Sunday, 9 August 2026

CVE-2026-11976 (CVSS 10.0): The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) a (opens in a new tab)

NVD ·fetched 9 Aug 2026, 11:37 UTC Must read CVE-2026-11976 CVSS 10.0 EPSS 0.5% agreed3/3

Why readThe version MonsterInsights rolled back to is also poisoned and the attacker still holds write access to the bucket, so the obvious remediation makes things worse.

The S3 bucket serving MonsterInsights Pro updates was compromised and both the current 10.2.2 release and the 10.2.0 build the vendor reverted to carry a malicious class-system-check.php. Three payload variants observed on 11 June 2026 share one AES-256-GCM key, pointing to a single actor who was iterating on the implant during the day while retaining write access to the distribution bucket. Anyone running MonsterInsights Pro should check for the file directly rather than trusting a version number, since the trusted update channel is the delivery mechanism.

nvd.nist.gov → (opens in a new tab)

CVE-2026-17032 (CVSS 9.8): Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers (opens in a new tab)

NVD ·fetched 9 Aug 2026, 11:37 UTC Must read CVE-2026-17032 CVSS 9.8 EPSS 0.4% agreed3/3

Why readA second WordPress plugin vendor's update server shipped credential stealing builds, which turns this from one incident into a pattern worth checking your whole plugin estate against.

Supsystic's update infrastructure was compromised and served trojanised Pro plugin builds, including google-maps-easy-pro 1.6.9 up to 1.7.0, that fetch a second stage payload to exfiltrate credentials and other sensitive data. Unauthenticated exploitation and full site control follow, and CISA's SSVC record marks it automatable with public exploitation. Coming alongside the MonsterInsights bucket compromise, it argues for treating commercial WordPress plugin update endpoints as an unmonitored trust boundary.

nvd.nist.gov → (opens in a new tab)

CVE-2026-14812 (CVSS 10.0): The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, a (opens in a new tab)

NVD ·fetched 9 Aug 2026, 11:37 UTC CVE-2026-14812 CVSS 10.0 EPSS 0.6% agreed3/3

Why readPremium SEO is not a plugin with a bug in it, it is malware, so the only remediation is removal and a hunt for the admin account it planted.

NVD has published CVE-2026-14812 against the Premium SEO WordPress plugin, but the record describes deliberately planted functionality rather than a coding defect: an unauthenticated backdoor that creates a hidden administrator account, with some builds adding remote code execution, SSRF and front end content injection. CISA's SSVC entry marks it automatable with public exploitation, and every version is affected because there is no clean release to move to. Sites that ever installed it should assume the hidden account exists and treat the host as compromised, not merely vulnerable.

nvd.nist.gov → (opens in a new tab)

AI widely used to exploit critical flaws, disrupt supply chains (opens in a new tab)

Cybersecurity Dive ·David Jones ·fetched 9 Aug 2026, 06:22 UTC agreed3/3

Why readCrowdStrike attaches named adversaries and a timeline to the claim that AI has collapsed the window between public PoC and exploitation.

The report puts China-nexus groups Vault Panda and Genesis Panda on AI-assisted exploitation of critical flaws inside 24 hours of a proof of concept landing, and credits North Korea-nexus Stardust Chollima with slipping a malicious npm package into 131 Mastra AI framework packages. The underlying trend is not new, but the named actors and the 24-hour figure give patch-prioritisation arguments something concrete to cite. Vendor telemetry with the usual caveat that the attribution and counts are unverified outside CrowdStrike.

cybersecuritydive.com → (opens in a new tab)

The Scam Will Go On: Beware of Fake Offers for Celine Dion Concert Tickets (opens in a new tab)

Group-IB ·fetched 9 Aug 2026, 07:41 UTC Research agreed2/3

Why readConcrete mechanics of how ticket fraud rings abuse legitimate platform features, resale transfer flows and hosted storefronts, rather than just spoofing brands.

Group-IB tracked a multi-stage fraud operation targeting buyers for Celine Dion's French tour dates. The crews seed themselves into fan communities for lead generation, then push victims to convincing clones of official ticketing sites; the notable part is the platform abuse, using Ticketmaster transfer behaviour to sell the same ticket to multiple buyers and standing up Shopify storefronts to inherit merchant legitimacy and payment plumbing. Useful as a reference pattern for any high-demand event, and for fraud teams who need to explain why brand-monitoring alone misses this.

group-ib.com → (opens in a new tab)

AI chat bots are sliding into League of Legends friend requests (opens in a new tab)

Malwarebytes Labs ·fetched 9 Aug 2026, 03:38 UTC agreed2/3

Why readDocuments scam accounts working the Riot client friends list within seconds of a match ending, a social engineering surface that sits outside anything most awareness programmes cover.

