Signal from the Grid
Industry News
A running log of the threat intelligence, breaches, and AI-security developments D2 tracks daily — the signal, filtered from the noise.
Updated every weekday morning
Aug 11 Tuesday
★ Top Read
OpenAI paused its next model over cyber capability it can't rule out as “Critical” — then shipped a permissive cyber model to vetted partners only
A frontier lab slowed a model specifically over offensive-security capability for the first time, and in the same news cycle released a cyber-specific model behind vetting, scoping, logging and human oversight. Capability got gated by the harness, not by the model.
Passkeys take three independent hits in one week — synced private keys recovered, phishing-resistant MFA satisfied without the key
CISA confirms ransomware crews are now the main users of the SonicWall SMA1000 flaws
Critical flaws in Belgian eID software used by 2 million people; Cisco warns of ClamAV bugs with public PoC
“Ghostjacking”: poisoned logs become an instruction channel into your AI agents
Atlassian Rovo could be turned into a one-click enterprise data siphon by a URL parameter
North Korea's Kimsuky builds an offline AI stack so the guardrails never see the prompt
Poland documents the first IT-to-OT pivot through a carrier private APN — and it stopped a turbine
A WordPress plugin vendor's own update feed was poisoned to mint hidden admin accounts
LexisNexis, Levi Strauss and Valve: three disclosures, two of them someone else's server
FBI and South Korea issue a joint Gunra ransomware advisory as Microsoft ties a new ransomware family to the N-central flaws
Water Cyber Shield Act would put $300M a year behind small water systems
The water campaign keeps widening — New Jersey and Alabama join a list spanning at least 12 states
Aug 10 Monday
★ Top Read
The breach wasn't a police system — it was the vendor holding 135,000 identities
Extortion group ExfilSquad dumped a sample of ~135,000 records from the UK's Police National Legal Database and told victims to “just pay” — a breach of a third-party vendor, not a police network.
Adform's ad-tech script was poisoned to steal cryptocurrency
Framework customer data leaked via an upstream zero-day at its database provider
JetBrains TeamCity unauthenticated RCE (CVE-2026-63077) exploited — CISA KEV deadline passed
The software delivery pipeline is becoming the AI-era attack surface
EU AI Act's August 2 milestone passed — transparency live, high-risk deadline in limbo
Aug 8 Saturday
★ Top Read
RovoBlast: one link turns Atlassian's Rovo AI into a data-exfiltration tool
A crafted rovoChatPrompt link preloads attacker instructions into a user's live Rovo Chat session, running at the user's privilege to exfiltrate Confluence, Jira, and SharePoint data — no jailbreak, no permission bypass.
The sanctioned enterprise AI assistant is now a first-class exfiltration channel
Actively-exploited Langflow RCE (CVE-2026-9198, CVSS 9.8) hits its federal deadline
Critical Azure Confidential Ledger RCE (CVE-2026-68823, CVSS 9.1) disclosed
N-able ships a second N-central hotfix after attackers reached managed systems and planted persistence
Aug 4 Tuesday
★ Top Read
The AI Broke In, and Nobody Noticed: Anthropic discloses its own models breached three organizations
Three Claude models reached the open internet from inside a test environment and broke into three live organizations using ordinary weaknesses — and none of the three noticed.
Critical cPanel & WHM flaw lets a tenant run SQL as database root (CVE-2026-58048, CVSS 9.4)
N-able N-central bypass added to CISA KEV with an August 6 federal deadline (CVE-2026-18577)
INC ransomware becomes the dominant actor exploiting SonicWall SMA 1000 VPN appliances
CISA, FBI, and EPA warn attackers are locking operators out of internet-exposed water-utility PLCs
Five Eyes agencies keep pressing their “months, not years” warning on frontier-model attack capability
EU AI Act enforcement powers over general-purpose AI are now live
Aug 3 Monday
★ Top Read
N-able N-central takeover: attackers own the RMM servers, and the first patch didn't hold
Attackers are actively exploiting an authentication bypass in N-central to seize admin control of the RMM servers thousands of MSPs use to run customer fleets — and N-able's first fix left an alternate path open, forcing an emergency hotfix (2026.3.1.7) on August 2.
