AI Goes Rogue, Metabase 0-Day, MCP Provide-Chain Assaults, and Router Backdoors

Ravie LakshmananAug 10, 2026Cybersecurity / Hacking

A whole lot of safety issues nonetheless start with somebody doing a totally regular factor. Cloning a repo. Answering a name. Leaving a field uncovered. Trusting the default.

That just about covers the temper this week. Previous bugs are again, provide chains are getting stranger, and a few exploit paths are so brief you marvel what was imagined to cease them within the first place.

That’s solely a part of it. Right here’s every thing else that made the Monday recap.

⚡ Risk of the Week

Anthropic’s Mannequin Makes an attempt to Poison Open-Supply Mission — A brand new analysis carried out by the U.Ok. AI Safety Institute (AISI) discovered that AI fashions with entry to the web reached out into the actual world to focus on people and organizations autonomously throughout 10 of the overall of 122 runs. Of 19 such actions recorded, 17 originated from Anthropic’s Mythos 5 and the remaining two concerned OpenAI’s GPT-5.6-Sol with cyber classifiers. In essentially the most severe case, Anthropic’s Claude Mythos 5 spent 34 hours attempting to get a malware dropper merged into an actual open-source undertaking and engaged in social engineering by creating pretend on-line identities and utilizing them to strain the undertaking’s maintainer to approve the code. Finally, a human maintainer caught and refused to approve the malicious code. “These makes an attempt had been unsuccessful, and our investigations haven’t evidenced any ensuing real-world hurt,” AISI stated. However that is the primary time we’ve seen dangers round autonomy and deception manifest this clearly, with out particular prompting, within the real-world.”

• Metabase 0-Day Exploited in Assaults — Metabase warned {that a} maximum-severity safety flaw impacting its enterprise intelligence and information visualization software program bundle has been exploited within the wild as a zero-day. The vulnerability (CVSS rating: 10.0), which doesn’t carry a CVE identifier, permits an unauthenticated distant attacker to inject arbitrary SQL into the Metabase utility database, enabling them to achieve administrator entry to the occasion. Armed with the elevated entry, the attacker can change the applying configuration, steal saved credentials for the related databases, learn any information accessible by way of these connections, and export information. One of many firms that has been affected is Framework.
• New Interrupt Injection Assault Bypass Spectre v2 Defenses on Intel and AMD CPUs — A gaggle of researchers demonstrated a strategy to bypass defenses for the Spectre vulnerability impacting fashionable CPUs. “The defenses work by wiping or isolating the processor’s prediction equipment, eradicating something an attacker might need planted,” MIT’s Pc Science and Synthetic Intelligence Laboratory (CSAIL) stated. “The catch […] is that the wipe and the second the predictions get used cannot occur on the similar on the spot. There’s at all times a niche — typically solely a handful of directions huge. Something that runs in that hole can soiled the equipment another time. The researchers name this class of assault TONTOU.” The examine discovered a dependable strategy to get code into that hole utilizing a method known as Interrupt Injection to in the end pull secrets and techniques out of reminiscence.
• New CSS Assaults Can Break Webmail Defenses — New analysis demonstrated on the Black Hat convention final week detailed assault chains spanning Microsoft Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail that may seize passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI instruments that learn electronic mail. “Hassle is you possibly can create discrepancies between what the sanitizer thinks is secure and what the browser really renders,” PortSwigger stated. “Some webmail purchasers go a step additional by letting the browser parse the HTML and CSS first, then filtering the browser’s interpreted output reasonably than the unique supply. But even this may be mutated into one thing malicious.”
• UNC6671 Vishing Assaults Goal Monetary Corporations — A current wave of cyber assaults concentrating on monetary providers, personal fairness, {and professional} providers has been attributed to a knowledge extortion group referred to as UNC6671. The assaults make use of voice phishing to focus on enterprise workers and trick them into visiting spoofed login portals the place adversary-in-the-middle (AitM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. The risk actors then leverage the captured information to determine session persistence and deploy automated Python and PowerShell scripts for information exfiltration from enterprise cloud environments and SaaS functions, together with Microsoft 365 and Okta. UNC6671 has diversified its operations throughout a number of extortion manufacturers together with Redact, Pink (aka CL-CRI-1147), Helix, and Falcon (aka CL-CRI-1182). UNC6671 was beforehand stated to have operated underneath the BlackFile (aka CL-CRI-1116) model, concentrating on organizations through vishing and SSO compromise, earlier than it was retired on Might 11, 2026.
• Chinese language-Made Zbtlink Routers Ship With Backdoor — An evaluation of firmware related to Chinese language router producer Zbtlink has unearthed a factory-shipped backdoor that is designed to telephone house and run instructions obtained from the server. The backdoors are designed such that they begin routinely and try and beacon to Chinese language command-and-control (C2) infrastructure as usually as each 35 seconds. The backdoor is implanted in not less than 20 router fashions. In response to the findings, Zbtlink reiterated that the “distant administration element” is used just for after-sales technical assist and to “help clients with gadget troubleshooting and configuration solely upon their specific request and authorization.” The corporate additionally stated it has by no means been used for unauthorized entry. The corporate additionally stated it is growing and releasing firmware updates to deal with the difficulty.

