Cybersecurity briefing, 2026-08-05

Passkeys survive phishing.

• npm worm now spreads through stolen tokens
• Imported agents become server commands in Paperclip
• Snowflake plea locks in identity-layer blast radius
• SMA1000 access turned into ransomware fuel
• Local Linux users can reach root through OVS datapath
• Cloaked Mac lures beat content-based detection
• Open VSX Evil twins turn developer trust into recon
• QuickFox loader targets only chosen Windows hosts
• Operator trust opens Tenable Sensor Proxy to code execution
• AI security breaks at conversation and API layers
• Chrome passkeys become reusable after Windows malware
• Device-code phishing goes industrial and bypasses passkeys
• AI agents can carry poisoned trust across runs
• Management planes are exposing the keys themselves
• Omada’s provisioning plane is the real attack surface
• Leaked n8n tokens became live access keys
• AI security turns toward rapid response
• Published staff contacts raise the value of phishing

Recent editions

• Tuesday, August 4, 2026: AI agents can carry poisoned trust across runs · 16 stories
• Monday, August 3, 2026: SMA1000 access turned into ransomware fuel · 15 stories
• Sunday, August 2, 2026: Coldcard patch leaves old seeds exposed · 5 stories
• Saturday, August 1, 2026: PLC access reaches past disruption into lockout · 14 stories
• Friday, July 31, 2026: OWA access now survives resets and reimaging · 15 stories
• Thursday, July 30, 2026: Shared PLC exposure turns one attack into many · 16 stories
• Wednesday, July 29, 2026: One malicious page can reach Android root · 17 stories