Cybersecurity briefing, 2026-08-14

Safe Mode boots with your network connection but without your security tools, and ransomware crews have started living there.

• Evooo1Bot Turns Edge CVEs Into Proxy Nodes
• SharePoint JWT Flaw Is Being Exploited
• LiteLLM Breach Grew Into CI Secret Spill
• White House Opens Hack-Back Role for Private Firms
• WindRelay and SpyNote Fueled a 13-Minute Call Scam
• CISA’s KEV Update Spans Four Live Exploits
• White House Lets Contractors Join Offensive Cyber Operations
• AmnesiaStealer Adds Live Browser Session Control
• Agent Guardrails Fail Before the Model Speaks
• HoneyMyte Adds a Signed Driver to CoolClient
• Power Pages Misconfigurations Exposed D365 Data
• GeoTools Regression Reopens GeoServer SQL Injection
• Jewelbug Merges Espionage and Crypto Theft
• Flock Tightens Defaults After ALPR Abuse Scandals
• Beacon Breach Traced to Leaked AWS Key
• AWS ACM Drops Email Validation by 2027
• Solid Edge File Parsing Puts CAD Workstations at Risk

Recent editions

• Thursday, August 13, 2026: CISA’s KEV Update Spans Four Live Exploits · 18 stories
• Wednesday, August 12, 2026: Gunra Shifts Ransomware to Perimeter Break-ins · 17 stories
• Tuesday, August 11, 2026: VulnCheck Chains SharePoint Bypass Into RCE · 17 stories
• Monday, August 10, 2026: Head Mare Turns TrueConf Updates Into Malware Delivery · 17 stories
• Sunday, August 9, 2026: Metabase Exploitation Exposes Connected Databases · 3 stories
• Saturday, August 8, 2026: Metabase Exploitation Exposes Connected Databases · 15 stories
• Friday, August 7, 2026: Cisco IOS XE Fixes Expose Broader Codebase Weaknesses · 19 stories