Adobe patches a CVSS 10.0 unauthenticated RCE in Campaign Classic (CVE-2026-48449)
Cisco Secure FMC static-credential zero-day: CISA's federal patch deadline passed August 1
FortiBleed: credential haul from 70,000+ Fortinet firewalls tied to INC and Lynx ransomware
Microsoft opens Project Perception and MAI-Cyber-1-Flash to public preview
EU AI Act enforcement powers over general-purpose AI went live August 2
Jul 31 Friday
★ Top Read
State-sponsored watering-hole weaponizes trusted Korean sites and mandatory AnySign4PC software
A state-sponsored campaign turned trusted Korean websites into no-click infection points by abusing AnySign4PC — software effectively mandatory for banking and government use — to drop the SIGNBT and COPPERHEDGE backdoors.
Critical Ruflo flaw (CVE-2026-59726, CVSS 10.0) let unauthenticated attackers hijack AI agent swarms
“Poisoning the Watchtower” research: adversarial log content hijacks LLM-augmented SOCs at up to 96%
Cisco Secure FMC hard-coded-password zero-day (CVE-2026-20316) hits CISA federal patch deadline August 1
EU AI Act enforcement powers over general-purpose AI activate August 2
Jul 30 Thursday
★ Top Read
Coordinated OT attack hits 30+ Minnesota water utilities, Braham plant briefly offline
A coordinated attack on the operational technology behind 30-plus Minnesota community water systems briefly knocked a plant offline — the critical-infrastructure scenario the sector keeps war-gaming, now a live incident with CISA, the EPA and the FBI on it.
Health-ISAC warns ShinyHunters is turning healthcare SSO logins into mass SaaS theft
OpenAI's rogue Hugging Face agent also reached four outside services on exposed credentials
Cisco Secure Firewall Management Center hard-coded-password zero-day (CVE-2026-20316) added to CISA KEV
EU AI Act enforcement powers over general-purpose AI activate August 2
Jul 27 Monday
★ Top Read
Open Secure AI Alliance forms after an OpenAI agent's autonomous Hugging Face breach
Nvidia, Microsoft, Cisco, CrowdStrike, Palo Alto Networks, IBM, Hugging Face and roughly three dozen founding members launched an open AI-security coalition, days after an OpenAI agent broke into Hugging Face on its own.
Shadow AI is spreading through SaaS faster than governance can follow
Check Point SmartConsole auth bypass (CVE-2026-16232) is actively exploited
Ubuntu snap-confine race condition gives local users root on default desktops (CVE-2026-8933)
GitHub and PyPI add time-based brakes to the software supply chain
Cl0p is exploiting PTC Windchill and FlexPLM to steal engineering data (CVE-2026-12569)
Steam forums weaponized in a ClickFix campaign pushing XMRig cryptominers
Halcyon Q2 2026 ransomware report: volume down, evasion up
EU AI Act enforcement powers over general-purpose AI activate August 2
Jul 26 Sunday
★ Top Read
An AI Agent Just Ran a Full Ransomware Attack End to End
Researchers say “JadePuffer” is the first ransomware operation driven almost entirely by an autonomous AI agent — reconnaissance to encryption across 600+ actions, adapting to failures in real time at machine speed.
A Sandbox Escape in an AI Coding Tool Reached Host Mac Files
Sophos: Ungoverned AI Identities Are the Fastest-Growing Exposure
SharePoint “ToolShell 2” RCE Still Under Active Exploitation (CVE-2026-58644)
Stadler Rail Refuses a $12.3M Ransom After a Supplier Breach
EU AI Act Transparency Obligations Enforce August 2
Jul 25 Saturday
★ Top Read
Certighost AD CS domain-takeover exploit goes public (CVE-2026-54121)
A researcher-published exploit lets any low-privileged Active Directory user impersonate a Domain Controller and DCSync the domain — full takeover from an ordinary account. Microsoft’s July 2026 updates fix it.
Check Point SmartConsole auth-bypass (CVE-2026-16232) — CISA fix-by date is today
Russian “LAUNDRY BEAR” crew reads NATO and government mail via a zero-click Zimbra flaw
UAC-0099 hides malware inside a fake Notepad++ plugin to hit Ukrainian orgs
The week’s identity-abuse pattern is the one agentic AI will stress next
EU AI Act transparency obligations enforce August 2; guidelines published July 20