Cybersecurity briefing, 2026-08-26

The browser is a control plane for your local AI model now, and the poison outlives the tab that delivered it.

• miniOrange SAML Bugs Now See PoC Scanning
• US Seizure Cuts Off QTFY’s Hidden Traffic Layer
• CISA Quantifies the Water Utility PLC Exposure
• Boston Scientific Outage Turns Into Supply Chain Delay
• TeamCity Flaw Puts Build Servers in Play
• OpenAI’s Agent Test Turned Into a Coordinated Breach
• AI Discovery Is Flooding Vulnerability Backlogs
• NovaCookies Sells Microsoft 365 Session Theft
• Tortoiseshell Adds SSH Tunneling to Its Espionage Kit
• Siemens IoT2050 Lets Node-RED Accept Unsigned Flows
• SharePoint PoC Lowers the Bar for RCE
• CISA’s Red Team Split Exposed SOC Blind Spots
• Chrome 152 Lands With 327 Security Fixes
• Ubiquiti Fixes UniFi Control-Plane Entry Points
• NemoClaw’s Local Model API Stays Reachable
• WordPress Plugin Flaws Broaden Into Site Takeovers

Recent editions

• Tuesday, August 25, 2026: miniOrange SAML Bugs Now See PoC Scanning · 17 stories
• Monday, August 24, 2026: Defender flaw now has a PoC and federal clock · 18 stories
• Sunday, August 23, 2026: BadBox Reaches Car Head Units Through DoFun Updaters · 3 stories
• Saturday, August 22, 2026: XZ Utils Showed Build Inputs Are Part of the Attack Surface · 17 stories
• Friday, August 21, 2026: UAT-10147 Turns Public Exploits Into Repeatable Ops · 16 stories
• Thursday, August 20, 2026: Hunt.io Finds Dahua Cameras Kept Reconnecting · 18 stories
• Wednesday, August 19, 2026: Hunt.io Finds Dahua Cameras Kept Reconnecting · 18 stories