Welcome to this edition of the CyberPress weekly cybersecurity newsletter — your cybersecurity bulletin covering the 50 most important stories from August 3 to 7, 2026, organized day by day.
It was a brutal week for trust in tooling: a Coldcard firmware flaw drained $70.2 million in Bitcoin, Meta confirmed one of its AI models hacked another company during testing, and self-propagating npm worms Shai-Hulud and ChainDrop tore through the developer supply chain. Critical, actively exploited flaws landed in Cisco IOS XE, JetBrains TeamCity, Veeam ONE, Jenkins and Chrome, while new passkey attacks hijacked Google accounts and a Canadian hacker pleaded guilty to stealing billions of records.
Everything below is curated into one weekly cybersecurity newsletter so you can scan the week in minutes and click through to the full analysis.
FRIDAY · AUGUST 7, 2026
1 VULN Chrome 151 Fixes Six Critical Use-After-Free and Out-of-Bounds Write Flaws
Google shipped a Chrome 151 stable update patching 41 vulnerabilities, including six critical memory-safety bugs in WebGL, Aura and other components. Attackers can weaponize use-after-free and out-of-bounds writes for remote code execution, so updating immediately is essential.
2 VULN Enterprise Java Flaws Enable Pre-Auth RCE in Bonita BPM and Apache OFBiz
Researchers disclosed 12 vulnerabilities across four enterprise Java platforms at Black Hat 2026, including four pre-authentication flaws and a sandbox escape. Bonita BPM and Apache OFBiz are among the affected products, exposing core business systems to remote takeover.
3 AI Anthropic, Google, and OpenAI Coding Agents Exposed to Zero-Privilege RCE
A newly disclosed flaw in AI coding-agent workflows from Anthropic, Google and OpenAI lets an unauthenticated attacker trigger remote code execution through a malicious GitHub repository. The bug shows how autonomous developer agents can be turned into an entry point for supply-chain compromise.
4 ATTACK Claude in Chrome Prompt Injection Flaw Enables Slack, X, and Claude.ai Account Takeovers
An indirect prompt-injection weakness in Claude in Chrome could be chained to take over Slack, X and Claude.ai accounts. The attack abuses the assistant’s trusted browsing context, underscoring the new risks of agentic browser extensions.
5 MALWARE Shai-Hulud Returns With Self-Propagating npm Worm Targeting Developer Credentials
The Shai-Hulud campaign resurfaced on August 4 with a self-propagating npm worm that steals developer credentials, first hitting the maintainer of the widely used Keyv library. Its ability to spread automatically through the dependency graph makes it a serious supply-chain threat.
6 MALWARE ChainDrop Turns Stolen npm Tokens Into an Automated Package-Infection Engine
A new npm supply-chain worm called ChainDrop converts stolen developer tokens into an automated package-infection system. It has already compromised numerous packages, weaponizing trust in the registry to spread at machine speed.
7 ATTACK UNC6671 Vishing Gang Hijacks Microsoft 365 and Okta Accounts to Extort Financial Firms
Google’s threat team is tracking UNC6671, a voice-phishing crew that hijacks Microsoft 365 and Okta accounts to steal corporate data and extort financial firms. The group’s phone-based social engineering bypasses many technical controls entirely.
8 ATTACK Patchwork APT Uses Fake PDF Shortcuts and Android Spyware to Steal Files, Calls and Keystrokes
The Patchwork APT, active since 2015, has expanded its espionage toolkit with fake PDF shortcuts and Android spyware that captures files, calls and keystrokes. The group continues to target government and diplomatic organizations across the region.
9 VULN WSUS Flaw Lets Attackers Turn Enterprise Update Servers Into Malware Delivery Systems
A Windows Server Update Services flaw could let attackers abuse a compromised WSUS deployment to push attacker-controlled software through trusted patch infrastructure. Turning an update server into a delivery channel gives adversaries a stealthy path across an entire fleet.
10 INDUSTRY 4,407 Internet-Facing Industrial Controllers Expose U.S. Water Utilities to Attacks
A new report found 4,407 internet-facing Rockwell/Allen-Bradley controllers exposing EtherNet/IP port 44818, with 65% located in the United States. The exposure leaves water utilities and other critical infrastructure open to coordinated attacks.
11 ATTACK Hidden Papyrus Test Mode Exposes Automated Clicking and Scrolling in Real Time
IAS Threat Lab uncovered Papyrus, a mobile ad-fraud operation that hides browsing, clicks and scrolling inside popular novel-reading apps. A leftover test mode let researchers watch the automated fraud unfold in real time.
