Cybersecurity briefing, 2026-08-05

Passkeys survive phishing.

• npm Worm Now Spreads Through Stolen Tokens
• Imported Agents Become Server Commands in Paperclip
• Snowflake Plea Locks In Identity-Layer Blast Radius
• SMA1000 Access Turned Into Ransomware Fuel
• Local Linux Users Can Reach Root Through OVS Datapath
• Cloaked Mac Lures Beat Content-Based Detection
• Open VSX Evil Twins Turn Developer Trust into Recon
• QuickFox Loader Targets Only Chosen Windows Hosts
• Operator Trust Opens Tenable Sensor Proxy to Code Execution
• AI Security Breaks at Conversation and API Layers
• Chrome Passkeys Become Reusable After Windows Malware
• Device-Code Phishing Goes Industrial and Bypasses Passkeys
• AI Agents Can Carry Poisoned Trust Across Runs
• Management Planes Are Exposing the Keys Themselves
• Omada’s Provisioning Plane Is the Real Attack Surface
• Leaked n8n Tokens Became Live Access Keys
• AI Security Turns Toward Rapid Response
• Published Staff Contacts Raise the Value of Phishing

Recent editions

• Tuesday, August 4, 2026: AI Agents Can Carry Poisoned Trust Across Runs · 16 stories
• Monday, August 3, 2026: SMA1000 Access Turned Into Ransomware Fuel · 15 stories
• Sunday, August 2, 2026: Coldcard Patch Leaves Old Seeds Exposed · 5 stories
• Saturday, August 1, 2026: Coldcard Patch Leaves Old Seeds Exposed · 14 stories
• Friday, July 31, 2026: OWA Access Now Survives Resets and Reimaging · 15 stories
• Thursday, July 30, 2026: OWA Access Now Survives Resets and Reimaging · 16 stories
• Wednesday, July 29, 2026: OWA Access Now Survives Resets and Reimaging · 17 stories