Malwarebytes describes a repeatable script in League of Legends: a friend request arrives moments after a match from a name that appeared in nobody's lobby, opens with generic praise about the player's performance, claims to have been on the enemy team when challenged, and eventually steers the conversation to an OnlyFans link. The account is built from one colleague's firsthand experience plus months of matching complaints on Reddit and gaming forums, so the volume claim is anecdotal rather than measured. The wider point is the migration of automated conversational lures from dating apps into game clients, where the friends list is an unfiltered inbound channel with no reporting maturity behind it.

malwarebytes.com → (opens in a new tab)

Attackers Exploit N-able Patch Bypass Flaw on RMM Servers (opens in a new tab)

Dark Reading ·Alexander Culafi ·fetched 9 Aug 2026, 07:41 UTC Must read CVE-2026-18577 EPSS 4.1% agreed3/3

Why readAn authentication bypass in N-able RMM servers, CVE-2026-18577, is being exploited after the original patch was found to be incomplete.

N-able discovered a second authentication bypass vector for CVE-2026-18577 over the weekend, granting attackers administrator access to RMM servers whose operators believed they were already patched. RMM infrastructure is a high-value pivot into every downstream managed endpoint, so a bypass of the earlier fix means re-patching rather than confirming patch status. EPSS sits at 0.041 but in the 90th percentile, and reported exploitation outranks that number.

darkreading.com → (opens in a new tab)

CVE-2022-4995 (CVSS 9.3): Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbi (opens in a new tab)

NVD ·fetched 9 Aug 2026, 23:43 UTC Must read CVE-2022-4995 CVSS 9.3 EPSS 0.7% agreed3/3

Why readConfirmed in-the-wild webshell uploads against Weaver E-cology 9.0 via an unauthenticated POST to /workrelate/plan/util/uploaderOperate.jsp, with Shadowserver exploitation evidence dating to October 2023.

Weaver (Fanwei) E-cology 9.0 before 10.52 accepts arbitrary file uploads, including JSP webshells, from an unauthenticated multipart/form-data POST to /workrelate/plan/util/uploaderOperate.jsp with any secId and plandetailid values, yielding RCE as the app server process. Shadowserver first observed exploitation on 2023-10-14, so any exposed instance should be assumed compromised rather than merely patched. The CVE is only now surfacing in NVD despite years of activity, which means detection backfill matters as much as upgrading to 10.52.

nvd.nist.gov → (opens in a new tab)

CVE-2026-64638 (CVSS 8.9): WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted (opens in a new tab)

NVD ·fetched 9 Aug 2026, 23:43 UTC Must read CVE-2026-64638 CVSS 8.9 EPSS 0.8% agreed3/3

Why readPre-auth reflected XSS on the WordPress login screen affecting every version, with a fix backported all the way to the 4.7 branch.

A specially crafted attacker-hosted page can trigger reflected XSS on the WordPress login screen without authentication, and under conditions outside the attacker's control it can be escalated to RCE; it requires the victim to be socially engineered into interacting. All WordPress versions are affected. 7.0.3 carries the fix and it has been backported to every branch back to 4.7, which is the notable part for the long tail of unmaintained installs. Found and disclosed by pwn.ai.

nvd.nist.gov → (opens in a new tab)

CVE-2026-70558 (CVSS 9.3): Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with (opens in a new tab)

NVD ·fetched 9 Aug 2026, 15:40 UTC Must read Research CVE-2026-70558 CVSS 9.3 EPSS 0.6% agreed3/3

Why readDinky ships a hardcoded default dinkyToken (efda1551-7958-4e0f-80a8-dfd107df3e38) guarding an unauthenticated arbitrary file write, and the write path leads to RCE via classpath shadowing.

POST /download/uploadFromRsByLocal passes the caller-supplied path straight to new File(path) and file.transferTo(dest) with no validation; the route is @SaIgnore and /download/** is excluded from the Sa-Token interceptor, so the only control is a header match against a token hardcoded in source and shipped to every deployment. The default Docker image listens on 8888 with no proxy and chmod 777 on /opt/dinky, making the classpath, launch scripts and static assets writable by the flink uid 9999. Demonstrated impact includes overwriting /opt/dinky/config/static/index.html to serve JavaScript to admin browsers and dropping /opt/dinky/org/dinky/Dinky.class for code execution at next JVM start via script/bin/auto.sh.

nvd.nist.gov → (opens in a new tab)

CVE-2026-19264 (CVSS 9.3): Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload dir (opens in a new tab)

NVD ·fetched 9 Aug 2026, 23:43 UTC CVE-2026-19264 CVSS 9.3 EPSS 0.6% agreed3/3

Why readFull unauthenticated takeover of self-hosted Postiz: URL-encoded traversal in the media route reads /proc environment, leaking the JWT secret used to forge non-expiring admin sessions.

