Briefing — 8 August 2026

🎧 Subscribe to the podcast feed

Security News

Metabase SQLi zero-day exploited in customer data-theft attacks (BleepingComputer) — A SQL injection zero-day in Metabase is being actively exploited; Framework and Tally have both disclosed breaches via a compromised Metabase BI instance, with Framework notifying all customers.

Unlimited Technology Systems breach impacts 3.8 million people (BleepingComputer) — A breach at Unlimited Technology Systems has exposed personal data belonging to 3.8 million individuals, making it one of the larger individual disclosures this week.

Levi Strauss & Co. says hackers stole corporate data in cyberattack (BleepingComputer) — Levi Strauss has disclosed a targeted cyberattack in which threat actors exfiltrated corporate data; scope and attribution remain unclear.

Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks (The Register) — Following suspected Iranian attacks on US water utilities, a former NSA director stated plainly that OT controllers have no business being internet-facing.

Water utilities group partners with DEF CON offshoot for Water Watch Center (The Record) — A new Water Watch Center will provide dedicated sector-wide threat monitoring, born from a partnership between the water utilities sector and a DEF CON community group.

N-able God mode flaw: attackers reached customer networks as second hotfix lands (The Register) — A critical privilege-escalation vulnerability in N-able's MSP platform was exploited in the wild, with the vendor confirming attackers pivoted into managed customer networks; a second hotfix has been issued.

Ransomware attacks spike as world distracted by AI (The Register) — New reporting highlights a significant uptick in ransomware activity, with researchers noting that enterprise security attention has been fragmented by AI adoption initiatives.

MIT TONTOU attack slips through Spectre defenses on Intel and AMD CPUs (The Register) — MIT researchers have demonstrated TONTOU, a new side-channel attack that bypasses current Spectre mitigations on both Intel and AMD processors, warranting fresh enterprise patch evaluation.

AI-Generated Patches Fail Half the Time (Dark Reading) — New research finds that AI-generated security patches are ineffective approximately 50% of the time, raising concerns about over-reliance on automated remediation pipelines.

Military device manufacturer discloses cyber incident to SEC (The Record) — A manufacturer of military devices has filed an SEC disclosure following a cybersecurity incident, though details on scope and attribution remain limited.

Inside the Modern SOC: The Identity Front Door (Unit 42) — Palo Alto's Unit 42 publishes analysis of how identity-based attacks have become the primary initial access vector facing modern security operations centres.

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET (Microsoft Security Blog) — Microsoft details how Defender for Endpoint detected and disrupted a ransomware attack at QNET within 128 seconds of initial execution, showcasing automated response capabilities.

Ransomware Victims (48h)

Today's Picks

• Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover (Semperis) — Research detailing CVE-2026-25177 and CVE-2026-27912, two Active Directory flaws that chain to enable Kerberos downgrade, denial of service, and complete domain takeover.
• Borrowing Windows Hello keys for authentication and persistence (Dirk-jan Mollema) — Dirk-jan Mollema's deep dive into how Windows Hello for Business keys can be borrowed via the Passport KSP for authentication and long-term persistence in Entra ID environments.
• Detect Windows Hello Key Borrowing for Authentication and Persistence (Steven Lim / @0x534c) — KQL detection queries built on Mollema's research to identify Windows Hello key borrowing activity in Microsoft Sentinel or Defender logs.