OpenAI Paused Its Own Model. The Harness Is the Product Now.

Passkeys took three independent hits in one week — synced private keys recovered, phishing-resistant MFA satisfied without the key. Three separate research efforts landed together. SpecterOps’ Michael Grafnetter showed “Pass-the-Passkey”: Windows stored prior YubiKey assertions in cleartext readable by an unprivileged user (CVE-2026-34348, an Event Logging Service information disclosure), and chaining that signed material with Entra ID weaknesses let an attacker impersonate privileged users while satisfying a phishing-resistant MFA policy — no key extraction required. Palo Alto Unit 42’s “Pass-ta-key” work found the 32-byte Security Domain Secret that protects synced passkeys exposed in Chrome device logging and resident in process memory during re-registration, allowing recovery of synced private keys with only endpoint malware and no admin escalation — and there is no rotation or revocation path for that secret. Dirk-jan Mollema separately showed low-privilege processes in a compromised session can use non-exportable Windows Hello keys without a fresh PIN or biometric, with Entra WebAuthn challenges valid for five minutes and unbound to session, user or tenant. Microsoft has applied mitigations for relayed passkey assertions. (The Hacker News, covering SpecterOps, Unit 42 and Mollema)

So what: nobody should read this as “passkeys are broken” — every one of these needs a foothold or a specific platform defect, and passkeys still kill credential phishing at scale. Read it as the end of passkeys as a terminal control: if the endpoint is owned, phishing-resistant MFA is a speed bump, and a secret with no revocation path is a permanent one. Hunt for assertion reuse, shorten challenge validity where you can, and stop letting “we deployed passkeys” close the identity risk item.

CISA confirms ransomware crews are now the main users of the SonicWall SMA1000 flaws. CISA updated its position on CVE-2026-15409 (CVSS 10.0, unauthenticated SSRF in the SMA 1000 Workplace interface) and CVE-2026-15410 (CVSS 7.2, post-authentication code injection in the management console), confirming ransomware operators are exploiting them. Both were added to the Known Exploited Vulnerabilities catalog on July 14 with a three-day federal remediation deadline after zero-day exploitation traced to June 22; INC Ransomware has since become the dominant actor, and reporting on the intrusions describes theft of credentials, active session databases and TOTP MFA seeds for durable re-entry. Shadowserver still counts 380+ SMA1000 instances exposed online. (BleepingComputer; The Hacker News; SecurityWeek; CISA KEV)

So what: the patch was available a month ago and the appliances are still out there, which makes this an asset-inventory failure, not a patching one. And note what was stolen — session databases and MFA seeds. Patching the box does not evict the attacker; rotate seeds, invalidate sessions, and treat any SMA1000 that was internet-facing in July as compromised until you can prove otherwise.

Quieter but worth a scan. Cisco disclosed high-severity ClamAV flaws letting unauthenticated remote attackers trigger denial of service, with public proof-of-concept code already circulating; and researchers found critical flaws in the Belgian eID software used by eight major banks and 60+ government agencies, covering roughly two million people. Microsoft’s August Patch Tuesday releases this afternoon US time and is not included here — July’s record was 621 CVEs, so plan capacity accordingly. (SecurityWeek)

So what: the eID one is the interesting shape — national identity middleware is critical infrastructure that nobody owns operationally. If you consume a government identity stack anywhere in your authentication chain, you inherited someone else’s patch cycle.

“Ghostjacking”: your logs are an instruction channel into your AI agents, and it works 9 times out of 10. Tenet Security demonstrated at DEF CON that an external attacker can plant instructions as ordinary text in logs and alerts from trusted platforms, and AI agents reading that telemetry will act on the instructions. The demonstrated paths are all mundane: one edge platform logs blocked requests verbatim, so a blocked request becomes the payload and the agent alters DNS settings; a planted “urgent diagnostic” alert in a monitoring platform triggers code execution; a crafted report leads an error-tracking platform’s AI agent to adopt a bogus fix that downstream agents then execute. The researchers report roughly 90% success against one popular coding agent and also demonstrated one AI composing attacks for another to run; one vendor fixed a related desktop data-exfiltration issue without a CVE. Their framing is the right one: an AI reads outside data it trusts and can also act on it, and wherever those two meet, the door is open. (SecurityWeek, covering Tenet Security’s DEF CON research)

So what: this is the sharpest version of the agentic-SOC problem yet, because it inverts the value of telemetry — the same log lines we spent a decade centralizing become the adversary’s write channel the moment an agent with tools reads them. There is no model fix for this. The control is architectural: strip or neutralize attacker-controlled strings before they reach an agent’s context, never grant read-and-act to the same agent identity, and require a separate, human-or-policy-gated actuator for anything that changes state. If your SOC roadmap has agents reading raw telemetry and executing response in one loop, that design is now publicly known to be exploitable.