Postiz serves locally stored media by joining URL-supplied path segments onto the upload directory with no normalisation, confinement or authentication. Raw dot-segments get collapsed before routing, but URL-encoded separators survive route matching and are decoded only at the handler, restoring traversal at the filesystem call. Reading the process environment exposes the JWT signing secret, database connection string and provider and billing secrets; because session tokens are signed with that secret and carry no expiry, an attacker forges a permanent administrator session without a password.

nvd.nist.gov → (opens in a new tab)

CVE-2026-48054 (CVSS 8.8): OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0 (opens in a new tab)

NVD ·fetched 9 Aug 2026, 15:40 UTC CVE-2026-48054 CVSS 8.8 EPSS 0.5% agreed3/3

Why readA shared wizard.openzeppelin.com URL can execute arbitrary Node.js on a developer's workstation the moment they run npx hardhat test on the downloaded scaffold.

OpenZeppelin Contracts Wizard before 0.10.9 interpolates user-supplied opts.name (ERC20/ERC721) and opts.uri (ERC1155) directly into TypeScript string literals at zip-hardhat.ts:48 and :50 with no JavaScript escaping. A crafted URL containing a closing quote plus require("child_process").execSync(...) lands in the generated test/test.ts, so code runs with the victim developer's OS privileges on first test run. No authentication needed, only that the target downloads and runs the zip; fixed in 0.10.9.

nvd.nist.gov → (opens in a new tab)

CVE-2026-5423 (CVSS 8.2): @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL sub (opens in a new tab)

NVD ·fetched 9 Aug 2026, 11:37 UTC CVE-2026-5423 CVSS 8.2 EPSS 0.3% agreed3/3

Why read@neo4j/graphql accepts a client-supplied pre-decoded JWT object over WebSocket connectionParams without verifying it, so anyone can forge sub and roles claims and read restricted subscription events.

In versions before 7.5.6, GraphQL-over-WebSocket clients can pass connectionParams.jwt as an already-decoded object, which the library trusts for @authentication and @subscriptionsAuthorization directive evaluation without checking the signature. An unauthenticated remote client can therefore claim arbitrary identity and roles and receive subscription events meant for privileged users. Fixed in 7.5.6+ and 5.12.14+; the v6 branch is end-of-life and will not be patched.

nvd.nist.gov → (opens in a new tab)

CVE-2026-70559 (CVSS 8.7): Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-l (opens in a new tab)

NVD ·fetched 9 Aug 2026, 15:40 UTC CVE-2026-70559 CVSS 8.7 EPSS 0.3% agreed3/3

Why readOne unauthenticated GET to Dinky's /api/sysConfig/getAll returns the full system configuration in cleartext, including LDAP, MinIO, DolphinScheduler and dinkyToken credentials.

A method-level @SaIgnore on SysConfigController.getAll() short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor never checks a session; any caller reaching port 8888 gets all 54 config entries on a stock v1.2.5 install. Only sys.maven.settings.repositoryPassword has a desensitization handler, leaving sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, the OSS accessKey and secretKey, and the DolphinScheduler token in plaintext. Bare installs leak shipped defaults including dinkyToken efda1551-7958-4e0f-80a8-dfd107df3e38 and minioadmin/minioadmin; configured installs leak live third-party credentials.

nvd.nist.gov → (opens in a new tab)

CVE-2026-71851 (CVSS 9.0): crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() usi (opens in a new tab)

NVD ·fetched 9 Aug 2026, 23:43 UTC CVE-2026-71851 CVSS 9.0 EPSS 0.3% agreed3/3

Why readQuantifies how badly crypto-js 3.x weakened randomness: a nominal 256-bit request yields roughly 2^47 of real search space, enough to brute-force BIP39 seeds.

CryptoJS.lib.WordArray.random() in every crypto-js release from 3.1.2-4 up to 4.0.0 uses a custom Multiply-With-Carry PRNG seeded from Math.random() rather than a CSPRNG. Requests for 128 and 256 bits of entropy collapse to effective spaces of about 2^39 and 2^47, enumerable on commodity hardware. Wallet software that used the function to derive BIP39 recovery phrases has recoverable private keys; audit any dependency tree still pinned to 3.x.

nvd.nist.gov → (opens in a new tab)

CVE-2026-48088 (CVSS 9.4): OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /a (opens in a new tab)

NVD ·fetched 9 Aug 2026, 15:40 UTC Research CVE-2026-48088 CVSS 9.4 EPSS 0.3% agreed3/3

Why readAn unauthenticated attacker can register their own ML-KEM-768 public key as an extra recipient for any tenant's encrypted appointments, and a JavaScript `undefined === undefined` comparison makes the bypass silent.

OpenReception before 1.0.4 accepts attacker-supplied ML-KEM-768 public keys at POST /api/tenants/{tenantId}/staff/{staffId}/crypto without authentication: the handler logs an "Unauthorized crypto key storage attempt" warning when neither session nor registration cookie is present, then inserts the row anyway. That breaks the platform's claim that even administrators cannot read sensitive data, since the attacker becomes an additional decryption recipient for future patient appointments. A second variant suppresses even the warning: the Zod schema marks `email` optional, so omitting it with no registration cookie makes the check `registrationEmail === email` evaluate `undefined === undefined` to true and the request is treated as legitimate.

nvd.nist.gov → (opens in a new tab)

CVE-2026-48087 (CVSS 9.8): OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration h (opens in a new tab)

NVD ·fetched 9 Aug 2026, 15:40 UTC Research CVE-2026-48087 CVSS 9.8 EPSS 0.5% agreed3/3

Why readA WebAuthn registration handler that validates the challenge against the cookie email but never against the `userId` in the URL, letting an attacker graft their own passkey onto any victim account.

