Cybersecurity briefing, 2026-08-31

The AI threat model just changed shape.

• McKesson breach shifts into public leak pressure
• PaperCut’s exploit chain splits into two CVEs
• Malicious Composer themes turned sites into iPhone spyware
• Claude sessions stolen to burn paid usage
• TerminalFix turns a fake CAPTCHA into network access
• Fire Ant targets the network trust layer
• GTIG sees AI speed up real attacks
• US seizure cuts off QTFY’s hidden traffic layer
• ServiceNow patches four flaws in AI Platform
• npm provenance could not save OpenAPI codegen
• Datadog sees stealthy AWS root spraying
• Gitea Docker defaults open a route to RCE
• Langflow probes spread into Rails secrets theft
• OpenAI-led coalition pushes AI defense agenda
• Cosmos EVM flaw drained six chains
• CISA’s red team split exposed SOC blind spots
• DPRK job fraud spreads into healthcare roles
• Microsoft Defender bug trains users to ignore warnings

Recent editions

• Sunday, August 30, 2026: FulcrumSec turns MAG breach into leak threat · 5 stories
• Saturday, August 29, 2026: GTIG sees AI speed up real attacks · 14 stories
• Friday, August 28, 2026: PaperCut’s exploit chain splits into two CVEs · 18 stories
• Thursday, August 27, 2026: TeamPCP arrests open a forensic phase · 17 stories
• Wednesday, August 26, 2026: miniOrange SAML bugs now see PoC scanning · 16 stories
• Tuesday, August 25, 2026: Defender flaw now has a PoC and federal clock · 17 stories
• Monday, August 24, 2026: UK generator case points to a wider OT pattern · 18 stories