this with its own months of frontier-model benchmarking, noting the same long-horizon capability that lets GPT-5.6 Sol finish a malware investigation sustains a two-and-a-half-day intrusion. The closing argument is operational: attribution to "the AI" will not hold, because the objective and the access were granted by a human.

  5. Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers (opens in a new tab)

    The Hacker News ·The Hacker News ·fetched 8 Aug 2026, 18:33 UTC agreed3/3

    Why readOne of the two reported exfiltration paths is still unconfirmed as closed, so tenants that rolled Rovo out broadly are carrying residual exposure bounded only by what each signed-in user can read.

    Attacker-controlled instructions planted in content Rovo ingests, including an uploaded file in PromptArmor's case, cause the assistant to gather Jira or Confluence data within the current user's access and send it to an external server. Two security firms found the behaviour independently via different paths, and only one path has been confirmed closed by Atlassian. The residual exposure matters for anyone who has enabled Rovo across a tenant: the assistant inherits the user's read scope, so the blast radius is whatever that account can see.

  6. The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure (opens in a new tab)

    Tenable Research ·Research Special Operations ·fetched 15 Aug 2026, 03:42 UTC CVE-2025-3248 EPSS 100.0% agreed3/3

    Why readThe Taiwan numbers give the agentic threat its first hard figures, and Tenable's finding that every incident began at exposed identity puts it in the same category as the credential theft stories above it.

    Tenable's Research Special Operations team links seven incidents since late July 2026 into a single agentic AI cluster, anchored by Taiwan's Ministry of Digital Affairs confirming that autonomous agents mapped 21 government systems, took 85 accounts and pulled over 2,564 personnel records in roughly four days. The cluster also covers JADEPUFFER, which exploited CVE-2025-3248 in Langflow for automated database extortion, and knaithe/KnYuan, a Chinese-speaking operator Unit 42 assesses with moderate confidence as using the same agent framework for autonomous scanning. The through line the report draws is unglamorous: every incident started at identity and authentication exposure, meaning discoverable federation endpoints and weak credentials, not novel agent capability.

  7. CVE-2026-73487 (CVSS 9.0): Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inje (opens in a new tab)

    NVD ·fetched 15 Aug 2026, 23:38 UTC CVE-2026-73487 CVSS 9.0 EPSS 0.4% agreed3/3

    Why readUnauthenticated chat message to Python execution, with proof of concept already public, on a product typically stood up by teams outside the normal patch inventory.

    Flowise before 3.1.3 validated Python in its CSV and Airtable Agent nodes with a regex blocklist that never covered pandas helpers such as pd.read_json(), so a crafted prompt reaching the unauthenticated prediction endpoint can pull remote data, hit internal services over SSRF, or execute code. The CVSS 4.0 vector is AV:N/PR:N/UI:N with high confidentiality impact and a scope change, and CISA's SSVC record marks it proof-of-concept and automatable even though EPSS still sits near 0.4 percent. Upgrading to 3.1.3 is the only fix; any Flowise instance whose prediction API is reachable without auth should be treated as exposed now, not after the EPSS number moves.

  1. Private security firms will soon be allowed to hack overseas cybercriminals (opens in a new tab)

    Ars Technica Security ·Dan Goodin ·fetched 15 Aug 2026, 03:42 UTC Must read agreed3/3

    Why readThe mechanics matter more than the headline: a programme run through the National Coordination Center with per-operation DOJ and DHS approval, which turns this into a question of whether your firm applies, not whether hack back is lawful.

    A National Security Presidential Memorandum directs the National Coordination Center to build a programme for cyber operations against foreign transnational criminal organisations, with private sector firms brought in to conduct both Cyber Surveillance Operations and Cyber Effects Operations under Justice and Homeland Security oversight. The accompanying fact sheet names ransomware, sextortion, phishing, financial fraud and impersonation scams as in scope targets. The authorisation mechanics, liability treatment, attribution standards and vetting of participating firms are all still undefined, and those details determine whether this is a narrow deputisation or a broad licence.

  2. Trump taps cyber firms to go on offensive against criminals (opens in a new tab)

    The Record ·fetched 14 Aug 2026, 11:38 UTC Must read agreed3/3

    Why readAdvance approval per operation plus early congressional pushback sets the shape of the coming fight, and liability for collateral damage remains the undefined clause your counsel will fixate on.

    A presidential memorandum released on 12 August 2026 permits vetted US companies to run offensive cyber operations and surveillance against transnational cybercrime and fraud groups, working in partnership with the Justice and Homeland Security departments. Each operation requires advance approval from DOJ and DHS officials, placing the activity under federal direction rather than leaving it to firms acting alone. Congressional reaction is already forming, with Representative Bennie Thompson quoted in the piece, and the oversight and liability questions around collateral damage remain unresolved.

