Cybersecurity briefing, 2026-08-19

The guest account you can't delete is a public-read API, and someone just used one for seventeen months.

• Hunt.io Finds Dahua Cameras Kept Reconnecting
• Clop’s Windchill Backdoor Turns Credentials Loose
• GitLab Exploitation Turns Repo History Into a Target
• AI Tools Turn Siemens PLC Exposure into Control Risk
• Medusa Turns Brokered Access Into Faster Intrusions
• MLflow SSRF Is Already Harvesting Cloud Credentials
• SilkParasite Fields Five New RATs in Central Asia
• CISA Confirms Windows Task Host Ransomware Exploitation
• Azure Tenant Dumps Expose the Org Chart
• GeoTools Regression Reopens GeoServer SQL Injection
• AIT-GUI Lets Browsers Send Spacecraft Commands
• Ransom Busters Adds a Fake Recovery Layer
• UT San Antonio Cut Systems Offline Before Term
• Froxlor API Leak Exposes Password Hashes and 2FA Seeds
• Oracle EBS Patches 120 Flaws Across Core Modules
• Black Kite Finds Ransomware Still Prefers Mid-Market Manufacturers
• Microsoft Expands MacSync Beyond Rotating C2 Domains
• AI Agents Broke Out Through Small Weaknesses

Recent editions

• Tuesday, August 18, 2026: MLflow SSRF Is Already Harvesting Cloud Credentials · 16 stories
• Monday, August 17, 2026: SAP Commerce Cloud Exploit Lands Days After Patch · 18 stories
• Sunday, August 16, 2026: Evooo1Bot Turns Edge CVEs Into Proxy Nodes · 3 stories
• Saturday, August 15, 2026: Evooo1Bot Turns Edge CVEs Into Proxy Nodes · 15 stories
• Friday, August 14, 2026: Evooo1Bot Turns Edge CVEs Into Proxy Nodes · 17 stories
• Thursday, August 13, 2026: CISA’s KEV Update Spans Four Live Exploits · 18 stories
• Wednesday, August 12, 2026: Gunra Shifts Ransomware to Perimeter Break-ins · 17 stories