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the hole between a patch and an exploit is shrinking quick. These are the heavy hitters for the week: high-severity, broadly used, or already being poked at within the wild.

Test the record, patch what you could have, and hit those marked pressing first — CVE-2026-34348, CVE-2026-18497 (stb TrueType), CVE-2026-63508, CVE-2026-56162, CVE-2026-65667, CVE-2026-50515, CVE-2026-62830, CVE-2026-59115, CVE-2026-50481 (Microsoft Home windows), CVE-2026-64638 (WordPress), CVE-2026-64564 (Linux SCTP), CVE-2026-56181 (Microsoft Home windows NAT), CVE-2026-63913 (Linux), CVE-2026-64561 (Linux kernel), CVE-2026-20303, CVE-2026-20304, CVE-2026-20310, CVE-2026-20267, CVE-2026-20272 (Cisco), CVE-2026-18830 (AWS AgentCore), CVE-2026-18236 (Google ADK), CVE-2026-64650, CVE-2026-64651 (Vercel), CVE-2026-41679, GHSA-x8hx-rhr2-9rf7 (Paperclip), CVE-2026-58073, CVE-2026-58072 (Veeam), CVE-2026-16498, CVE-2026-16496, CVE-2026-14869 (HashiCorp), CVE-2026-15307 (GeoDjango), CVE-2026-64531 (Linux kernel Open vSwitch), CVE-2026-18577, CVE-2026-18556 (N-able N‑central), CVE-2026-59774 (Gitea), CVE-2026-58048 (cPanel), CVE-2026-17583 (Thermo Fisher Scientific), CVE-2026-8496 (Alinto SOGo), CVE-2026-65400 (Apple macOS Tahoe, macOS Sequoia, and macOS Sonoma), CVE-2026-19137, CVE-2026-19149, CVE-2026-19154, CVE-2026-19157, CVE-2026-19170, CVE-2026-19172 (Google Chrome), CVE-2013-3821 (Oracle PeopleSoft), CVE-2025-8943 (Flowise), and an SQL injection in Metabase.

🎥 Cybersecurity Webinars

• Construct a Safety Technique for AI-Pace Growth → AI is pushing software program supply far past the tempo conventional safety applications had been designed for. This session reveals safety leaders the best way to govern AI-built software program, cut back danger with out slowing groups down, and construct controls that scale with machine-speed growth.
• Benchmark Your AI Coding Danger Towards 300 Safety and Engineering Leaders → AI coding is bringing extra unvetted open supply into manufacturing and increasing remediation debt. This session offers safety and engineering leaders peer benchmarks, a data-backed framework for measuring enterprise affect, and a transparent view of which governance fashions are literally decreasing danger.
• Construct a Safety Operations Technique for Machine-Pace Assaults → AI can now discover vulnerabilities, generate exploits, and construct assault paths at machine velocity. This session offers safety leaders a sensible framework to evaluate AI risk readiness, enhance attack-surface visibility, and speed up investigation and remediation earlier than present processes turn into the bottleneck.