Atlassian Rovo could be turned into a one-click enterprise data siphon by a URL parameter. Varonis Threat Labs disclosed “RovoBlast,” an attack where a URL parameter pre-seeds instructions into a victim’s Rovo AI chat session without authentication — parameter-to-prompt injection. The organization ID could be left blank and Atlassian would still route the request to the victim’s default org without a warning; from there Rovo’s autonomous research agent retrieved internal content and exfiltrated it to an external site. Rovo’s reach includes Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, connected databases and uploaded files, and the researchers demonstrated exfiltration of Confluence pages, Jira tickets and SharePoint content containing personal data. Atlassian patched before publication; no CVE was assigned. (Varonis, via SecurityWeek and The Hacker News)

So what: an AI assistant wired into every system of record is a single click away from being an exfiltration primitive, and the failure here wasn’t the model at all — it was a URL parameter and a missing tenant check. Treat every deep link into an AI assistant as untrusted input, and audit which of your assistants can both browse the open web and read internal repositories in the same session.

North Korea’s Kimsuky is building an offline AI stack so the guardrails never see the prompt. South Korean firm Genians documented Kimsuky infrastructure assembled from local model hosting tools, a retrieval layer over stolen material, libraries for embedding model calls into custom tooling, speech transcription, and an AI code editor. The apparent goals are automating phishing lure production, adding AI functions inside malware, and mining exfiltrated documents; the infrastructure ties to a campaign that uses GitHub repositories as a command channel and distributes AsyncRAT. (Genians, via The Hacker News)

So what: every vendor safety control assumes the adversary uses a hosted model. A state group running open-weight models on its own hardware has no rate limit, no abuse review and no telemetry pointed at it. Detection has to move to the artifacts — the lures, the tooling, the infrastructure — because the generation step is now invisible by design.

Poland publishes the first documented IT-to-OT pivot through a carrier private APN — and it stopped a turbine. Poland’s CERT detailed an intrusion at a combined heat and power plant serving about 50,000 residents, distinct from the December 2025 energy-sector campaign. Attackers entered via an internet-exposed VPN/firewall at a wind farm, found a cellular router, opened an SSH tunnel into the private APN operated by the distribution system operator, and pivoted to the plant’s OT network — reaching one PLC, then a second vendor’s controllers about a week later, which they switched to stop mode and password-locked. The steam turbine shut down, water treatment failed and cogeneration was disrupted before staff restored service. The router’s administrative interface had no defined handling requirements, and the attackers corrupted the controller’s partition table on the way out, destroying logs. CERT states this attack vector has not been observed in any prior known incident. Attribution for this specific incident is not established. (Security Affairs; SecurityWeek; BleepingComputer, reporting Poland’s CERT analysis)

So what: the private APN was treated as a trusted transport because a carrier operates it — and it turned out to be a flat path between an unmanned wind farm and a turbine hall. If you run distributed OT over cellular, the APN is a network segment you own the risk for even though you don’t own the equipment, and the cellular router’s admin interface belongs in your asset inventory with a named owner.

A WordPress plugin vendor’s own update feed was poisoned to mint hidden admin accounts. Wordfence detected attacks on August 7 against BdThemes plugins, including one with 100,000+ installs across a portfolio the vendor advertises at 350,000+ active installations. The attacker obtained write access to the vendor’s storage and poisoned a static remote JSON feed pulled by an admin promotional banner, exploiting a cross-site scripting flaw introduced into the library’s JSON parsing in March 2026; the payload ran in authenticated admin sessions to create hidden administrator accounts, dropped a webshell disguised as a plugin, and manipulated database queries to keep the rogue accounts out of the user list. WordPress.org pulled the affected plugins on August 8; the earliest possible attack start is June 23. Researchers link the command-and-control infrastructure to two other recent plugin supply-chain compromises. At time of publication the vendor had not issued a statement and the flaw was unpatched. (BleepingComputer, reporting Defiant/Wordfence)

So what: a promotional banner that phones home is a code-execution channel with an admin session attached, and this is the third compromise traced to the same infrastructure. Inventory which of your plugins fetch remote content into the admin dashboard, and if you ran these, hunt for unlisted admin accounts — the query manipulation means the user list is lying to you.

