Cybersecurity briefing, 2026-08-04

Here's a line that should stop your standup cold: device-code phishing breaks the authorization step, not the password, so passkeys and hardware keys never get to help.

• AI Agents Can Carry Poisoned Trust Across Runs
• npm Worm Now Spreads Through Stolen Tokens
• Microsoft Confirmation Turns Hotel Wi‑Fi Into Attack Surface
• BMCs Stay Crackable Before Login
• Operator Trust Opens Tenable Sensor Proxy to Code Execution
• Omada’s Provisioning Plane Is the Real Attack Surface
• Coldcard Patch Leaves Old Seeds Exposed
• SMA1000 Access Turned Into Ransomware Fuel
• Beneficial Ownership Register Breach Hits AML Control Point
• Published Staff Contacts Raise the Value of Phishing
• React2Shell Exploitation Now Turns Into Credential Theft Fast
• Ad SDK Defaults Leak Location Beyond App Controls
• AI Security Breaks at Conversation and API Layers
• Public PoCs Turn GL-MT3000 Bugs Into Edge Footholds
• AI Eval Misconfigurations Reached Real Production Systems
• Device-Code Phishing Goes Industrial and Bypasses Passkeys

Recent editions

• Monday, August 3, 2026: SMA1000 Access Turned Into Ransomware Fuel · 15 stories
• Sunday, August 2, 2026: Coldcard Patch Leaves Old Seeds Exposed · 5 stories
• Saturday, August 1, 2026: Coldcard Patch Leaves Old Seeds Exposed · 14 stories
• Friday, July 31, 2026: OWA Access Now Survives Resets and Reimaging · 15 stories
• Thursday, July 30, 2026: OWA Access Now Survives Resets and Reimaging · 16 stories
• Wednesday, July 29, 2026: OWA Access Now Survives Resets and Reimaging · 17 stories
• Tuesday, July 28, 2026: BMCs Stay Crackable Before Login · 17 stories