Cybersecurity briefing, 2026-08-24

Removing a poisoned dependency is not remediation.

• XZ Utils Showed Build Inputs Are Part of the Attack Surface
• Grok Followed Hidden Instructions in Ciphertext Pages
• GitLab Exploitation Turns Repo History Into a Target
• OpenAI Moves Model Security Into Runtime Containment
• NCSC and Meta Show Approved AI Can Still Leak Data
• Citrix NetScaler Bypass Targets Trust Roles
• North Korean Link Deepens Rust Build-Time Poisoning
• Check Point Finds a Signed Windows Kernel Abuse Path
• isolated-vm Flaw Breaks the Sandbox Boundary
• CyberSheath Survey Shows SPRS Scores Losing Trust
• Atlassian Fans One Library Fix Across Its Stack
• Agent Tesla Hides in Emoji-Laced Finance Lures
• CISA Turns Logging into an Operating Blueprint
• SickKids Data Exposure Stays Outside Patient Systems
• Leaked AWS Keys Stay Live for Years