Cybersecurity briefing, 2026-08-01

Here is the quick read for August 1.

• Coldcard patch leaves old seeds exposed
• PLC access reaches past disruption into lockout
• Android TV boxes now double as residential proxies
• One CareCloud breach reaches thousands of practices
• Ad tag compromise turns trusted sites into stealers
• Cosmos DB gateway secret breaks tenant boundaries
• A rehearsed npm playbook reached major packages
• Microsoft confirmation turns hotel Wi‑Fi into attack surface
• AI eval misconfigurations reached real production systems
• Chrome bug discovery is outrunning release cadence
• SBOM baseline expands to AI and SaaS
• Memory-only backdoors evade disk-based hunting
• SAML login bypass opens Web Help Desk admin access
• GitHub mailboxes hide a persistent law firm foothold

Recent editions

• Friday, July 31, 2026: OWA access now survives resets and reimaging · 15 stories
• Thursday, July 30, 2026: Shared PLC exposure turns one attack into many · 16 stories
• Wednesday, July 29, 2026: One malicious page can reach Android root · 17 stories
• Tuesday, July 28, 2026: BMCs stay crackable before login · 17 stories
• Monday, July 27, 2026: Spring Boot fat-JARs stay exposed after Fastjson bypass · 16 stories
• Sunday, July 26, 2026: Windchill patch window became Cl0p's entry point · 5 stories
• Saturday, July 25, 2026: Password reuse turns retail logins into fraud targets · 14 stories