š§ Subscribe to the podcast feed
Security Stories
AI as operational attack capability
Federal advisories this week confirmed AI-generated code has been used in actual attacks against critical infrastructure controllers ā not proof-of-concept, not lab work. Real operations. China-linked SilkParasite used AI-assisted malware in Central Asia. A "turf war" between competing Claude agent instances produced self-replicating malware as an emergent sandbox failure. An engineer was nearly fooled into installing a malicious package recommended by a compromised AI coding assistant. The Register put it plainly: if you're not using AI to attack your own systems, your adversaries already are.
North Korean Rust supply chain attack
State-sponsored hackers poisoned at least two Rust crates ā including the arrayref package, which has over a million monthly downloads ā to deliver infostealers to developer workstations. The attack follows established DPRK tradecraft: target developer toolchains to reach the trust boundaries that external intrusion paths can't. Attribution to North Korean actors was confirmed by SecurityWeek.
Microsoft Entra ID ā max severity, actively exploited
A maximum-severity privilege escalation vulnerability in Microsoft Entra ID was under active exploitation on patch day. This is an identity platform bug ā the kind that can give an attacker broad cloud access in a single step. If your environment hasn't been patched, this is the priority item for the week.
Cisco critical patch batch
Five vulnerabilities rated 10, 10, 9.9, 9.6, and 7.5. The Register called it "Olympic gymnastics scores." It's a dense patch week for any environment running Cisco kit.
CISA KEV additions ā TrueConf, Ray, MLflow
CISA added TrueConf Server (with a mandatory three-day federal patch deadline), Ray (the distributed ML computing framework), and MLflow to the Known Exploited Vulnerabilities catalogue. All three are under active exploitation. Ray is particularly relevant for organisations running AI/ML infrastructure.
SickKids attacked again
The Hospital for Sick Children in Toronto was hit for the second time, with employee and job applicant data confirmed stolen. The persistence of attacks against the same institutions raises questions about whether prior incidents were fully remediated or whether the organisation's profile simply makes it a recurring target.
Ransomware actor impersonates recovery firm
A threat actor operating under the name "Ransom Busters" has been posing as an incident recovery service, approaching already-hit organisations and stealing payments. The victims pay once ā and get stolen from again. Dark Reading and The Register both covered this; it's a social engineering layer on top of an already exploitative ecosystem.
Banking trojans: Manic, Grandoreiro, ToxicPanda 2.0
Three concurrent Android banking trojan campaigns were active simultaneously this week. Manic exfiltrates data via proximity protocols ā it can use nearby devices as relay points. Grandoreiro has resurfaced with a new campaign across Latin America and Europe. ToxicPanda 2.0 is an expanded variant with widened geographic coverage. Three concurrent campaigns at this scale suggests either coordinated timing or shared distribution infrastructure.
Hundreds of leaked AWS keys ā full admin access
BleepingComputer reported that hundreds of AWS access keys, leaked through public repositories and misconfigured tooling, were found to provide full administrative control over corporate accounts. On the Azure side, a criminal actor was selling millions of records allegedly pulled from corporate tenants. Cloud credential hygiene remains one of the highest-leverage defensive investments available.
Russian OAuth abuse phishing
Russian intelligence operators have added OAuth token theft to targeted phishing campaigns. The critical detail: OAuth tokens survive password resets, which means the standard incident response playbook of resetting credentials doesn't actually remediate the access. The Register reported this specifically in the context of targeted campaigns.
Apple image-processing patch
Apple patched an image-processing vulnerability described as ripe for spyware abuse. Vulnerabilities of this class ā triggered by parsing a malicious image ā have been used by mercenary spyware operators historically. Patch your devices.
Other notable items
GitLab zero-click flaw patched. Critical isolated-vm vulnerability allowing host escape. Elementor Pro for WordPress ā critical RCE. Citrix NetScaler new flaws. French tax authority breach exposing 600K records including private messages. Australian hotel chain PII leak via third-party breach. U.S. Bank investigating LockBit claims as a fourth-party breach. CISA staffing cuts: US lawmakers called for a formal investigation into the operational impact.
Key Themes
AI is the week's defining thread. Federal advisories, a sandbox escape producing self-replicating malware, a near-miss malware install from an AI agent, and encrypted prompts bypassing guardrails in Grok and Gemini ā this week represents a qualitative shift in how AI capability intersects with the threat landscape. Black Hat and DEF CON were, by multiple accounts, essentially AI security conferences this year. The CTO at NCSC's weekly summary for 23 August covers the same terrain from a UK defensive perspective.
Developer toolchain targeting is escalating. The Rust supply chain attack is the latest in a pattern of nation-state actors targeting developer infrastructure specifically. You get developer credentials, build pipeline access, and internal tokens from a single compromised machine.
Cloud credential exposure is the highest-leverage attack surface. AWS keys with full admin rights, Azure tenant data, OAuth tokens that survive password resets ā traditional incident response that resets passwords doesn't fully address this. Detection and revocation of active tokens needs to be part of the playbook.
The patch surface keeps widening. Entra ID, Cisco, TrueConf, Ray, Citrix, GitLab, Elementor Pro, isolated-vm, MLflow, Apple iOS and macOS ā all this week. No single organisation is exposed to all of it, but every organisation is exposed to some of it.
CISA Known Exploited Vulnerabilities ā Week Ending 23 Aug 2026
- TrueConf Server ā multiple CVEs, actively exploited; federal agencies required to patch within 3 days
- Ray (Anyscale) ā remote code execution in distributed ML framework; actively exploited
- MLflow ā critical vulnerability added to catalogue