In OpenReception before 1.0.2, POST /api/auth/register/{userId} checks that the WebAuthn challenge matches the registration cookie's email but never checks that the path `userId` belongs to that email. An attacker requests a challenge for their own address, completes the ceremony with their own authenticator, and replays the response against a victim's user ID; addPasskey writes the attacker credential into the victim's user_passkey rows and the next login as the victim's email issues them a session. Staff-list endpoints return user IDs to authenticated tenant members, so the identifier needed is not secret. The binding mistake generalises to any passkey enrolment flow.

nvd.nist.gov → (opens in a new tab)

CVE-2026-70636 (CVSS 8.7): Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh en (opens in a new tab)

NVD ·fetched 9 Aug 2026, 19:38 UTC CVE-2026-70636 CVSS 8.7 EPSS 0.4% agreed3/3

Why readPrefix-matching in Flowise's auth middleware lets an unauthenticated POST reach the OAuth2 credential refresh route, and it is a bypass of the earlier fix for CVE-2026-41273.

Flowise through 3.1.4 whitelists authentication exemptions by URL prefix in packages/server/src/utils/constants.ts, so appending a credential identifier to the oauth2-credential refresh path matches the exemption and skips all authentication and authorization checks. An unauthenticated attacker can force OAuth token rotation against credentials in any workspace, breaking dependent integrations. The pattern matters beyond this product: prefix-based route allowlists are a recurring source of these bypasses, and this one defeated a previous patch.

nvd.nist.gov → (opens in a new tab)

nodiuus/nocturne: A bin2bin code virtualizer for x86-64 PE's (opens in a new tab)

GitHub: new security tools ·nodiuus ·fetched 9 Aug 2026, 15:40 UTC Research ★ 170 agreed3/3

Why readOpen-source bin2bin code virtualizer for x86-64 PE files that rewrites chosen RVA ranges into a custom VM, usable without source access.

Nocturne takes a compiled PE and virtualizes either SDK-marked regions or an arbitrary address range given on the command line, for example cli.exe -i calc.exe -o calc_vmp.exe --mode rva 0x1600 0x1864, producing a binary whose selected code runs on a bespoke interpreter. Publicly available VM-based obfuscators of this kind are rare, and it gives reverse engineers a devirtualization target they can compare against known ground truth. The author describes it as a proof of concept and licenses it noncommercially under PolyForm, so treat stability and handler coverage as work in progress.

github.com → (opens in a new tab)

Quantum One-Way Functions and Related Cryptographic Primitives (opens in a new tab)

arXiv cs.CR (all) ·Georgios M. Nikolopoulos ·fetched 9 Aug 2026, 23:43 UTC agreed2/3

Why readA map of what a quantum analogue of the one-way function actually looks like, and why some of these primitives may survive assumptions that would kill classical cryptography.

The paper is a review, not new results, covering quantum one-way functions alongside one-way state generators, pseudorandom quantum states and efficiently indistinguishable state pairs, and clarifying how these primitives relate to one another. It separates computational from information-theoretic notions of quantum one-wayness and is explicit about the differing adversarial models behind each. The sections on physical realizability, noise robustness and open problems are the parts with any near-term bearing; nothing here changes what a practitioner deploys today.

arxiv.org → (opens in a new tab)

ClouGence/open-cdm: A free and open-source database management tool, suitable for team use. It offers capabilities such as access control, data anonymization, SQL auditing, CI/CD, and supports cross-regional deployment. (opens in a new tab)

GitHub: new security tools ·ClouGence ·fetched 9 Aug 2026, 07:41 UTC ★ 341 agreed3/3

Why readSelf-hosted database access gateway that puts RBAC, data masking, SQL auditing and change approval in front of production databases.

open-cdm gives teams a single web console over MySQL, Oracle, PostgreSQL, SQL Server, DB2, TiDB, ClickHouse, MongoDB, Redis and a long tail of others, with permissions grantable per instance, database, schema and table and scoped by statement type. It also covers data anonymisation, SQL review workflows, CI/CD integration and cross-region deployment. Useful if you currently hand out direct DBA credentials, but the README reads as a feature list and there is no security design detail or audit to judge the enforcement layer on.

github.com → (opens in a new tab)

Welcoming the Nepalese Government to Have I Been Pwned (opens in a new tab)

Troy Hunt ·Troy Hunt ·fetched 9 Aug 2026, 03:38 UTC agreed3/3

Why readNepal's NCSC becomes the 47th government with free HIBP domain monitoring, which matters if you work with or through that CERT.

