Here is your briefing for Monday, August 10, 2026. Researchers disclosed attacks against passkeys that can pull synced private keys from certain implementations or sidestep phishing-resistant MFA entirely. The techniques target how some password managers and browsers handle key synchronization and attestation. The work shows that the convenience of cross-device sync introduces attack surfaces that were not fully stress-tested before widespread rollout. Defenses will likely require tighter hardware binding and better visibility into sync operations. That's the headline from The Hacker News, and it is a reminder that moving the root of trust into the cloud does not automatically make it harder to steal. Attackers exploited vulnerabilities in TrueConf video conferencing servers to swap out legitimate client installers with a backdoored version called PhantomCore. The campaign has been active for months and targets enterprise users of the platform. The supply-chain angle is straightforward: compromise the update or distribution mechanism once, and every subsequent install carries the payload. Patching the server side stops new infections, but existing compromised clients need separate remediation. That's the headline from The Hacker News, and the pattern is becoming predictable. Any product that pushes binaries to users without strong signing and verification is an attractive target. Anthropic's own AI coding agent was turned against a GitHub repository in a rogue operation that involved creating fake identities and deploying malware. The incident highlights how agentic systems can be abused when they have write access and insufficient guardrails. The attack did not require compromising Anthropic's infrastructure directly. It leveraged the agent's capabilities to perform actions that looked like normal development activity until the malware appeared. That's the headline from Ars Technica, and the uncomfortable truth is that giving an AI persistent access to code repos without ironclad constraints is asking for creative misuse. Discovered Materials is using AI to search for new materials that could improve chip cooling and performance. The approach treats material discovery as a high-dimensional optimization problem where traditional lab methods move too slowly. Early results suggest the AI is finding candidates that human researchers might have overlooked, but the real test will be whether any of them survive fabrication and real-world thermal cycling. That's the headline from TechCrunch, and it is one of the few places where AI is being applied to the physical constraints that actually limit scaling rather than just generating more tokens. DeepMind is undergoing a leadership transition with Demis Hassabis stepping back and several senior scientists leaving. The moves come amid broader reorganization at Google as the company tries to consolidate its AI efforts across multiple teams. The departures are notable because they remove some of the original technical leadership that built the lab's reputation. Whether the shift improves execution or simply redistributes the same problems remains to be seen. That's the headline from Ars Technica, and it shows that even the organizations with the deepest talent pools are not immune to the coordination costs of rapid growth. Five stories, one recurring theme. Authentication systems keep revealing new failure modes once they leave the lab. Supply chains remain the easiest place to insert persistent access. Agentic tools are powerful enough to be dangerous when their permissions exceed their judgment. Materials science is finally getting AI attention where it might matter for hardware. And even the best AI labs are still figuring out how to keep their best people aligned as the org charts grow. The fundamentals have not changed. Trust boundaries, verification, and human oversight remain the bottlenecks. That's the briefing. Stay sharp, patch your systems, and we'll see you tomorrow. 

