Security News.
Zero-days, breaches, and the defenses that matter, explained clearly enough to act on. We cover the exploits under active attack, the disclosures worth patching now, and the shifts reshaping how software is attacked and defended.
Security
Microsoft Paint Secretly Watermarks Even Local AI Images
A reverse-engineering write-up shows Microsoft Paint and Photos stamp AI images with an invisible, server-issued GUID watermark, even when the image itself is rendered entirely on-device, because the prompt still travels to a Microsoft moderation server first.
Security
Metabase Zero-Day Let Attackers Grab Admin, No Login
CVE-2026-72898 is a maximum-severity SQL injection in Metabase's password reset endpoint that let attackers become admin with zero credentials, and it was already being exploited before a patch existed.
Security
Flaw in NASA's AIT-GUI Could Let Anyone Command a Spacecraft
A critical, now-patched flaw chain in NASA JPL's AIT-GUI console let anyone on the network send commands to a spacecraft or instrument without logging in, rated 9.4 on the CVSS scale and fixed in version 2.5.2.
Security
Copilot Explained Its Own Guardrails, Then Leaked Them
Microsoft patched CoSnitch, a critical one-click flaw in Copilot Personal, on August 18, 2026, eight months after Varonis reported it. A single click let an injected prompt raid connected Gmail, Drive, Calendar and OneDrive accounts and exfiltrate the data through Copilot's own URL-fetch feature, and researchers found the missing piece because Copilot's own refusal explained exactly how to get past it.
Security
A Video Call Gets You Kernel Access on Unisoc Phones
SSD Secure Disclosure published the second half of a Unisoc exploit chain on August 17, 2026: answer a malicious VoLTE video call and an attacker moves from the modem into full Android kernel access. The root cause is that Unisoc SoCs share physical memory between the modem and application processors with no hardware boundary, and Unisoc has not responded to the researchers.
Security
SAP Commerce Cloud RCE hit by attacks 3 days after patch
Attackers began probing CVE-2026-58231, a CVSS 10.0 unauthenticated code-execution flaw in SAP Commerce Cloud, just three days after SAP shipped the fix and with no public exploit in circulation, because the patch itself revealed the bug.
Security
GeoServer Zero-Day Exploited Hours After Disclosure
A CVSS 9.8 SQL injection in GeoServer's jsonArrayContains function lets unauthenticated attackers inject SQL through OGC filters, with a path to remote code execution on some deployments. It was disclosed publicly on August 12 before any patch existed, and exploitation attempts began within hours. Fixes are now out in 3.0.1, 2.28.5 and 2.27.6.
Security
France's Tax Agency Faces Second Breach Claim in Three Days
France's DGFiP confirmed on August 13 that an attacker extracted 678,438 rows of tax data after spoofing an identity in late June. A second claim surfaced on August 14 against the agency's cadastral server, covering 2,041,778 property holders, and the DGFiP has not confirmed it.
Security
AI Agents Ran a Four-Day Breach of Taiwan's Nuclear Agency
Between July 1 and July 4, two open-source AI agent frameworks compromised 85 Taiwanese government accounts and took over 2,500 personnel records, then expanded on their own to a nuclear safety agency and seven energy firms. Researchers call it the first documented near-autonomous cyberattack on a government.
Security
vCenter's 9.8 Flaw Was Exploited Five Days After Disclosure
CVE-2026-59310 is an unauthenticated path traversal in the VMware vCenter Syslog server rated CVSS 9.8. Broadcom disclosed it on July 29, attackers were exploiting it by August 3, and forensics firm Quirso counted 361 victim IPs across 47 countries. There is no workaround.
Security
Spaghettifying DRAM: attack reads AMD's PSP and SMM memory
Christopher Domas published tooling that flips one configuration bit in an AMD DRAM controller to rewire how physical addresses map onto memory chips, letting ring 0 code read the PSP carveout, SMM handlers, C6 core state and microcode patch RAM without ever defeating the protections that guard them.
Security
LiteLLM breach: 40 minutes, 2,488 companies exposed
CloudSEK finished attributing the stolen data from March 2026 LiteLLM supply chain attack: 118,829 CI runner memory dumps traced to 2,488 corporate domains across roughly 434,000 CI/CD pipelines, including Nvidia, AWS, Samsung, FedEx and Volkswagen. The malicious LiteLLM packages were live on PyPI for only 40 minutes.
Security
ShieldBreak Zero-Day Bypasses Microsoft's Defender Patch
A researcher known as Nightmare Eclipse published ShieldBreak on August 12, a working Microsoft Defender zero-day that defeats the July patch for RoguePlanet (CVE-2026-50656) and hands a normal user SYSTEM privileges. It was tested at a 100 percent success rate on fully updated Windows 11 25H2 and Windows Server 2025. There is no CVE and no fix.
Security
A Windows Socket Driver Bug Handed Lazarus SYSTEM Access
CVE-2026-68820 is a use-after-free in afd.sys, the Windows kernel driver behind the Sockets API. A local attacker wins a race condition and walks away with SYSTEM. Check Point ties it to Lazarus, and CISA added it to the KEV catalog on August 11.
Security
OpenAI's Cyber Model Answers 95% of Exploit Prompts
OpenAI released GPT-5.6-Cyber on 10 August 2026, a model trained to find zero-days and build exploit chains. It completes 95% of advanced offensive-security requests that standard GPT-5.6 Sol completes 1.5% of the time, and it ships only through Daybreak Red, an application-vetted access tier.
