Cybersecurity briefing, 2026-08-06

Rotating a stolen token can feed this npm worm its next release.

• npm Worm Now Spreads Through Stolen Tokens
• Imported Agents Become Server Commands in Paperclip
• Compromised Packages Become Reusable Intrusion Pipelines
• Local Linux Users Can Reach Root Through OVS Datapath
• Trusted Remote-Admin Tools Become Stealth Persistence
• Management Planes Are Exposing the Keys Themselves
• Thousands of Rockwell PLCs Are Still Publicly Reachable
• Leaked n8n Tokens Became Live Access Keys
• Omada’s Provisioning Plane Is the Real Attack Surface
• QuickFox Loader Targets Only Chosen Windows Hosts
• Cloaked Mac Lures Beat Content-Based Detection
• Jenkins Control Plane Leaves Secrets Exposed
• Agent Guardrails Fail Before the Model Speaks
• AI Agents Can Carry Poisoned Trust Across Runs
• Snowflake Plea Locks In Identity-Layer Blast Radius
• Embedded MongoDB Leaves Zenon Users Exposed
• Oracle SQL Injection Crosses Into Host Compromise

Recent editions

• Wednesday, August 5, 2026: npm Worm Now Spreads Through Stolen Tokens · 18 stories
• Tuesday, August 4, 2026: AI Agents Can Carry Poisoned Trust Across Runs · 16 stories
• Monday, August 3, 2026: SMA1000 Access Turned Into Ransomware Fuel · 15 stories
• Sunday, August 2, 2026: Coldcard Patch Leaves Old Seeds Exposed · 5 stories
• Saturday, August 1, 2026: Coldcard Patch Leaves Old Seeds Exposed · 14 stories
• Friday, July 31, 2026: OWA Access Now Survives Resets and Reimaging · 15 stories
• Thursday, July 30, 2026: OWA Access Now Survives Resets and Reimaging · 16 stories