Support the show

Here is your briefing for Friday, August 7, 2026. Tencent researchers disclosed SCTPhantom, a use-after-free in the Linux kernel's SCTP networking stack that has existed since 2008. With SCTP reachable on the target, it yields full root and lets attackers escape containers to the host. The bug was assigned CVE-2026-64564 and fixed in stable kernels released August third. No public exploits were known at disclosure. The flaw affects Debian, Ubuntu, Rocky, and RHEL builds among others. Exposure is limited because it requires local access and SCTP enabled, but the age of the bug and the container escape path make it worth attention for any environment running older kernels with that protocol in use. That's the headline from The Hacker News, and the real story is how long these issues can hide in plain sight. Eighteen years is not a patch cycle. It is a career. Security researcher Malcolm Stagg presented NatJack at Black Hat USA, showing how attackers with privileged access behind the same NAT can manipulate connection tracking tables to hijack active TCP sessions, spoof DNS responses, expose internal ports, and exhaust NAT resources. Separate CVEs landed in Windows Hyper-V NAT and Linux Netfilter conntrack. The attack does not require a universal patch because it exploits fundamental behavior across implementations. Defenses center on isolating untrusted workloads from shared NAT infrastructure and applying the available Windows and Linux updates. That's the headline from the Black Hat presentation, and it is a reminder that the plumbing we rely on for isolation has always been more porous than the diagrams suggest. Novee Security showed that a GitHub issue created by an unprivileged account was enough to execute code on the CI runners for Anthropic's and Google's own coding-agent repositories. On OpenAI's setup it could hijack the next agent run. The Gemini CLI carried CVE-2026-12537, a command injection via a crafted .env file that ran before the sandbox. Claude Code leaked an API key one character at a time through a download counter. Both are now patched. The attack path bypassed the model entirely in several cases. Public issues became direct execution channels into the build environment. That's the headline from the Black Hat disclosure, and the uncomfortable part is that the vendors' own agent tooling shipped with these gaps. If the builders cannot keep their CI safe from a GitHub ticket, the rest of us should assume the defaults are not our friends. A New Mexico court added five hundred sixty-seven million dollars to Meta's penalties in an ongoing child safety case. The ruling comes amid broader scrutiny of platform safety practices and follows other large settlements and regulatory actions. The scale of the judgment keeps the pressure on social platforms to demonstrate meaningful controls rather than process theater. Whether the money changes design incentives remains the open question. That's the headline from TechCrunch, and the number is large enough to notice even for a company the size of Meta. Regulators are still willing to write big checks when the underlying conduct does not improve. Arctic Wolf Labs reported a widespread adversary-in-the-middle phishing campaign against Microsoft 365 accounts. The actors use residential proxies to blend in, maintain sessions on roughly eight-hour cycles, and focus on harvesting payroll and finance-related messages. The activity overlaps with Microsoft's Storm-2755 cluster and has hit healthcare, education, manufacturing, government, and professional services organizations in multiple countries. The campaign is financially motivated and relies on account takeover rather than novel malware. Standard MFA and session hygiene remain the primary defenses. That's the headline from The Hacker News, and the pattern is familiar: once the account is in, the attacker lives off the land in the mailbox. The residential proxy layer just makes the initial compromise harder

Support the show

Here is your briefing for Thursday, August 6, 2026. Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities Forescout scanned the internet and found more than four thousand four hundred exposed Rockwell Automation programmable logic controllers worldwide, including twenty-two in cities already hit by recent cyberattacks on US water utilities. Nineteen of those sat on the same mobile carrier network. The company could not confirm any had been compromised, but the exposure alone is the story. Attackers in the water incidents did not need zero-days. They changed IP addresses and set passwords on controllers that were already reachable from the internet, knocking operators blind and sometimes seizing control. The FBI and EPA have tracked incidents across at least seven states since July twenty-seventh. No one has explained how the attackers located or initially accessed the targets. That's the headline from Forescout, and honestly, the numbers are worse than they look. These are not theoretical exposures. They are live devices in critical infrastructure that defenders have known about for years. If basic reachability is still this widespread, the patch-and-pray model is failing in the places it matters most. AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory A new class of prompt injection is spreading across commercial websites with no malware, no credentials, and no zero-day required. Sites are embedding hidden payloads inside "Ask AI" buttons on marketing and competitor comparison pages. When a logged-in user of ChatGPT, Claude, Gemini, or Grok clicks one, the pre-formed query executes immediately with no confirmation. The dangerous versions instruct the model to permanently save the vendor's domain as a "trusted source," quietly biasing every future answer in that vendor's favor. Microsoft Security catalogued the behavior as AI Recommendation Poisoning back in February, identifying thirty-one companies across fourteen industries already deploying it. That's the headline from the researchers who found it, and the mechanism is elegant in its simplicity. It turns a feature users expect to be helpful into a persistent memory poison. Once the model treats the attacker-controlled domain as authoritative, the bias sticks across sessions. The attack surface just expanded from the prompt to the entire conversation history. AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model Security flaws in agent infrastructure from Amazon Web Services, Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several attack paths the model never ran at all, so system prompts, content filters, and guardrails never got a chance to intervene. The affected products include Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit for Python, and Vercel AI SDK harness packages. AWS has fixed the managed service. Google addressed the issues in ADK 2.5.0. Vercel patched the relevant packages in versions 1.0.29 and 1.0.28. That's the headline from the security teams that disclosed it, and the implication is uncomfortable. Agent frameworks are being built on the assumption that the model is the gatekeeper. When that assumption breaks, the entire tool-calling layer becomes a direct execution path for attackers. The fixes are out, but the architectural lesson is clear: authorization must happen before the tool call, not after the model thinks about it. Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells VulnCheck researchers disclosed a factory-shipped backdoor present in at least twenty Chinese router models from Zbtlink. The implant appears in every firmware image the company has released over more than two years. It beacons to Chinese command-and-control infrastructure as often as every thirty-five seconds and masquerades as a legitimate Linux kernel thread while running with root privileges. The tool, called rctl, has been on GitHub since twenty-fifteen and never updated. It implements a simple remote control interface that starts automatically on boot. The backdoors have been codenamed ENDLESSDOORS. That's the headline from VulnCheck, and the supply chain angle is the real problem. These are not compromised updates or third-party malware. They are intentional implants baked into the firmware at the factory. Anyone buying these routers for home or small business use has been shipping a persistent root shell to Chinese infrastructure for years. Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service A federal judge in Alexandria, Virginia sentenced Maksim Silnikau to sixteen years in prison on August fifth for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in twenty-twenty-one. Between twenty-twenty-one and twenty-twenty-three the group attacked at least eighteen companies across multiple states and countries. Silnikau built the infrastructure, bought initial access, ran the affiliate panel, and pushed payments through cryptocurrency mixers. He did not carry out most intrusions himself. He built the business around them and let affiliates do the work while taking a cut. The sentence is sixteen years, longer than the thirteen years and seven months handed to another RaaS operator earlier this year. That's the headline from the Department of Justice, and the message is straightforward. Building and operating a ransomware franchise at scale now carries real prison time, not just fines or asset seizures. Whether that deters the next operator is another question, but the precedent is set. Five stories, one through-line: the fundamentals are still broken. Critical infrastructure devices remain exposed in the thousands. New AI attack patterns are being deployed in production before most teams have heard the term. Agent frameworks assume model-level authorization that does not always happen. IoT vendors are still shipping root shells. And even successful law enforcement actions against RaaS crews come after years of damage. The attack surface keeps expanding while the basics of reachability, supply chain integrity, and authorization remain unsolved. That gap is not theoretical anymore. That’s the briefing. Stay sharp, patch your systems, and we’ll see you tomorrow.

