Cybersecurity briefing, 2026-08-14

Safe Mode boots with your network connection but without your security tools, and ransomware crews have started living there.

• Evooo1Bot turns edge CVEs into proxy nodes
• SharePoint JWT flaw is being exploited
• LiteLLM breach grew into CI secret spill
• White House opens hack-back role for private firms
• WindRelay and SpyNote fueled a 13-minute call scam
• CISA’s KEV update spans four live exploits
• White House lets contractors join offensive cyber operations
• AmnesiaStealer adds live browser session control
• Agent guardrails fail before the model speaks
• HoneyMyte adds a signed driver to CoolClient
• Power Pages misconfigurations exposed D365 data
• GeoTools regression reopens GeoServer SQL injection
• Jewelbug merges espionage and crypto theft
• Flock tightens defaults after ALPR abuse scandals
• Beacon breach traced to leaked AWS key
• AWS ACM drops email validation by 2027
• Solid Edge file parsing puts CAD workstations at risk

Recent editions

• Thursday, August 13, 2026: CISA’s KEV update spans four live exploits · 18 stories
• Wednesday, August 12, 2026: Gunra shifts ransomware to perimeter break-ins · 18 stories
• Tuesday, August 11, 2026: VulnCheck chains SharePoint bypass into RCE · 18 stories
• Monday, August 10, 2026: Head Mare turns TrueConf updates into malware delivery · 17 stories
• Sunday, August 9, 2026: Metabase exploitation exposes connected databases · 3 stories
• Saturday, August 8, 2026: SharePoint patches didn’t clear BIT’s breach · 15 stories
• Friday, August 7, 2026: Cisco IOS XE fixes expose broader codebase weaknesses · 19 stories