Cybersecurity briefing, 2026-08-25

When an exploit can forge your git history, your audit log records the attacker's story, not yours.

• miniOrange SAML Bugs Now See PoC Scanning
• Defender flaw now has a PoC and federal clock
• CISA Turns Logging into an Operating Blueprint
• WordlistLoader and SynkLoader Abuse Trusted Surfaces
• Leaked AWS Keys Stay Live for Years
• Paylogix Breach Spreads Past One Vendor
• Doubloon Dredger Hijacks Notion Trust for Token Theft
• UK Generator Case Points to a Wider OT Pattern
• npm Mirrors Became Persistent Phishing Hosting
• Firefox Extension Ring Keeps Stealing Wallet Secrets
• TeamCity Flaw Puts Build Servers in Play
• Keycloak Reset Bypass Now Means Account Takeover
• Apollo Confirms Cloud Breach, SSNs Exposed
• Interpol’s Black Axe Sweep Targeted the Money Trail
• ShinyHunters Leak Fueled a Fake Security Pitch
• Sponsored Search Drives Fake Codex Mac Malware
• NemoClaw’s Local Model API Stays Reachable

Recent editions

• Monday, August 24, 2026: Defender flaw now has a PoC and federal clock · 18 stories
• Sunday, August 23, 2026: BadBox Reaches Car Head Units Through DoFun Updaters · 3 stories
• Saturday, August 22, 2026: XZ Utils Showed Build Inputs Are Part of the Attack Surface · 17 stories
• Friday, August 21, 2026: UAT-10147 Turns Public Exploits Into Repeatable Ops · 16 stories
• Thursday, August 20, 2026: Hunt.io Finds Dahua Cameras Kept Reconnecting · 18 stories
• Wednesday, August 19, 2026: Hunt.io Finds Dahua Cameras Kept Reconnecting · 18 stories
• Tuesday, August 18, 2026: MLflow SSRF Is Already Harvesting Cloud Credentials · 16 stories