Have I Been Pwned's free government service has onboarded Nepal's National Cyber Security Centre, giving it visibility into breached credentials across Nepalese government domains. The mechanism is unchanged from the previous 46 onboardings. Routine expansion news rather than anything that shifts practice.

troyhunt.com → (opens in a new tab)

flythenimbus/bramble: Local-first, encrypted password manager with private P2P mesh. (opens in a new tab)

GitHub: new security tools ·flythenimbus ·fetched 9 Aug 2026, 15:40 UTC ★ 298 agreed2/3

Why readA password manager that removes the vault server entirely, worth knowing exists if you are advising on self-hosted credential storage.

Bramble keeps the vault in browser extension storage or app private storage and syncs between a user's own devices peer to peer, with no account and no cloud copy to breach. It ships Chromium, iOS and Android clients sharing one Rust crypto core, with passkeys and biometric unlock on mobile. Treat it as an early project rather than a recommendation: at roughly 300 stars there is no public third party audit of the crypto core or the sync protocol, which is where designs like this usually fail.

github.com → (opens in a new tab)

One Adversary: The Moment Nobody Sees (opens in a new tab)

Group-IB ·fetched 9 Aug 2026, 11:37 UTC agreed2/3

Why readA tabletop exercise you can run in an hour: walk your last fraud case stage by stage and name whose telemetry contained each one, not who caught it.

Group-IB argues that in a phishing-to-fraud chain the early stages belong to cyber (look-alike domains, certificate transparency, lure distribution) and the late stages belong to fraud (anomalous device, session, money movement), while the credential capture moment in between has no owner. The ownership question is framed usefully, and the distinction between telemetry that contains an event and a team that acts on it is the part worth borrowing. It stops at the diagnosis: there is no detection logic, data source, or integration pattern offered for closing the gap, so read it as a framing piece from a vendor selling into that gap.

group-ib.com → (opens in a new tab)

2026-08-09: Traffic Analysis Exercise - First to Last (opens in a new tab)

Malware Traffic Analysis ·fetched 9 Aug 2026, 06:22 UTC Research agreed3/3

Why readA fresh pcap and SOC alert timeline to practise narrowing a FormBook infection to one host before you have to do it under pressure.

The exercise hands you a 12.8 MB capture from a 172.16.8.0/24 segment with an Active Directory controller at 172.16.8.2, plus a run of Emerging Threats FormBook CnC check-in alerts starting at 02:13 UTC across six separate destination IPs. The task is to work back from the alerts to the infected host, which exercises the exact pivot analysts fumble when C2 fans out across many addresses. Primary material rather than commentary, and reusable as internal tabletop content.

malware-traffic-analysis.net → (opens in a new tab)

2026-08-07: Seven days of scans and probes and web traffic hitting my web server (opens in a new tab)

Malware Traffic Analysis ·fetched 9 Aug 2026, 23:43 UTC Research agreed3/3

Why readA free 15.4 MB packet capture of seven days of unsolicited internet traffic against a live web server, useful as raw material for detection tuning and analyst practice.

Malware-Traffic-Analysis has posted a password-protected pcap covering a full week of scans, probes and opportunistic web requests aimed at the author's public web server. There is no accompanying writeup, so the value is entirely in the capture itself: a current, unfiltered sample of internet background radiation including exploit attempts against common web paths. Note the site has changed its archive password scheme, so check the about page before extracting.

malware-traffic-analysis.net → (opens in a new tab)

Forensic Early Case Assessment: is eDiscovery collecting the right data? (opens in a new tab)

Magnet Forensics ·HaadiyaAli ·fetched 9 Aug 2026, 03:38 UTC agreed2/3

Why readMakes the case for running forensic collection and validation before data enters eDiscovery review, and draws a clean line between scoping and early case assessment.

Magnet argues that early case assessment should include forensic collection, validation, and analysis rather than treating collected data as a given and optimising only for review speed. The useful distinction is between scoping, which sets the boundaries of custodians, sources, systems, and timeframes, and assessment, which tests whether the data actually captured within those boundaries is complete and defensible. The practical payoff is avoiding recollection, reprocessing, and revised timelines late in a matter, and building a documented record from the first collection onward. It is a vendor practice piece, so read it for the workflow argument rather than for tooling claims.

magnetforensics.com → (opens in a new tab)

Towards a Risk Assessment of Malicious Skill Files in Coding Agents (opens in a new tab)

arXiv cs.CR (AI) ·Rui Yang, Michael Fu, Kla Tantithamthavorn, Chetan Arora ·fetched 9 Aug 2026, 11:37 UTC Must read Research agreed3/3

Why readMeasures how often coding agents execute hostile shell commands hidden in skill files: Gemini CLI is exploited in 95.5-96.1 percent of runs, Qwen Code in 71.6-74 percent.

