Cybersecurity briefing, 2026-08-07

Stolen tokens, agent flaws, and exposed industrial controls are driving the biggest risks today.

• Cisco IOS XE Fixes Expose Broader Codebase Weaknesses
• SharePoint Patches Didn’t Clear BIT’s Breach
• Container Escape Turns Old Linux Bug into Host Risk
• Malicious Python Releases Reach Developer Secrets at Startup
• npm Worm Now Spreads Through Stolen Tokens
• Compromised Packages Become Reusable Intrusion Pipelines
• Session Theft Bypasses MFA and Sign-In Alerts
• Imported Agents Become Server Commands in Paperclip
• Elementor Pro Upload Check Opens PHP Write Path
• One Terraform State Leak Can Cross Cloud Boundaries
• AI Fuzzing Finds Hundreds of HTTP Desync Exposures
• Agent Guardrails Fail Before the Model Speaks
• Oracle SQL Injection Crosses Into Host Compromise
• AI Testing Sandboxes Are Becoming Attack Surface
• Agent Harness Bugs Expose CI Secrets
• Thousands of Rockwell PLCs Are Still Publicly Reachable
• AI Patches Still Need Human Eyes
• Redact Rebrand Hides the Same Extortion Playbook
• Embedded MongoDB Leaves Zenon Users Exposed

Recent editions

• Thursday, August 6, 2026: npm Worm Now Spreads Through Stolen Tokens · 17 stories
• Wednesday, August 5, 2026: npm Worm Now Spreads Through Stolen Tokens · 18 stories
• Tuesday, August 4, 2026: AI Agents Can Carry Poisoned Trust Across Runs · 16 stories
• Monday, August 3, 2026: SMA1000 Access Turned Into Ransomware Fuel · 15 stories
• Sunday, August 2, 2026: Coldcard Patch Leaves Old Seeds Exposed · 5 stories
• Saturday, August 1, 2026: Coldcard Patch Leaves Old Seeds Exposed · 14 stories
• Friday, July 31, 2026: OWA Access Now Survives Resets and Reimaging · 15 stories