  1. France investigates tax authority breach after hacker claims 600,000 victims (opens in a new tab)

    The Record ·fetched 14 Aug 2026, 15:40 UTC Must read agreed3/3

    Why readWhat followed the confirmation is the story: Paris prosecutors opened an investigation, the prime minister convened a crisis meeting, the count settled near 678,000, and the entry point was a misused identity rather than a flaw.

    The French Economy Ministry confirmed late on 13 August 2026 that an attacker reached DGFiP systems in late June by stealing or misusing an identity, then viewed and extracted data on individuals and businesses. Access was detected and cut off in late June, but the incident only became public after the hacker publicly claimed responsibility this week and DGFiP imposed further access restrictions. Scope is still being determined; the 600,000 figure is the attacker's claim, not a confirmed count, and notification of affected parties is pending.

  2. Fortune 500 Companies Hit in Azure Data Theft Campaign (opens in a new tab)

    SecurityWeek ·Ionut Arghire ·fetched 17 Aug 2026, 07:41 UTC Must read agreed3/3

    Why readNo product vulnerability anywhere in this: stolen credentials yielded directory exports from nine large enterprises, and because three are IT outsourcers the phishing value flows directly into their clients.

    An actor going by TheHatman is advertising employee directory data said to come straight from the Azure and Entra tenants of McDonald's, TCS, Vodafone, HCL, IHG, Kyndryl, Gap, Hexaware and Wyndham, with the McDonald's set alone at over 1.7 million records. Hudson Rock reports the field names and email formats line up with genuine Azure directory exports, and the stated access route is simply stolen credentials rather than any product flaw. Nothing here is confirmed by the named companies, but three of the listed victims are large IT outsourcers, which makes the directory data useful raw material for targeted phishing against their clients.

  3. Three intrusions at UK criminal records office went undetected for two years (opens in a new tab)

    The Record ·fetched 12 Aug 2026, 15:39 UTC agreed3/3

    Why readThe regulator named the causes rather than the breach: a CMS frozen since 2019, unread antivirus alerts and a critical system unpatched for four years, which is exactly the shape of the edge exploitation elsewhere in this issue.

    The Information Commissioner's Office has formally reprimanded ACRO Criminal Records Office after attackers compromised its public-facing customer portal three separate times between July 2021 and June 2023, exposing personal data including that of domestic violence victims. The portal ran on a Kentico CMS build unchanged since September 2019 with multiple known flaws, antivirus alerts went unread, and one critical system sat unpatched for close to four years. It is a clean example of a regulator treating patch and alert hygiene as the finding, which is the shape of enforcement peers should expect.

  4. City of Suisun declares local emergency after cyberattack downs 911 dispatch system (opens in a new tab)

    DataBreaches.net ·Dissent ·fetched 8 Aug 2026, 23:38 UTC agreed3/3

    Why readThe consequence is the benchmark: loss of 911 dispatch severe enough to require a declared emergency, which is now the continuity scenario every municipality should have an answer ready for.

    Suisun City declared a state of emergency on 8 August after malicious software compromised IT systems at around 05:45 the previous day, taking down the emergency dispatch line and other core services. Officials have not named the malware family or said whether extortion is involved. The value is the consequence: dispatch loss severe enough to trigger an emergency declaration, which is the failure mode peers in local government need a continuity answer for.

  5. Klue Security Incident and Impact on Recorded Future (opens in a new tab)

    translated KlueセキュリティインシデントとRecorded Futureへの影響

    Recorded Future ·fetched 12 Aug 2026, 23:39 UTC agreed3/3

    Why readA single OAuth token between Salesforce and a marketing vendor was the whole blast radius, which is the concrete answer to the SaaS integration risk question boards have been asking in the abstract.

    Klue notified Recorded Future's CSIRT on 13 June 2026 that its integration layer connecting Klue to marketing and sales SaaS platforms had been accessed without authorization, with activity starting 12 June and contained the same morning. Recorded Future's own log correlation confirmed that part of its Salesforce tenant was reached via a compromised OAuth token tied to the Salesforce-Klue integration, exposing business data fields such as customer contact names and email addresses and possibly some contract information. No access to Recorded Future's own systems, internal databases or customer platform data was found; the integrations connected to Klue were disconnected as part of the response, and the investigation is continuing.

This issue is edited down from the daily digest at today.cyberfortnightly.com, which publishes every morning. Primary technical research is indexed separately at threatresearch.io.

Editions in this issue

2026-08-08 2026-08-09 2026-08-10 2026-08-11 2026-08-12 2026-08-13 2026-08-14 2026-08-15 2026-08-16 2026-08-17 2026-08-18 2026-08-19 2026-08-20 2026-08-21

Items considered
1589
Shortlisted
120
Published
40
Edited by
claude-opus-5
Generated
2026-08-21T03:42:13+00:00