Three corporate incidents worth a line each. LexisNexis pulled three Nexis products offline after detecting unusual activity on servers run by an unnamed third-party vendor, engaged a forensics firm, and is rebuilding in a new environment — the company notes its Nexis Metabase product is unrelated to last week’s Metabase Cloud zero-day. Levi Strauss disclosed via SEC filing on August 10 that social engineering compromised three employee computers and corporate information was exfiltrated, with no customer data apparently taken and no material impact; the company did not name the actor. Valve notified European Steam hardware customers that attackers accessed shipping partner CEVA Logistics between July 29 and August 1, taking names, addresses, phone numbers, emails and order details — no payment data, passwords or Steam Guard codes. (BleepingComputer; SecurityWeek)

So what: two of the three are someone else’s server. Third-party and logistics providers keep producing the “our systems were not affected” disclosure that still ends with your customers’ data on a leak site — and the shipping vendor is the one nobody’s third-party risk program actually scoped.

FBI and South Korea issue a joint advisory on Gunra, and Microsoft ties a China-based crew to new ransomware via the N-central flaws. The FBI and South Korea’s National Police Agency, with CISA support, published a joint advisory on August 10 for Gunra ransomware: built from the leaked 2022 Conti source, active since April 2025, moved to a ransomware-as-a-service model in January 2026, targeting healthcare, financial services and government, gaining access through firewall flaws CVE-2024-55591 and CVE-2025-24472, with ransom demands reported above $10 million on five-to-seven-day clocks. Separately, Microsoft Threat Intelligence reported that Storm-1175 — a China-based, financially motivated group that previously deployed Medusa — is now deploying a new ransomware family called StormEncryptor, likely via CVE-2026-18577 in N-able N-central, assessed as a patch bypass for the already-KEV-listed CVE-2026-18556, then abusing remote-support tooling for persistence and Mimikatz for credential theft. (The Record; The Hacker News; BleepingComputer, reporting Microsoft Threat Intelligence)

So what: both entries start with two-year-old firewall CVEs and a patch bypass on an RMM — the initial access is never the interesting part. The N-central detail is the one to act on: if you patched for CVE-2026-18556 and closed the ticket, the bypass means you’re still exposed, and an RMM compromise is a compromise of every endpoint downstream of it.

Water Cyber Shield Act would put $300M a year behind small water systems. Senators Adam Schiff and Amy Klobuchar introduced the bill on August 10. It would add $300 million annually to the drinking water and clean water state revolving funds earmarked for cybersecurity, authorize the EPA to run cybersecurity assessments and require corrective action, and direct the EPA to work with CISA and NIST on baseline standards for drinking water systems. It follows last month’s coordinated attack on 30+ Minnesota water and wastewater systems. (The Record; The Hill)

So what: this is the first credible answer to the problem the sector has had for a decade — the smallest systems face state-actor tradecraft on a budget that doesn’t cover a firewall refresh. Watch the standards clause more than the money: EPA-mandated corrective action would be the sector’s first real enforcement hook.

The water campaign keeps widening. New Jersey (Cape May, Woodbine) and Alabama (Childersburg) join a target list now spanning at least 12 states, alongside Minnesota, Michigan, South Dakota and Georgia, with warnings issued in Wisconsin, Pennsylvania and Washington. Reporting links the campaign to Iranian actors targeting OT devices, primarily one major vendor’s controllers and possibly others. Impact remains minimal — some utilities shut systems down precautionarily, none reported significant disruption, and all confirmed drinking water stayed safe. New York has put $9M in grants behind 153 water systems despite no confirmed attacks there. (SecurityWeek)

So what: “minimal impact” is doing a lot of work in that sentence — this campaign looks like target development, not sabotage, and the thing being built is a map. Sector-wide, the gap isn’t detection, it’s that most of these utilities have no one to send the alert to. Pooled monitoring plus the funding above is the only combination that closes it.