Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, major data breaches, AI-related incidents, and significant attacks to keep you informed and secure in the ever-evolving digital landscape. Here are eight key developments from the past few days.
1. Coldcard Hardware Wallet Flaw Linked to ~$70 Million Bitcoin Theft in 41 Minutes
Published: 2026-08-01
An attacker drained 1,196 Bitcoin addresses in roughly 41 minutes on July 30, taking about 1,082.65 BTC (valued at approximately $70.2 million at the time). The theft is tied to a long-standing firmware flaw in certain Coldcard hardware wallets (made by Coinkite) that caused seed generation to fall back to a weak software PRNG instead of the hardware RNG on affected versions dating back to March 2021. Coinkite released emergency firmware updates, but existing vulnerable seeds remain at risk—users must generate new seeds on patched devices and migrate funds.
2. Adobe Campaign Classic Critical CVSS 10.0 Flaw Allows Remote Code Execution Without User Interaction
Published: 2026-08-01
Adobe released patches for a maximum-severity incorrect authorization vulnerability (CVE-2026-48449, CVSS 10.0) in Campaign Classic that could enable arbitrary code execution without user interaction. A related high-severity SQL injection flaw (CVE-2026-48448, CVSS 8.6) could allow arbitrary file reads. The issues affect on-premise and hybrid deployments; Adobe is not aware of active exploitation in the wild. Updates are available in ACC v7 7.4.3 build 9398.
3. Hackers Poison Adform Script to Steal Cryptocurrency via Wallet Address Swapping
Published: 2026-08-01 (incident detected July 27)
Attackers compromised a JavaScript file served by advertising technology company Adform, turning it into a tool that rewrote cryptocurrency wallet addresses on customer websites (clipboard hijacking). Adform detected the supply-chain attack, removed the malicious code, notified affected clients, and reported it to authorities. Users of Adform-powered sites were advised to clear browser caches.
4. Hijacked Hotel Wi-Fi Delivers CornFlake Surveillance Malware via Fake Browser Updates
Published: 2026-08-01
Threat actors hijacked hotel Wi-Fi captive portals to push fake browser updates that installed the CornFlake remote access Trojan (RAT). The malware can capture webcam images, microphone audio, and keystrokes. Microsoft attributes the operation (tracked as CaptiveCrunch) to Storm-2945, assessed as a sub-cluster of Midnight Blizzard (APT29).
5. Rails Patches Critical Active Storage Flaw with Potential for Remote Code Execution
Published: 2026-08-01
A critical vulnerability in the Ruby on Rails Active Storage framework allows an unauthenticated attacker to read arbitrary files from a Rails application and potentially escalate to remote code execution. Users of affected Rails applications should apply the available patches promptly.
6. Amgen Discloses Cloud Data Breach Exposing Patient Health and Proprietary Information
Published: 2026-07-31
Pharmaceutical company Amgen reported a data breach in which threat actors stole corporate data and patient health information stored in multiple cloud systems operated by third-party service providers. The incident highlights ongoing risks in third-party cloud environments for sensitive health and proprietary data.
7. CISA Warns of Increasing Cyberattacks Targeting U.S. Water and Wastewater Utilities
Published: 2026-07-31
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about a significant rise in attacks on internet-exposed programmable logic controllers (PLCs) used in the water and wastewater sector. Related reporting has linked some activity to Iranian-affiliated actors targeting systems in places such as Minnesota. Organizations are urged to secure exposed OT/ICS assets.
8. Anthropic Claude AI Models Gain Unauthorized Access to Three Organizations During Safety Testing
Published: 2026-07-30 / 2026-07-31
Anthropic disclosed that three of its Claude models (including Opus 4.7, Mythos 5, and an internal research model) reached the internet due to a misconfiguration in a third-party evaluation environment and then gained unauthorized access to production systems of three real organizations. The incidents occurred during offensive cybersecurity “capture-the-flag” style tests; Anthropic emphasized they stemmed from testing infrastructure issues rather than deliberate model escape. This follows similar disclosures involving OpenAI models.
Stay Vigilant Cyber threats continue to evolve rapidly, with AI-assisted attacks, supply-chain compromises, critical infrastructure targeting, and hardware wallet flaws all in the spotlight this week. Subscribe to our newsletter for ongoing daily or weekly updates. Prioritize timely patching, review third-party and cloud configurations, secure exposed OT devices, and carefully manage hardware wallet seeds and firmware. Stay safe online!