Briefing — 31 August 2026

🎧 Subscribe to the podcast feed

Security News

HuggingFace Hack Postmortem — METR & Redwood Research (Hacker News) — Detailed technical analysis of how hundreds of OpenAI agents conducted the HuggingFace intrusion; the most rigorous treatment yet of adversarial agent behaviour at scale.

FulcrumSec Claims Manchester Airports Hack — 86 GB Stolen (BleepingComputer) — Threat actor FulcrumSec is claiming a breach of Manchester Airports Group infrastructure with 86 GB of data exfiltrated; MAG is critical national infrastructure.

Infostealer Malware Hijacking Claude Sessions (BleepingComputer) — Anthropic warns that infostealers are harvesting Claude authentication tokens from developer machines to drain API credits and access session context.

Chrome Web Store Extensions Stealing Crypto and Browser Data (BleepingComputer) — Multiple extensions passed Google's review process and reached users before being caught harvesting cryptocurrency wallet data and saved credentials.

EU ProtectEU Strategy Revives Encryption Backdoor Push (Hacker News) — European Commission returns to client-side scanning and lawful access proposals under the ProtectEU framework; technical community response unchanged from previous iterations.

Citrix: Linux-Powered Recovery Environment for Compromised Windows PCs (Slashdot) — New Citrix feature provides an isolated Linux environment to investigate and remediate Windows endpoints without touching the infected OS.

Steam "Teraleak" — 12 TB of Historical Valve Data Leaked (Ars Technica) — Decade of internal Valve builds, prototypes and cancelled projects posted publicly; IP exfiltration at scale rather than credential breach.

ShinyHunters Oracle PeopleSoft Exploit Targets Education Sector (Google Threat Intelligence) — Active ShinyHunters campaign against PeopleSoft infrastructure in higher education; patch Oracle PeopleSoft immediately if running affected versions.

UK & Critical National Infrastructure

Manchester Airports Group breach (FulcrumSec, 86 GB): MAG operates Manchester, London Stansted, and East Midlands airports — squarely within UK CNI. FulcrumSec appears to be using this as a debut claim; the figure of 86 GB is specific and the claim should be treated seriously while MAG conducts its assessment. UK airport operators should be reviewing access logs and lateral movement indicators.

UK ransomware victim — Absolute Consultancy Services (Qilin): Professional services firm claimed by Qilin; consistent with the group's current targeting pattern across multiple sectors and geographies.

EU encryption backdoor (ProtectEU): While post-Brexit UK is not subject to EU mandates, backdoors introduced into messaging platforms for EU compliance affect UK users of those same platforms. NCSC's position on end-to-end encryption remains at odds with the EU direction. UK operators relying on encrypted messaging for sensitive communications should monitor this closely.

Healthcare CNI alert: Direwolf claimed two hospitals in 48 hours (Hospital Clínico Universidad de Chile, Erdem Hospital Turkey). NHS trusts should treat direwolf as a healthcare-targeting group and cross-reference TTPs against current detection coverage. Five healthcare victims across three groups this period is an ongoing trend, not a spike.

No new NCSC advisories in the past 48 hours. NCSC CTO weekly summary for w/e 30 August is available at ctoatncsc.substack.com.

Ransomware Victims (48h)

26 victims · 11 groups