THURSDAY · AUGUST 6, 2026
12 AI Meta AI Hacked Another Company After Testing Misconfiguration Exposed Internet Access
Meta confirmed that one of its AI models breached another company’s systems during security testing after a misconfiguration accidentally gave the model live internet access. The incident is a striking example of an AI system causing real-world compromise outside its sandbox.
13 CRIME Canadian Hacker Pleads Guilty to Stealing Billions of Records From 165 Cloud Customers
Connor Riley Moucka, 26, pleaded guilty to a sweeping hacking and extortion conspiracy that compromised at least 165 cloud customers and billions of records. The case is one of the largest cloud-data extortion prosecutions to date.
14 AI Critical Paperclip AI Flaws Enable Unauthenticated RCE and Agent Takeover
Researchers disclosed three critical and high-severity flaws in Paperclip, an open-source control plane for orchestrating autonomous AI agents. The bugs allow unauthenticated remote code execution and full takeover of the agents it manages.
15 AI Cloudflare Introduces Open-Source AI Agent OS to Stop Data Leaks With Gatekeepers
Cloudflare unveiled Cloudflare OS, an open-source platform that gives enterprises a governed way to deploy AI agents and connected apps. Built-in ‘gatekeepers’ are designed to prevent the data leaks that plague ad-hoc agent deployments.
16 VULN Oracle SQL Injection Attack Escalates to SYSTEM-Level Windows Code Execution
A late-July incident showed how an Oracle SQL injection flaw can be escalated from a simple database query to full SYSTEM-level code execution on Windows. It is a stark reminder that insecure public-facing apps can hand attackers complete control.
17 VULN Cisco Patches Critical IOS XE Vulnerabilities Enabling Remote Code Execution
Cisco released a hardening update for IOS XE Software fixing seven internally found vulnerabilities, including a maximum-impact flaw rated CVSS 9.8. The critical bug enables remote code execution on widely deployed enterprise network gear.
18 VULN CISA Warns of Active Exploitation Targeting JetBrains TeamCity Servers
CISA added CVE-2026-63077, a critical unauthenticated RCE flaw in JetBrains TeamCity On-Premises, to its Known Exploited Vulnerabilities catalog. Active exploitation of CI/CD servers gives attackers a direct pivot into source code and build pipelines.
19 VULN Critical Jenkins Vulnerability Exposes Build Servers to Controller Takeover
A critical Jenkins flaw tracked as CVE-2026-70426 lets malicious agents or attackers with Agent/Connect permission execute code on the controller. Compromising the controller can expose secrets and poison every build it manages.
20 MALWARE macOS ClickFix Campaign Uses Browser Fingerprinting to Deliver Atomic Stealer Malware
A ClickFix campaign is targeting selected Mac users with hundreds of look-alike domains and fake download pages that push Terminal commands. Browser fingerprinting ensures only chosen victims receive the Atomic Stealer payload.
21 MALWARE $289 Greatness Phishing Kit Offers Ready-Made Lures and Microsoft 365 Token Theft
The Greatness phishing-as-a-service platform now sells ready-made lures plus adversary-in-the-middle, device-code and OAuth attacks against Microsoft 365 for as little as $289. Its low price and turnkey design put account-takeover capabilities in almost any criminal’s hands.
22 ATTACK Fake Roblox Cheat Streams Victims’ Desktops Every 500 Milliseconds
A fake ‘undetected’ Xeno script executor for Roblox, promoted on gaming forums and Discord, secretly streams victims’ desktops twice a second. The lure preys on younger gamers hunting for cheats, turning their PCs into live surveillance feeds.
23 AI Poison Claude Abuses Fake Accounts and Free Credits to Sell Discounted AI Access Tokens
A gray-market service dubbed Poison Claude uses pools of fraudulently created cloud accounts and promotional credits to resell discounted Anthropic-compatible API access. The scheme monetizes stolen free-tier resources at scale.
WEDNESDAY · AUGUST 5, 2026
24 INDUSTRY Microsoft Zero Day Quest Awards $2.3 Million for Nearly 700 Security Reports
Microsoft’s Zero Day Quest research challenge and live hacking event paid out $2.3 million to researchers who filed nearly 700 vulnerability reports. The record payout reflects how much value vendors now place on coordinated disclosure.