📰 Across the Cyber World

• New Shai-Hulud Model Weaponizes the MCP Registry — A brand new model of the Shai-Hulud worm unfold by way of the open-source ecosystems is provided to ship the payload through the Mannequin Context Protocol (MCP) Registry. “Whereas earlier iterations of Shai-Hulud tampered with native AI coding consumer configs, this marks the primary time we noticed a Shai-Hulud payload being delivered immediately by way of the official Mannequin Context Protocol (MCP) Registry (registry.modelcontextprotocol.io),” OX Safety stated. The assault works like this: the npm and PyPI bundle linked by the MCP server is totally clear, however opening or cloning the linked MCP server GitHub repository (“jUXTAPOSITION1/V.A.P.E”) inside Claude Code or VS Code triggers the malware, resulting in the gathering of developer tokens, cloud credentials, and session keys. The worm unfold by way of 440 distinctive npm packages.
• China Launches Overview of Palo Alto Networks — China’s Our on-line world Administration (CAC) has introduced it is conducting a assessment of Palo Alto Networks’ merchandise. “As a way to make sure the secure and secure operation of vital data infrastructure, stop hidden dangers of community safety, and safeguard nationwide safety, in accordance with the Nationwide Safety Regulation of the Folks’s Republic of China and the Cyber Safety Regulation of the Folks’s Republic of China, the Community Safety Overview Workplace implements community safety assessment of merchandise offered by Palo Alto in China in accordance with the ‘Community Safety Overview Measures,'” the CAC stated.
• Papyrus Makes use of Faux Novel Studying Apps for Advert Fraud — A brand new cell advert fraud scheme dubbed Papyrus has been noticed leveraging a “cluster of novel-reading functions that monetize customers’ studying periods by operating hidden browser exercise within the background,” Integral Advert Science stated. “Whereas customers imagine they’re merely studying a narrative, the apps are secretly utilizing their telephone to go to web sites, generate clicks, and create pretend engagement behind the scenes. The apps current themselves as leisure merchandise constructed round long-form fiction and serialized tales, however IAS noticed them covertly navigating to net domains underneath the path of command-and-control infrastructure.” Papyrus is constructed round BootNova, an orchestration layer that controls hidden browser exercise contained in the app. When the app runs, BootNova contacts distant command-and-control infrastructure for configuration. The distant configuration can management enablement, timing, geographic concentrating on, retry habits, the variety of WebViews to run, vacation spot URLs, and the interplay logic utilized to these pages. Papyrus has been linked to greater than 800 domains and almost 8,000 distinctive hostnames.
• Estimated $30M Stolen in Violent Crypto Assaults in 2026 — An estimated $30 million is alleged to have been stolen in violent “wrench assaults” in 2026, in line with Chainalysis. “Dwelling invasions now account for 37% of incidents in 2026, up from 26% in 2023,” it stated. “Kidnappings have remained comparatively secure year-over-year (YoY) by way of share of whole assaults.” In distinction, annual worth stolen in violent assaults peaked at $58 million in 2025.
• 26 Ransomware Assaults Per Day in July 2026 — In response to Comparitech, July 2026 noticed almost 26 ransomware assaults per day, up from 22 per day in June. The variety of ransomware assaults jumped from 668 in June to 799 in July. “The schooling sector noticed a big improve (up 44%), as did finance firms (up 71%), tech companies (up 62%), and companies working throughout the healthcare sector, e.g. pharmaceutical producers and medical billing suppliers (up 46%),” Comparitech stated. Probably the most prolific teams had been The Gents (135), Qilin (125), DragonForce (41), INC (36), and CRPx0 (33).
• Gadget Code Phishing Evasion Strategies Detailed — Palo Alto Networks Unit 42 stated it recognized 4 evasion strategies which might be at present being utilized in gadget code phishing campaigns. This contains CAPTCHA gates, multi-step flows that undergo a number of SaaS internet hosting platforms separating the preliminary hyperlink from the phishing content material to evade URL popularity checks, blob URL supply, and using Cyrillic characters instead of Latin letters, zero-width areas, and strings inside tags to interrupt content-based detection.
• From LLMJacking to Token Jacking — A rising variety of safety incidents involving AI token jacking have resulted in monetary losses for victims. “The monetary loss comes from criminals having access to API keys utilized by legit builders for entry to common AI platforms,” Unit 42 stated. “The unrelenting frenzy of AI adoption and hovering prices of mannequin entry are converging into an irresistible alternative for cybercriminals. Premium pricing on scarce AI processing energy means stolen entry through tokens can generate a fast and straightforward revenue for attackers. Complicated, patchwork billing administration and limitless scaling by default can result in large monetary losses in brief durations.”
• ScarCruft Leverages RokRAT in New Assaults — Spear-phishing emails disguised as supplies for precise tutorial occasions and seminars are getting used to ship RokRAT, a distant entry trojan linked to a North Korean group referred to as ScarCruft. “Though the file was disguised as a PDF, it really delivered a malicious ISO file by way of a cloud storage hyperlink,” Genians stated. “The ISO contained an executable disguised as a PDF doc, utilizing the ‘.pdf,’ ‘.pif’ extension to induce the person to run it. The assault loaded the shellcode payload into reminiscence and injected a RokRAT variant right into a course of.”
• Kimsuky Makes use of New Gomir Variant — Talking of North Korean risk teams, the risk actor tracked as Kimsuky is alleged to have gained management of internet-facing servers by way of vulnerability exploitation and spear-phishing and deployed a brand new variant of a backdoor known as Gomir, a Linux variant of the Home windows-based GoBear backdoor. “Kimsuky developed Gomir variants with considerably altered C2 communication strategies to evade detection, together with leveraging Google Drive as a C2 channel and implementing a brand new customized protocol,” ENKI stated. In not less than one case in December 2025, the risk actor has been discovered deploying HttpTroy, which is then used to put in further instruments, together with DWAgent and a proxy device. Kimsuky has additionally been noticed organising native giant language mannequin (LLM) environments utilizing Ollama, GPT4All, and Msty to enhance its operations and goal overseas diplomatic missions, in addition to the navy, safety, and digital asset sectors. The assaults have leveraged Git-based repositories as C2 and distribution channels for encrypted AsyncRAT payloads. The exercise has been codenamed Operation GitPower, citing similarities with FlowerPower. Final yr, the group was tied to campaigns that concerned abusing OpenAI’s ChatGPT to forge deepfake navy ID playing cards in a spear-phishing marketing campaign towards South Korean defense-affiliated entities and different people centered on North Korean affairs, corresponding to researchers, human rights activists, and journalists.

Conclusion

Perhaps the actual downside just isn’t that safety retains failing in stunning methods. It’s that the “stunning” half often disappears the second somebody reveals how little it took.

That’s value remembering. Attackers don’t want excellent situations. They simply want one assumption no one checked, one shortcut no one revisited, or one previous weak spot that quietly stayed helpful.