Cybersecurity briefing, 2026-08-06

Rotating a stolen token can feed this npm worm its next release.

• npm worm now spreads through stolen tokens
• Imported agents become server commands in Paperclip
• Compromised packages become reusable intrusion pipelines
• Local Linux users can reach root through OVS datapath
• Trusted remote-admin tools become stealth persistence
• Management planes are exposing the keys themselves
• Thousands of Rockwell PLCs are still publicly reachable
• Leaked n8n tokens became live access keys
• Omada’s provisioning plane is the real attack surface
• QuickFox loader targets only chosen Windows hosts
• Cloaked Mac lures beat content-based detection
• Jenkins control plane leaves secrets exposed
• Agent guardrails fail before the model speaks
• AI agents can carry poisoned trust across runs
• Snowflake plea locks in identity-layer blast radius
• Embedded MongoDB leaves Zenon users exposed
• Oracle SQL injection crosses into host compromise

Recent editions

• Wednesday, August 5, 2026: Imported agents become server commands in Paperclip · 18 stories
• Tuesday, August 4, 2026: AI agents can carry poisoned trust across runs · 16 stories
• Monday, August 3, 2026: SMA1000 access turned into ransomware fuel · 15 stories
• Sunday, August 2, 2026: Coldcard patch leaves old seeds exposed · 5 stories
• Saturday, August 1, 2026: PLC access reaches past disruption into lockout · 14 stories
• Friday, July 31, 2026: OWA access now survives resets and reimaging · 15 stories
• Thursday, July 30, 2026: Shared PLC exposure turns one attack into many · 16 stories