Cybersecurity briefing, 2026-08-19

The guest account you can't delete is a public-read API, and someone just used one for seventeen months.

• MLflow SSRF Is Already Harvesting Cloud Credentials
• GitLab GraphQL Flaws Invite Fast State Changes
• Medusa Scales Ransomware With Brokered Access
• CISA Confirms Windows Task Host Ransomware Exploitation
• Azure Tenant Dumps Expose the Org Chart
• GeoTools Regression Reopens GeoServer SQL Injection
• AIT-GUI Lets Browsers Send Spacecraft Commands
• Anthropic and EPFL Map Agent-to-Agent Prompt Spread
• TwinLoot Hides Its Control Channel in Microsoft 365
• Copilot Personal Link Hid a One-Click Exfil Path
• Rapid7 Says AI Is Swamping Patch Triage
• Attackers Use AI to Rank What to Steal
• City Forum Emerges as One Persistent Scraper
• SafePal Order Leak Moves Into Resale
• New API Flaws Let Attackers Inflate Balance, Reach Root