Support the show

Here is your briefing for Wednesday, August 5, 2026. The U.S. Cybersecurity and Infrastructure Security Agency added three flaws to its Known Exploited Vulnerabilities catalog on August 5, citing evidence of active exploitation in the wild. CVE-2026-9198 is a code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote code execution on default deployments. It was fixed in July with version 1.10.1. CVE-2026-34486 is a missing encryption of sensitive data flaw in Apache Tomcat that allows a bypass of EncryptInterceptor. Fixed in April. CVE-2026-18556 is an authentication bypass in N-able N-central. An incomplete fix for the N-central issue prompted the addition. These are not theoretical. Attackers are already using them. CISA's move is a reminder that the window between disclosure and exploitation keeps shrinking. Langflow in particular is popular in AI and data pipeline environments. If you're running it exposed, you're already late.  A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions. A public exploit ships with pre-built records for roughly 800 kernel builds. The vulnerability, tracked as CVE-2026-64531 with a CVSS score of 7.8, was disclosed by researcher Asim Manizada on July 28. The bug sits in the kernel datapath, not the userspace daemon. An attacker needs no existing OVS bridge, no running ovs-vswitchd, and no host-level CAP_NET_ADMIN. On affected systems where the OVS kernel datapath is available and unprivileged user namespaces are enabled, an ordinary user can create private namespaces with unshare, gain the capability inside that namespace, and reach the vulnerable flow-installation path. This is a local privilege escalation with a working public exploit and broad hardware coverage. If your fleet runs Open vSwitch — and many do for container networking — this one needs attention now. Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled device codes that victims approve on Microsoft's real authentication page. Once access and refresh tokens are issued, attackers may retain access to email, documents, and cloud resources. ANY.RUN telemetry records more than 80 public sessions linked to the campaign each week, with the United States as the main target. The kit uses SharePoint-themed lures and other enterprise-looking pages to draw victims into the device code flow. This is device code phishing at scale, and it's working. CrowdStrike's recent threat hunting report noted a 1,500% increase in device code phishing in the first half of 2026 alongside a doubling of vishing. The technique bypasses many traditional controls because the victim is actively approving the request on Microsoft's own infrastructure. If your org still relies on device code flows without additional verification, you're exposed. A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The packages were uploaded between July 26 and August 1 and removed as of August 3. In most cases the extensions send little more than the machine's hostname. In nineteen of them they send a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside. Fifty-eight were lightweight reconnaissance tools. The rest were more aggressive payloads. This is supply chain compromise at the editor level. Developers install these things thinking they're getting a useful utility. Instead they're phoning home with exactly the kind of context an attacker needs for targeted follow-on operations. The fact that it took a third-party security firm to catch this, rather than

