Cybersecurity briefing, 2026-08-04

Here's a line that should stop your standup cold: device-code phishing breaks the authorization step, not the password, so passkeys and hardware keys never get to help.

• AI agents can carry poisoned trust across runs
• npm worm now spreads through stolen tokens
• Microsoft confirmation turns hotel Wi‑Fi into attack surface
• BMCs stay crackable before login
• Operator trust opens Tenable Sensor Proxy to code execution
• Omada’s provisioning plane is the real attack surface
• Coldcard patch leaves old seeds exposed
• SMA1000 access turned into ransomware fuel
• Beneficial ownership Register breach hits AML control point
• Published staff contacts raise the value of phishing
• React2Shell exploitation now turns into credential theft fast
• Ad SDK defaults leak location beyond app controls
• AI security breaks at conversation and API layers
• Public PoCs turn GL-MT3000 bugs into edge footholds
• AI eval misconfigurations reached real production systems
• Device-code phishing goes industrial and bypasses passkeys

Recent editions

• Monday, August 3, 2026: SMA1000 access turned into ransomware fuel · 15 stories
• Sunday, August 2, 2026: Coldcard patch leaves old seeds exposed · 5 stories
• Saturday, August 1, 2026: PLC access reaches past disruption into lockout · 14 stories
• Friday, July 31, 2026: OWA access now survives resets and reimaging · 15 stories
• Thursday, July 30, 2026: Shared PLC exposure turns one attack into many · 16 stories
• Wednesday, July 29, 2026: One malicious page can reach Android root · 17 stories
• Tuesday, July 28, 2026: BMCs stay crackable before login · 17 stories