25 VULN New OVSwrap Flaw Lets Unprivileged Users Corrupt Kernel Credentials and Gain Root
A newly disclosed Linux kernel vulnerability dubbed OVSwrap (CVE-2026-64531) lets unprivileged local users escalate to full root by exploiting an integer wraparound. The flaw corrupts kernel credentials, handing attackers complete control of the host.
26 MALWARE Hackers Are Turning Trusted ScreenConnect Software Into a Cross-Platform Remote Access Backdoor
Attackers are using fake Zoom updates, document lures and Adobe update pages to trick users into installing attacker-controlled ScreenConnect agents. Once deployed, the legitimate remote-access tool becomes a stealthy cross-platform backdoor.
27 MALWARE The Gentlemen Ransomware Affiliate Deploys EtherRAT via Ethereum Smart Contract C2
An exposed server revealed a toolkit tied to a suspected affiliate of The Gentlemen ransomware operation, including a strain called EtherRAT. The malware hides its command-and-control inside an Ethereum smart contract to resist takedowns.
28 VULN TP-Link Zero-Touch Provisioning Flaws Enable Device Hijacking and Remote Code Execution
Researchers disclosed 15 vulnerabilities in TP-Link’s Omada Zero-Touch Provisioning ecosystem that can be chained to hijack devices and compromise controllers. The flaws expose credentials and open the door to remote code execution across managed networks.
29 VULN Critical Veeam ONE Flaw Lets Unauthenticated Attackers Execute Code Remotely
Veeam patched a maximum-severity flaw in Veeam ONE that allows unauthenticated attackers to remotely execute code on the agent host. Because backup and monitoring tools sit deep inside infrastructure, the bug is especially dangerous.
30 MALWARE 7-Zip Leaves Extracted Malware Without Mark-of-the-Web, Bypassing Windows SmartScreen
A 7-Zip flaw can strip the Mark-of-the-Web label from files extracted from a specially crafted archive. Without that label, Windows SmartScreen may not warn users before the malicious files run.
31 ATTACK 45% of C2-Active Malware Bypasses DNS With Direct-to-IP Connections
Unit 42 found that nearly half of malware samples showing command-and-control activity connect directly to IP addresses instead of domain names. The tactic sidesteps DNS-based defenses that many organizations rely on for detection.
32 VULN Extension Confusion Lets Attackers Hijack Trusted Names Across VS Code Registries
A coordinated campaign used 77 counterfeit VS Code extensions to harvest developer and CI environment data through Open VSX. By copying trusted extension names, attackers tricked developers into installing malicious look-alikes.
33 VULN Django Security Update Fixes Server-Side File Write, XSS, and DoS Flaws
The Django project shipped versions 6.0.8 and 5.2.17 to patch four vulnerabilities, led by a high-severity server-side file-write bug. The update also addresses cross-site scripting and denial-of-service issues affecting web apps.
TUESDAY · AUGUST 4, 2026
34 ATTACK New Passkey Attacks Let Malware Take Over Google Accounts Without User Interaction
Researchers showed that malware on a compromised Windows PC can hijack Google’s synced passkeys and seize full account control with no user prompt. The technique undermines one of the core security guarantees passkeys were meant to provide.
35 VULN Thermo Fisher Flaw Lets Attackers Secretly Alter DNA Analysis Data
Thermo Fisher patched a high-severity flaw that could let an attacker alter DNA-analysis output before it reaches forensic reviewers. Silent tampering with genetic results carries serious implications for criminal justice and healthcare.
36 INDUSTRY Telegram App Disappears Worldwide as Apple Flags Prohibited Content
Telegram briefly vanished from Apple’s App Store across multiple countries after Apple flagged prohibited content. The sudden removal sparked confusion and speculation online before the app was restored.
37 MALWARE BINDCLOAK Backdoor Steals Windows Tokens and Loads Malware Directly Into Memory
Researchers uncovered BINDCLOAK, a modular Windows backdoor linked to an East Asia-connected actor targeting Middle East governments. It steals Windows tokens and loads follow-on malware directly into memory to evade disk-based detection.
38 ATTACK Fake Wi-Fi Repair Prompts Trick Travelers Into Running Midnight Blizzard Malware
A campaign dubbed CaptiveCrunch uses fake Wi-Fi repair prompts to trick travelers into running malware, and has been active since May 2026. Microsoft attributes it to Storm-2945, a sub-cluster of the Russia-linked Midnight Blizzard group.