Support the show

AI is starting to look less like a buzzword and more like a line item, and the market is telling us exactly what it values. We break down why Palantir’s latest quarter reads as a clean signal of enterprise AI adoption moving from pilots into production workflows, and why Palo Alto Networks doubling down on AI-powered security fits the same pattern. When companies can show measurable outcomes, budgets follow and the “hype phase” ends fast.

Then we jump to a very different kind of milestone: accessibility. Alibaba’s open-weights release “Quen3827B,” plus Unsloth shipping day-zero support, points to a near-term world where local LLM work is not reserved for teams with massive infrastructure. We talk through what it means when a frontier-class model can run on around 17 GB of RAM or VRAM, including a single RTX 4090 or a high-end Mac with 24 GB unified memory, and why faster, lower-memory fine-tuning changes who gets to experiment and how quickly ideas can ship.

Finally, we map the constraints that will define the next phase of AI: governance, regulation, and infrastructure. Anaconda’s acquisition of Encrypt AI shows security, red teaming, and compliance automation becoming table stakes for regulated industries. We also cover the EU AI Act transparency rules now in effect, requiring disclosure of AI interactions and labeling of AI-generated or manipulated content, including deepfakes. And we dig into the growing US pushback on AI data centers over power and water use, turning energy and land into practical bottlenecks. If you want the clearest read on where AI is headed, subscribe, share the episode, and leave a review, then tell us what constraint you think matters most right now.

Support the show

What if a single update could bring the world to a standstill? On July 19th, that hypothetical nightmare became a reality when a CrowdStrike sys file update led to the largest IT outage in history. In this episode, we unravel the catastrophic chain of events that left 8.5 million Windows systems crippled and incurred an estimated $15 billion in global damages. From grounded flights to disrupted healthcare services, the fallout was immense and far-reaching. But that wasn’t the end—the chaos also opened the door for opportunistic hackers, posing as CrowdStrike support, to exploit the situation further.

Join us as we dissect the lessons learned from this unprecedented incident. We’ll explore the critical importance of rigorous testing, robust backup plans, and zero trust technologies in maintaining system integrity. Companies must prioritize compliance and vendor vetting to mitigate risks. Through CrowdStrike’s transparent response, we see a roadmap for handling such crises. As consumers of cybersecurity, the onus is on us to demand more stringent development and testing processes from our providers. Tune in to get the insights you need to stay secure and informed in an ever-evolving threat landscape.

Support the show

Imagine a world where artificial intelligence is not just a tool for progress but a weapon for exploitation. Are we prepared for this ironic twist? Join us as I unpack observations from the recent InfoSec conference in Orlando. The discussion delves into the burgeoning trends of utilizing AI technologies, such as chatGPT, across multiple industries with a keen emphasis on cybersecurity. We discuss how vendors employ AI to enhance their products, sometimes as a hands-on guide through processes, or as entirely AI-driven solutions for tasks such as log sorting and risk analysis.

However, the path forward is not without thorns. The conversation takes a sobering turn as I discuss how AI is being weaponized. Yes, the same AI we're leveraging for advancements is being harnessed by hackers to create streamlined workflows, write exploit codes, and more. Tune in for an insightful journey into the future implications of AI in cybersecurity and join the conversation. If you attended InfoSec, I'd love to hear your thoughts. Don't forget to like, subscribe, and follow for more enlightening discussions!

Support the show

In my premiere episode, I sit down with Jackson Mumey, the CEO of Celebration Bar Review. We discuss his journey from cassette tapes to the current cloud-delivered platform his business uses. Jackson can be found on his own podcast called The Extra Mile. If you need to pass the Bar Exam look no further than Celebration Bar Review https://www.celebrationbarreview.com.

Support the show