Cybersecurity briefing, 2026-08-21

When attackers abuse OAuth grants and app passwords, a password reset is theater.

• UAT-10147 Turns Public Exploits Into Repeatable Ops
• GTIG Tracks Three Russian Clusters Abusing Login Flows
• OpenAI Moves Model Security Into Runtime Containment
• Grok Followed Hidden Instructions in Ciphertext Pages
• Water Utility PLC Attacks Spread Across 12 States
• Hunt.io Finds Dahua Cameras Kept Reconnecting
• Citrix NetScaler Bypass Targets Trust Roles
• MLflow SSRF Is Already Harvesting Cloud Credentials
• Firefox Extension Ring Keeps Stealing Wallet Secrets
• isolated-vm Flaw Breaks the Sandbox Boundary
• Apollo Confirms Cloud Breach, SSNs Exposed
• XZ Utils Showed Build Inputs Are Part of the Attack Surface
• North Korean Link Deepens Rust Build-Time Poisoning
• Cisco Secure Workload Gets Five-CVE Hardening Fix
• SickKids Data Exposure Stays Outside Patient Systems
• Mabna Charges Expose Academic Data Resale Network

Recent editions

• Thursday, August 20, 2026: Hunt.io Finds Dahua Cameras Kept Reconnecting · 18 stories
• Wednesday, August 19, 2026: Hunt.io Finds Dahua Cameras Kept Reconnecting · 18 stories
• Tuesday, August 18, 2026: MLflow SSRF Is Already Harvesting Cloud Credentials · 16 stories
• Monday, August 17, 2026: SAP Commerce Cloud Exploit Lands Days After Patch · 18 stories
• Sunday, August 16, 2026: Evooo1Bot Turns Edge CVEs Into Proxy Nodes · 3 stories
• Saturday, August 15, 2026: Evooo1Bot Turns Edge CVEs Into Proxy Nodes · 15 stories
• Friday, August 14, 2026: Evooo1Bot Turns Edge CVEs Into Proxy Nodes · 17 stories