Cybersecurity briefing, 2026-08-15

Attackers are leaning on exposed services, weak portal wiring, and stealthy post-compromise tools.

• Evooo1Bot Turns Edge CVEs Into Proxy Nodes
• GeoTools Regression Reopens GeoServer SQL Injection
• HoneyMyte Adds a Signed Driver to CoolClient
• Jewelbug Merges Espionage and Crypto Theft
• Power Pages Misconfigurations Exposed D365 Data
• AmnesiaStealer Adds Live Browser Session Control
• White House Lets Contractors Join Offensive Cyber Operations
• Beacon Breach Traced to Leaked AWS Key
• Coordinated Water Utility Hits Span a Dozen States
• SAP Data Hub Adapter Draws Fast Exploitation Pressure
• AWS ACM Drops Email Validation by 2027
• Apple Puts Spyware Warnings on the Lock Screen
• WindRelay and SpyNote Fueled a 13-Minute Call Scam
• LiteLLM Breach Grew Into CI Secret Spill
• Agent Guardrails Fail Before the Model Speaks

Recent editions

• Friday, August 14, 2026: Evooo1Bot Turns Edge CVEs Into Proxy Nodes · 17 stories
• Thursday, August 13, 2026: CISA’s KEV Update Spans Four Live Exploits · 18 stories
• Wednesday, August 12, 2026: Gunra Shifts Ransomware to Perimeter Break-ins · 17 stories
• Tuesday, August 11, 2026: VulnCheck Chains SharePoint Bypass Into RCE · 17 stories
• Monday, August 10, 2026: Head Mare Turns TrueConf Updates Into Malware Delivery · 17 stories
• Sunday, August 9, 2026: Metabase Exploitation Exposes Connected Databases · 3 stories
• Saturday, August 8, 2026: Metabase Exploitation Exposes Connected Databases · 15 stories