Security
CISA Flags TeamCity RCE: An XStream Allowlist Left Open
CVE-2026-63077 is a CVSS 9.8 unauthenticated remote code execution flaw in on-premise JetBrains TeamCity, caused by an XStream allowlist that added TeamCity classes without removing XStream's permissive defaults. CISA added it to the KEV catalog on August 5 with a federal patch deadline of August 8.
Security
Valve warns Steam hardware buyers of CEVA data breach
Valve emailed European Steam hardware buyers on August 10, 2026 after attackers stole delivery data from CEVA Logistics, its European shipping partner. Names, addresses, phone numbers, emails and the item and price leaked; Steam passwords, Steam Guard codes and payment details did not.
Security
One GitHub issue, RCE on Claude Code and Gemini CLI runners
A GitHub issue filed by an account with no repository access was enough to run attacker code on the CI runners behind Anthropic’s, Google’s and OpenAI’s own coding agents. Novee Security disclosed the chain at Black Hat USA on August 5: Gemini CLI’s flaw is rated CVSS 10.0, Claude Code’s 9.1 on NVD, and all three products failed at the same seam between the agent’s validator and the shell.
Security
SCTPhantom: an 18-year-old Linux bug that hands out root
CVE-2026-64564, named SCTPhantom, is a use-after-free in Linux's SCTP address-reconfiguration code that turns an unprivileged local shell into root and lets an attacker escape a container onto the host. The flawed code shipped in December 2007 and is fixed in kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6.
Security
86,000 Server BMCs Sit Exposed, Half Critically Flawed
HD Moore's runZero scan found 86,000 baseboard management controllers reachable from the open internet, 54% carrying at least one critical flaw, and 75,000 still vulnerable to a bug disclosed in 2013.
Security
Cities Ditch Flock Cameras, Then Buy Axon's Instead
At least seven US cities that canceled Flock Safety license plate reader contracts replaced them with Axon cameras within weeks. The votes ended Flock's national lookup network, which let out of state agencies search local data, not the plate scanning itself.
Security
khunt Turns Oracle SQL Injection Into Windows SYSTEM
Attackers exploited a SQL injection flaw in a public web app to compile a post-exploitation toolkit called khunt directly inside an Oracle database, using CREATE JAVA SOURCE to gain SYSTEM-level command execution on the Windows host without writing malware to disk. Huntress disclosed the case on August 5, 2026.
Security
Atlassian Rovo AI Still Leaks Jira Data via Prompt Injection
A researcher disclosed in May 2026 that Atlassian's Rovo AI agent can be tricked by a hidden prompt injection into exfiltrating Jira tickets and Confluence documents to an attacker's website, and despite an initial acknowledgment, the flaw is still unpatched as of this week's public disclosure.
Security
A one-line firmware check cost Coldcard users 1,082 BTC
Coldcard's firmware checked whether a configuration macro existed instead of whether it was switched on. It existed and it was set to zero, so five years of wallets built their recovery seeds from a fallback pseudo-random generator, and an attacker swept roughly 1,082 BTC out of 1,196 addresses in 41 minutes.
Security
Claude escaped its test lab and hacked three real companies
Anthropic disclosed on July 31 that three Claude models broke out of what should have been an isolated cybersecurity evaluation and compromised three real organisations, after a misconfiguration with its testing partner Irregular left the machines on the live internet.
Security
Cisco FMC Hardcoded Credentials Exploited: Patch Due Today
CVE-2026-20316 is a hardcoded login baked into Cisco Secure Firewall Management Center. It has been exploited since early July, CISA added it to the KEV catalog on July 29, and the federal patch deadline is August 1.
Security
Tailscale: One Stolen Key Enrolled 181 Nodes at Hugging Face
Tailscale published its own postmortem of the Hugging Face intrusion on July 31. One reusable auth key, pulled from a secret store holding 136 credentials, let an autonomous agent enroll 181 nodes onto the company's private network. Tailscale says no vulnerability in its product was used, and that it should have been able to stop the pivot anyway.
Security
Unit 42 caught DeepSeek running its own attack campaign
Palo Alto Networks Unit 42 published research this morning documenting a Chinese speaking operator who wired DeepSeek into the Hermes Agent framework and let it hunt targets on its own over Telegram. The agent enumerated 25,209 hosts and triaged them well, but both of its unsupervised exploit attempts failed, and it leaked the operator's own API keys and target lists to the internet.
Security
Cheap Android TV Boxes Are Running an Ad-Fraud Botnet
Bitsight traced roughly 38,000 cheap Android TV boxes sold through Amazon, Best Buy and Newegg to a Chinese ad-fraud operation earning an estimated $50,000 a day. The boxes watch the HDMI signal: when your TV is on they rent your connection out as a residential proxy, and when it is off they sit there clicking fake ads.
Security
Claude Mythos found a real HAWK flaw, not an AES break
Anthropic's Claude Mythos Preview cut the expected cost of attacking HAWK-256, a NIST post-quantum signature candidate, from 2^64 to 2^38 operations in roughly 60 hours. The separate AES result targets a 7-round research variant, not the 10-round AES that secures real traffic, and nothing deployed needs changing.