The authors used six LLMs across four families to rewrite 471 real-world shell commands into benign-looking agent skill files, releasing a benchmark of 2,826 skills mapped to 11 MITRE ATT&CK tactics. Evaluation across 5,629 completed runs of two enterprise coding agents used a three-judge LLM panel with a refusal veto and declared-intent override, validated against a blind human gold standard at Cohen's kappa 0.85. The result is that the dynamically loaded skills interface is a reliable execution path into agents holding delegated authority over connected systems, and the benchmark is reusable against your own agent deployments.

arxiv.org → (opens in a new tab)

LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents (opens in a new tab)

arXiv cs.CR (AI) ·Longtao Guo, Zelin Zhang, Kaifeng Huang, Yang Shi ·fetched 9 Aug 2026, 07:41 UTC Must read Research agreed3/3

Why readShows a black-box, task-agnostic indirect prompt injection that makes an LLM web agent believe login is a prerequisite, then walks it into an attacker-controlled login page and out with credentials.

LoginTrap uses a fuzzing-inspired process to generate page-specific injections from the webpage context, so the attacker needs no knowledge of the user's task or the agent's internals. Because it targets the authentication boundary rather than a specific task, it produces end-to-end private data leakage rather than just misdirected actions. Relevant to anyone deploying browser-driving agents with access to real accounts or credential stores.

arxiv.org → (opens in a new tab)

"Allow" to Achieve, Over-Privileged Inadvertently: The Unintended Cost of Task-Completion-Driven Pop-up Decisions in Mobile GUI Agents (opens in a new tab)

arXiv cs.CR (AI) ·Dongsheng Chen, Yuxuan Li, Guanhua Chen, Jiaxin Zhang ·fetched 9 Aug 2026, 06:22 UTC Must read Research agreed3/3

Why readMeasures how frontier multimodal models handle Android permission dialogs during GUI agent tasks, and finds grant behaviour swings on which app is asking rather than on what the task needs.

The authors inject Android-style permission popups into real GUI tasks and evaluate four frontier multimodal LLMs against a four-level framework scoring permissions by task relevance and privacy risk, with synchronised screenshots and UI-tree hierarchies giving the agent the requester, permission text, justification and available actions. Holding the Calendar task fixed and changing only the requesting app from Calendar to PiMusic drops grants from 26/32 to 0/32, an App-Trust Bias that is strong but conditioned on task context rather than on privacy risk. The practical consequence: an agent driving a phone will over-grant whenever the requester looks plausible for the job, so permission decisions cannot be delegated to the agent without an external policy layer.

arxiv.org → (opens in a new tab)

CVE-2026-19111 (CVSS 8.6): Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might (opens in a new tab)

NVD ·fetched 9 Aug 2026, 15:40 UTC CVE-2026-19111 CVSS 8.6 EPSS 0.4% agreed3/3

Why readCross-tenant memory access in Amazon Strands Agents Tools: an attacker who can steer the LLM into emitting a forged namespace parameter reads or deletes another tenant's stored memories.

The mongodb_memory, elasticsearch_memory and mem0_memory tools before 0.8.3 trust the namespace argument supplied in a tool call rather than binding it to the authenticated tenant, a plain IDOR in the agent tool layer. Because the parameter is chosen by the model, prompt injection in retrieved content or user input becomes the delivery path for the forged identifier. Upgrade to 0.8.3; covered by AWS bulletin 2026-077 and GHSA-mpxq-953j-42m4.

nvd.nist.gov → (opens in a new tab)

Auto mode is now the default in Claude Code for Pro, Max, and Team plans (opens in a new tab)

Simon Willison on prompt injection ·fetched 9 Aug 2026, 03:38 UTC Must read agreed3/3

Why readAnthropic is making Claude Code's auto mode the default on 14 August, and has published prompt injection eval data from 1,053 paid testers to justify it.

Auto mode, which executes tool calls without per-action approval, becomes the default for new Claude Code sessions on Pro, Max and Team plans from 14 August 2026. The supporting evals swapped one permission prompt mid-session for a clearly dangerous command and measured whether the human reviewer caught it, with Anthropic's position being that model-side mitigation now outperforms average human review on prompt injection and data exfiltration. If developers in your estate run coding agents against untrusted repositories, issues or web content, the blast radius of a successful injection changes by default on that date.

simonwillison.net → (opens in a new tab)

CVE-2026-48039 (CVSS 9.1): Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatc (opens in a new tab)

NVD ·fetched 9 Aug 2026, 23:43 UTC CVE-2026-48039 CVSS 9.1 EPSS 0.3% agreed3/3

Why readAn MCP server that forwards unauthenticated Streamable HTTP requests straight to tool handlers, then leaks the operator's Meta access token back in the error response.

Meta Ads MCP before 1.0.109 never issues a 401: AuthInjectionMiddleware.dispatch() at http_auth_integration.py:272 passes unauthenticated requests to downstream tool handlers, which fall back to the META_ACCESS_TOKEN environment variable. When the Graph API call then fails, api.py:263-269 serialises the raw httpx request URL, access_token query parameter included, into the JSON-RPC response body. Any network-reachable caller gets both free tool invocation and the credential; fixed in 1.0.109.

nvd.nist.gov → (opens in a new tab)

Human oversight is still critical as AI patching tools miss security risks (opens in a new tab)

CSO Online ·fetched 9 Aug 2026, 11:37 UTC CVE-2026-45185 EPSS 0.2% agreed3/3

Why readPuts a number on LLM patch quality: 53.9 percent of AI-generated fixes for complex vulnerabilities were syntactically correct but carried embedded defects, across 6,080 patches for six real CVEs.

