Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, supply-chain attacks, critical infrastructure incidents, and significant law-enforcement actions to keep you informed and secure in the ever-evolving digital landscape.
1. ChainDrop / Shai-Hulud Worm Infects 444+ npm Packages with ~2 Billion Monthly Downloads
Published: 2026-08-05
Attackers compromised a popular maintainer’s GitHub account (keyv and related caching packages) and unleashed a self-propagating credential-stealing worm (dubbed ChainDrop, an evolved Shai-Hulud variant). It poisoned hundreds of packages and over 2,000 versions, stealing npm/GitHub tokens, cloud credentials, Kubernetes secrets, and more, then using those to spread further. Combined monthly downloads of affected packages exceed 2 billion.
2. CISA Adds Actively Exploited Langflow RCE, N-central, and Apache Tomcat Flaws to KEV Catalog
Published: 2026-08-05
The U.S. Cybersecurity and Infrastructure Security Agency added three vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-9198 (critical code-injection/RCE in Langflow, CVSS 9.8, unauthenticated on default deployments), authentication-bypass issues in N-able N-central (CVE-2026-18556 and related), and an EncryptInterceptor bypass in Apache Tomcat (CVE-2026-34486). Federal agencies face tight remediation deadlines.
3. Michigan and Georgia Confirm Iranian-Linked Attacks on Public Water Systems
Published: 2026-08-05
Officials in Michigan and Georgia confirmed cyberattacks on public water and wastewater systems as part of a broader campaign. The FBI described a coordinated effort targeting at least seven U.S. states (four confirmed). Attacks involved changing passwords/IP addresses and locking operators out of equipment; some facilities were temporarily disrupted. The activity is linked to Iranian actors (consistent with IRGC-affiliated activity). CISA and the FBI urged operators to isolate PLCs from the internet and harden access.
4. Over 250 ClickFix Domains Use Browser Fingerprinting to Deliver macOS Malware
Published: 2026-08-05
A large-scale macOS ClickFix campaign spanning more than 250 front-end domains now fingerprints visitors before showing malware lures. The operation delivers information-stealers (including AMOS variants) that target credentials and sensitive data. Microsoft Threat Intelligence has been tracking the infrastructure. Users are warned never to paste commands into Terminal based on website or CAPTCHA instructions.
5. OpenAI Disrupts Cambodia-Based Poipet Scam Network Abusing ChatGPT
Published: 2026-08-05
OpenAI banned a coordinated network of ChatGPT accounts linked to a scam operation based in Poipet, Cambodia. The network used the AI tool to support investment, romance, gambling, and law-enforcement impersonation schemes. The action targets infrastructure tied to known scam compounds in the region.
6. Critical Tails Linux Vulnerability Allows Websites to Deanonymize Users – Emergency Patch Issued
Published: 2026-08-05
A critical race-condition vulnerability (CVE-2026-64560) in the Linux kernel’s POSIX CPU timer subsystem (affecting Tails since kernel 5.7) can let malicious websites escalate privileges via Tor Browser and deanonymize users. Additional issues could allow control if users open malicious files in certain applications. Tails 7.10.1 contains the emergency fix; users are strongly urged to upgrade immediately to protect anonymity and Persistent Storage. State-sponsored actors or sophisticated firms are considered the primary risk.
7. New OVSwrap Linux Kernel Flaw Enables Local Root via Open vSwitch
Published: 2026-08-05
A memory-corruption vulnerability in the Linux kernel’s Open vSwitch datapath (CVE-2026-64531 / OVSwrap) allows unprivileged local users to gain root privileges on many default-configured distributions. Public exploits and pre-built records for hundreds of kernel builds have already appeared. Prompt kernel updates are recommended.
8. Canadian Man Pleads Guilty in Snowflake Cloud Data-Theft and Extortion Scheme
Published: 2026-08-05
A Canadian national pleaded guilty to his role in accessing Snowflake customer accounts and stealing data from at least 165 organizations, then using the stolen information in multi-million-dollar extortion campaigns. The case highlights ongoing risks around cloud data platforms and credential compromise.
Stay Vigilant
Cyber threats continue to evolve rapidly—supply-chain worms, critical-infrastructure targeting, AI-assisted scams, and high-impact kernel and application flaws remain front-and-center. Prioritize rapid patching of KEV items, monitor open-source dependencies (especially npm), isolate operational technology where possible, and maintain strong credential hygiene and multi-factor authentication.
Subscribe for daily or weekly updates, review your software bill of materials, and consider automated vulnerability monitoring for high-risk components. Stay safe online!