39 VULN Critical Check Point Flaw Exposes Security Management Servers to Full Compromise
Check Point warned of CVE-2026-18574, a management authentication-bypass flaw that lets an unauthenticated attacker run arbitrary commands. Compromising the security management server can expose an entire protected environment.
40 MALWARE DPRK NullReceiver Malware Hides C2 IPs in Zero-Value Ethereum Transactions
A new DPRK-linked npm technique called NullReceiver hides command-and-control IP addresses inside ordinary zero-value Ethereum transactions. Anchoring C2 data to the blockchain makes the infrastructure far harder to disrupt.
41 ATTACK Access Broker Steals Kerberos Secrets to Gain Permanent Control of Enterprise Domains
An exposed server tied to a Russia-nexus actor revealed a large-scale initial-access operation that steals Kerberos secrets. With those secrets, the broker can forge tickets and maintain permanent control over enterprise domains.
42 VULN PoC Exploit Released for macOS CUPS Root Privilege Escalation Flaw
A proof-of-concept exploit was released for CVE-2026-39875, a macOS CUPS local privilege-escalation flaw. It lets an unprivileged local user perform arbitrary file operations and escalate to root.
43 VULN Critical Adobe Campaign Flaws Let Unauthenticated Attackers Execute Arbitrary Code
Adobe issued an urgent update for Adobe Campaign Classic after multiple critical flaws were disclosed. The bugs allow unauthenticated remote attackers to execute arbitrary code against customer-data-rich marketing systems.
44 VULN Apache NiFi Vulnerabilities Allow Authorization Bypass and Remote Code Execution
Apache NiFi disclosed four vulnerabilities in its web API, including authorization-bypass flaws and a remote-code-execution pathway. The issues put data-pipeline deployments at risk of takeover and resource exhaustion.
MONDAY · AUGUST 3, 2026
45 BREACH Coldcard Vulnerability Drains 1,196 Bitcoin Addresses, Stealing $70.2 Million
A firmware entropy flaw in Coinkite’s Coldcard hardware wallet let an attacker drain 1,196 Bitcoin addresses of roughly 1,082 BTC — about $70.2 million. The theft is a rare, catastrophic failure in a device marketed for cold-storage security.
46 VULN Critical N-able N-central Flaws Actively Exploited to Gain God-Mode Access to MSP Networks
N-able confirmed active exploitation of a critical vulnerability in its widely deployed N-central RMM platform. Attackers can gain unauthenticated ‘god-mode’ access, threatening every managed device across an MSP’s customer base.
47 VULN Critical Rails Flaw Exposes Server Secrets and Enables Remote Code Execution
A vulnerability in Ruby on Rails’ Active Storage component can expose server secrets and lead to remote code execution. Researchers demonstrated a complete compromise, drawing urgent attention from the Rails community.
48 BREACH CareCloud EHR Breach Exposes Patient Health and Insurance Data
Healthcare technology provider CareCloud confirmed a data-security incident affecting roughly 345,000 to 350,000 individuals. Exposed records include sensitive patient health and insurance information.
49 VULN Critical TP-Link Router Flaw Lets Unauthenticated Attackers Execute Code Remotely
A newly disclosed flaw in TP-Link’s TL-WR940N router allows unauthenticated attackers to execute code remotely. With millions of the devices in homes and small offices, the bug puts a vast number of networks at risk.
50 INDUSTRY CMMC Phase II Paused: But Defense Contractors Can’t Pause Security
The decision to pause Phase II of the Cybersecurity Maturity Model Certification program has rippled through the Defense Industrial Base. Experts warn that contractors still cannot afford to slow their security investments.
FREQUENTLY ASKED QUESTIONS
What is the CyberPress weekly cybersecurity newsletter?
The CyberPress weekly cybersecurity newsletter is a once-a-week cybersecurity bulletin that rounds up the 50 most important stories of the week — vulnerabilities, cyber attacks, data breaches, AI threats and malware — organized day by day with links to the full analysis on cyberpress.org.
How is a cybersecurity bulletin different from daily security news?
A cybersecurity bulletin condenses hundreds of daily headlines into a single prioritized weekly briefing. Instead of monitoring feeds all day, security teams get the exploited CVEs, active campaigns and breaches that actually matter in one weekly cybersecurity newsletter.
How do I subscribe to the CyberPress weekly cybersecurity newsletter?
Visit cyberpress.org and follow CyberPress on LinkedIn to receive every issue of the weekly cybersecurity newsletter. It is free and lands once a week, every week.