1Password evaluated 6,080 LLM-generated patches against six recently disclosed vulnerabilities including CVE-2026-34197 (ActiveMQ RCE), CVE-2026-45185 (Exim RCE), CVE-2026-22738 (SpringAI SpEL RCE) and the Gemini CLI RCE tracked as GHSA-wpqr-6v78-jr5g. Where the fix required more than a local change, models produced what the researchers call Fix-Like Artifacts with Embedded Defects 53.9 percent of the time, missing architectural intent, business constraints and security implications while still compiling. The practical takeaway is a gating rule: keep human review mandatory on any AI-authored patch touching security-sensitive code paths, and note that this is CSO's write-up rather than the primary evaluation.

csoonline.com → (opens in a new tab)

CVE-2026-61808 (CVSS 9.8): LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with (opens in a new tab)

NVD ·fetched 9 Aug 2026, 23:43 UTC CVE-2026-61808 CVSS 9.8 EPSS 0.3% agreed3/3

Why readLightRAG ships listening on every interface with authentication off, so any RAG deployment that skipped a reverse proxy is fully open to whoever can reach the port.

Through version 1.5.4 the LightRAG API server binds to 0.0.0.0 with authentication disabled by default. An unauthenticated attacker who can reach it can read indexed documents, upload or delete them, rewrite the knowledge graph, cancel pipelines, clear caches and burn the deployment's LLM budget. Version 1.5.5rc1 mitigates the default; until then, bind to localhost or put the service behind an authenticating proxy and check whether any instance is internet reachable.

nvd.nist.gov → (opens in a new tab)

CVE-2026-67622 (CVSS 8.5): Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attack (opens in a new tab)

NVD ·fetched 9 Aug 2026, 15:40 UTC CVE-2026-67622 CVSS 8.5 EPSS 0.2% agreed3/3

Why readCross tenant credential theft in a widely deployed LLM app builder, where the stolen objects are provider API keys and the write primitive is a file upload into someone else's vector store.

Flowise through 3.1.4 never verifies workspace ownership when the OpenAI Assistants integration looks up a credential, so any authenticated user who supplies an arbitrary credential UUID operates as if it were theirs. That yields cross workspace assistant metadata, file and vector store listings, and the ability to upload files into a victim workspace, which is a retrieval poisoning primitive as much as a data leak. On multi team Flowise deployments the practical exposure is every LLM provider key held by every other tenant, so tenant separation here should not be assumed until you are past 3.1.4.

nvd.nist.gov → (opens in a new tab)

How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta (opens in a new tab)

CNBC Technology ·fetched 9 Aug 2026, 15:40 UTC agreed3/3

Why readThe three separate 'our model went rogue' disclosures from OpenAI, Anthropic and Meta all trace back to one evaluator, which changes how you should read them.

CNBC identifies Irregular, a Tel Aviv firm founded three years ago with 80 million dollars from Sequoia and Redpoint and a 450 million dollar valuation, as the common test bed behind the back to back rogue behaviour findings the three labs published over a fortnight. That single provenance matters: what looked like independent corroboration across vendors is closer to one methodology applied three times. Irregular says it will publish a full retrospective once the facts are in, so the underlying test design is not yet public.

cnbc.com → (opens in a new tab)

openhackai/OpenHack: Open Source Agentic Security Scanner (opens in a new tab)

GitHub: new security tools ·openhackai ·fetched 9 Aug 2026, 06:22 UTC Research ★ 370 agreed2/3

Why readAn agentic code-auditing pipeline that ends in a sandboxed exploit attempt, so findings come with a reproduction instead of a static-analysis guess.

OpenHack chains four stages: recon to build a project model, category and feature based hunters to surface candidate bugs, a validation agent to judge impact, and a verification agent that attempts the attack in a real Docker or DOM environment. That last stage is the interesting part, since it is the step most LLM-driven SAST tools skip and the reason their output drowns teams in unconfirmed findings. Treat the open source framing with some caution; the CLI still offers a hosted account with credits alongside the self-hosted open-weights path.

github.com → (opens in a new tab)

Tech industry alliance proposes AI agent safety reporting program (opens in a new tab)

Cybersecurity Dive ·Eric Geller ·fetched 9 Aug 2026, 03:38 UTC agreed3/3

Why readAn industry group is proposing a shared reporting channel for agentic AI security incidents, which is the first structural attempt at cross-org visibility into agent failures.

