Cybersecurity briefing, 2026-08-07

Stolen tokens, agent flaws, and exposed industrial controls are driving the biggest risks today.

• Cisco IOS XE fixes expose broader codebase weaknesses
• SharePoint patches didn’t clear BIT’s breach
• Container escape turns old Linux bug into host risk
• Malicious Python releases reach developer secrets at startup
• npm worm now spreads through stolen tokens
• Compromised packages become reusable intrusion pipelines
• Session theft bypasses MFA and sign-in alerts
• Imported agents become server commands in Paperclip
• WordPress alert widens version scope, not exposure certainty
• One Terraform state leak can cross cloud boundaries
• AI fuzzing finds hundreds of HTTP desync exposures
• Agent guardrails fail before the model speaks
• Oracle SQL injection crosses into host compromise
• AI testing sandboxes are becoming attack surface
• Agent harness bugs expose CI secrets
• Thousands of Rockwell PLCs are still publicly reachable
• AI patches still need human Eyes
• Redact rebrand hides the same extortion playbook
• Embedded MongoDB leaves Zenon users exposed

Recent editions

• Thursday, August 6, 2026: npm worm now spreads through stolen tokens · 17 stories
• Wednesday, August 5, 2026: Imported agents become server commands in Paperclip · 18 stories
• Tuesday, August 4, 2026: AI agents can carry poisoned trust across runs · 16 stories
• Monday, August 3, 2026: SMA1000 access turned into ransomware fuel · 15 stories
• Sunday, August 2, 2026: Coldcard patch leaves old seeds exposed · 5 stories
• Saturday, August 1, 2026: PLC access reaches past disruption into lockout · 14 stories
• Friday, July 31, 2026: OWA access now survives resets and reimaging · 15 stories