9 verified findings from 1 run · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01The campaign that was seven states a week ago is twelve, and a named utility has put its own name to the impact. The water-sector operational-technology campaign covered here on 2026-08-01 at seven US states has grown to at least twelve, with South Dakota and Georgia newly confirmed. Clayton County Water Authority in Georgia has publicly attached its own name to a distribution-side consequence: it reported unauthorised cyber activity in late July that caused reduced water pressure across part of the county and led it to issue a precautionary boil-water advisory before service was restored within hours. Effects of that class were already reported in aggregate — the FBI has recorded pressure loss and flooding among the wave's operational effects — so the change is attributable confirmation, not a new category of harm. The mechanism is unchanged and involves no vulnerability, and federal agencies have still declined to attribute the campaign publicly. →
02The TeamCity pre-auth RCE is now confirmed exploited — an unpatched build server is a compromise-assessment target. CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on 2026-08-05 based on evidence of active exploitation, changing the status of the unauthenticated JetBrains TeamCity On-Premises remote-code- execution flaw covered here on 2026-07-29 from patch-available to confirmed exploited. JetBrains' advisory, unchanged since 2026-07-27, still records that it was not aware of any active exploitation at publication. No authority has named an exploiting cluster or the observed intrusion path. Because every On-Premises version ever shipped is affected and the flaw needs only HTTP(S) reachability, any TeamCity server that was internet-reachable and unpatched before 2026-08-05 now warrants a compromise assessment rather than only an upgrade. →
03A self-propagating npm worm reaches packages totalling 1.3 billion monthly downloads, and its C2 address lives on-chain. Elastic Security Labs identified CHAINDROP on 2026-08-04, a new wave of the Shai-Hulud npm worm that began with the compromise of the keyv maintainer and has backdoored over 400 npm packages whose combined reach Elastic puts at more than 1.3 billion monthly downloads, keyv alone at over 600 million. Execution comes from a package.json preinstall hook that downloads the Bun runtime to run an obfuscated 711 KB payload, which harvests over 300 credential patterns — AI-assistant tokens, AWS/GCP/Azure/Alibaba credentials, GitHub tokens, Vault tokens, SSH keys and Kubernetes service-account tokens — and self-propagates only when it finds an npm token that both carries package-write permission and can publish without two-factor authentication. Rather than hardcoding a command-and-control domain, CHAINDROP queries an Ethereum smart contract at runtime to resolve where to send the stolen material, so the operator rotates infrastructure without shipping a new payload. →
04A second Swiss public-sector SharePoint victim in 48 hours, and the intrusion sat unnoticed for a week. The IT office of the Swiss canton of Graubünden disclosed on 2026-08-05 — one day after Switzerland's federal IT provider BIT disclosed an intrusion into its own on-premises SharePoint estate — that a SharePoint server hosting the cantonal administration's public web presence was compromised on the afternoon of 29 July 2026. Two files were placed on the cantonal server but their code was not executed, and a first analysis found no compromised accounts and no data exfiltration; confidential and specially-protected personal data are not held on those servers. The canton's IT chief says it could be the same vulnerability found at federal level, but neither Swiss disclosure names a CVE, and the canton shipped an out-of-band update on the evening of 5 August. →
The Amt für Informatik (AFI) of Canton Graubünden detected a cyberattack against the SharePoint server that hosts the cantonal administration's public web presence (Kanton Graubünden, 2026-08-05). The canton's own account is that a first analysis found no indication that accounts were compromised or data exfiltrated, and that confidential information and specially-protected personal data are not stored on those web-presence servers in the first place; the cantonal ePortal and specialised applications were unaffected and remained reachable through the remediation (Kanton Graubünden, 2026-08-05). AFI head Lorenz Tanner, speaking to the Keystone-SDA news agency, put the intrusion on the afternoon of 29 July and said two files were placed on the server whose code was not executed — meaning the compromise sat unremarked for roughly a week before disclosure (persoenlich.com, 2026-08-05). AFI carried out an extraordinary update from the evening of 5 August (persoenlich.com, 2026-08-05), during which the canton said its website would be unreachable for several hours (Kanton Graubünden, 2026-08-05).