A tech industry alliance has floated an information-sharing exchange for lessons learned from agentic AI security incidents. The reporting is thin on membership, scope and whether participation carries any obligation. Worth tracking for anyone running agents in production, because a functioning exchange would be the only source of comparable incident data outside individual vendors.

cybersecuritydive.com → (opens in a new tab)

Meta ordered to pay $942 million over harm to children (opens in a new tab)

Malwarebytes Labs ·fetched 9 Aug 2026, 06:22 UTC agreed3/3

Why readThe money is the headline, but the enforceable product obligations are what will show up in other platforms' compliance roadmaps.

A New Mexico court ordered Meta to pay $942 million, combining a $375 million civil penalty from March with a $567 million abatement fund, after finding the company concealed what it knew about risks to children and misrepresented platform safety. The order also imposes product-level requirements in the state, including building an under-13 prediction model within two years, seeking proof of age from users estimated to be under 13, and treating uncertain accounts as minors. Meta says it will appeal, but age assurance moving from policy commitment to court-ordered engineering work is the precedent to watch.

malwarebytes.com → (opens in a new tab)

Suisun City Declares State of Emergency After Cyberattack Disrupts Public Safety Services (opens in a new tab)

Google News: incidents · Contra Costa News ·fetched 9 Aug 2026, 15:40 UTC agreed3/3

Why readA US city has declared a state of emergency because a cyberattack degraded public safety services, which is the escalation municipal peers benchmark against.

Suisun City declared a state of emergency after a cyberattack disrupted public safety operations, following the network shutdown reported the same weekend. Only the headline was retrievable, so the vector, actor and duration are unknown. The emergency declaration itself is the fact that matters for anyone advising local government on incident thresholds and mutual aid.

Also covered byLos Angeles Times (opens in a new tab),KQED (opens in a new tab),nbcbayarea.com (opens in a new tab),The Vacaville Reporter (opens in a new tab),Local News Matters (opens in a new tab),abc10.com (opens in a new tab).

news.google.com → (opens in a new tab)

AU: Hackers leak sensitive Victorian court data to dark web (opens in a new tab)

DataBreaches.net ·Dissent ·fetched 9 Aug 2026, 03:38 UTC agreed3/3

Why readNames, emails and job titles of people who attended Victorian regional court online hearings were posted to a hacking forum, with a claimed actor and a live police investigation.

Personal data on users of Victoria's regional courts, taken from online hearing records, appeared on an underground forum in July, and a forum user has claimed responsibility. The exposed fields are names, email addresses and job titles rather than case content. Police are investigating; for justice-sector and public-sector leaders the relevant question is what remote-hearing platforms retain about participants and who can reach it.

databreaches.net → (opens in a new tab)

Georgia water treatment facility is latest cyberattack target (opens in a new tab)

Google News: incidents · Good Morning America ·fetched 9 Aug 2026, 03:38 UTC agreed3/3

Why readNames a Georgia water treatment facility as the latest target, giving the multi-state water utility story a concrete data point for sector peers.

A water treatment facility in Georgia was hit by a cyberattack, reported as the most recent in a series against US water systems. Mainstream coverage carries no detail on the intrusion path, whether OT or only IT was affected, or any impact on treatment operations. For water and wastewater operators the useful content is the pattern rather than the specifics: this sector is being worked systematically and boards will ask where their own utility sits.

Also covered byfacilitiesnet.com (opens in a new tab),newsnationnow.com (opens in a new tab).

news.google.com → (opens in a new tab)

August 4th – This Week’s Top Cybersecurity and Dark Web Stories (opens in a new tab)

Assetnote / Searchlight ·Lizzie Clark ·fetched 9 Aug 2026, 06:22 UTC agreed3/3

Why readTwo UK government breaches claimed by a new group calling itself ExfilSquad, including 607,000 records taken from Department for Education systems.

The DfE confirmed on 29 July that roughly 607,000 records were stolen from its external customer helpdesk and the Turing Scheme portal, comprising names, job titles, work email addresses and phone numbers with no financial data; it self-referred to the ICO and is working with the NCA and NCSC. The same roundup covers a cyberattack disrupting water utilities in Minnesota and a Bank of Baroda data leak. It is aggregated reporting rather than primary work, but the DfE volume, the self-referral and the named threat group are the facts a leader will be asked about.

slcyber.io → (opens in a new tab)

Former SK Hynix employee jailed for leaking information to a Chinese firm: Report (opens in a new tab)

Economic Times Tech ·fetched 9 Aug 2026, 11:37 UTC agreed2/3

Why readA concrete sentencing outcome to cite when you argue insider risk budget at an IP-heavy manufacturer.

The Seoul High Court upheld an 18 month sentence against a former SK Hynix employee who passed classified CMOS image sensor process information to a Chinese company in 2022, according to Yonhap. The material covered non-memory chip technology used in smartphone and laptop cameras rather than SK Hynix's core memory business. It is a single case, but it adds to the pattern of South Korean courts treating semiconductor process leakage to Chinese competitors as criminal, which is the reference point insider risk programmes in that sector are calibrated against.

economictimes.indiatimes.com → (opens in a new tab)