What makes this operationally significant for the constituency is not the canton's own limited damage but the pattern: this is the second confirmed Swiss public-sector victim of on-premises SharePoint exploitation disclosed in two days, after the Confederation's IT provider BIT reported roughly 200 compromised federal user and technical accounts (covered here on 2026-08-05). Tanner's stated view is that it could be the same vulnerability identified at federal level, one he describes as affecting SharePoint systems worldwide, and AFI is coordinating with the Federal Office for Cybersecurity (persoenlich.com, 2026-08-05). That link is a plausibility stated by the victim, not a confirmed technical finding — neither Swiss disclosure names a CVE, and no authority has published one for either incident, so an operator should treat "same flaw as the Confederation" as a working hypothesis rather than a scoping fact.
Triage: SharePoint farms legitimately write files into those directories during solution deployments, patch installation and content updates, so file creation alone is not the signal. The discriminators are timing and actor — writes that fall outside a change window, that are not attributable to an administrator session or a deployment job, and that are performed by the web-server worker process rather than the update or deployment tooling. A file that never executes, as at Graubünden, produces no process-execution event at all, so a detection strategy resting only on child-process spawning would have missed this one.
Das Amt für Informatik hat einen Cyberangriff auf einen SharePoint-Server des Kantons festgestellt.
Eine erste Analyse hat ergeben, dass es keine Anzeichen darauf gibt, dass Konten kompromittiert oder Daten abgeflossen sind.
WebPros shipped a targeted cPanel & WHM security release on 2026-08-04 carrying two flaws that both cross an account boundary. In CVE-2026-58048 the vendor's stated impact is that an authenticated cPanel account holder with access to the MySQL/MariaDB database feature could potentially execute arbitrary database commands with full administrative privileges, and that depending on the operating system and database engine configuration this may extend to operating-system-level compromise (cPanel / WebPros, 2026-08-04). The vendor advisory stops there and does not give a mechanism; the root cause is recorded in the HackerOne CNA entry, which states that SQL mode is not preserved when a database is renamed, causing SQL to execute in root context (The Hacker News, 2026-08-04). The same reporting carries the CNA's CVSS v4.0 score of 9.4 (The Hacker News, 2026-08-04).
The prerequisite reads as a mitigating factor and mostly is not one in the environment where cPanel actually runs. On a shared or reseller hosting platform, "an authenticated cPanel account holder" is any paying customer, and the database-rename operation is a routine self-service function. So the boundary this breaks is tenant-to-server: one customer account reaching the database identity that serves every account on the box. That is why the Swiss NCSC placed it on its own Cyber Security Hub dashboard for its constituency (NCSC Switzerland, 2026-08-05), and why it is in scope here — cantonal, communal and public-sector-adjacent web estates in the region are commonly hosted on exactly this control panel rather than on infrastructure the organisation runs itself.
The second flaw, CVE-2026-58047, is an HTTP request-smuggling issue in cpsrvd, the daemon serving the cPanel and WHM interfaces; the vendor states that in some situations an unauthenticated remote attacker may be able to manipulate responses delivered to other users on the same server (cPanel / WebPros, 2026-08-04). Neither flaw is reported exploited by any party. Both are fixed in builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48 and 11.136.0.32, and in WP Squared 138.1.6 (cPanel / WebPros, 2026-08-04).
Detection is thin by nature here and worth being honest about: exploitation of the database flaw is a legitimate, authenticated user invoking a legitimate feature, so it produces no anomalous authentication and no unusual process. What it does produce is database-server activity executing under the administrative account in the immediate wake of a rename operation on a customer database — the discriminator is the privilege level of the executing session rather than the operation itself, visible in database audit logs where those are enabled at all. Response manipulation from the smuggling flaw surfaces, if anywhere, as responses on the control-panel ports that do not correspond to the requesting session.
could potentially execute arbitrary database commands with full administrative privileges
manipulate responses delivered to other users on the same server
VulnCheck published an analysis on 2026-08-05 of what it names ENDLESSDOORS, a remote-access implant pre-installed on twenty router and CPE models from Zbtlink (Shenzhen Zhibotong Electronics), including units sold under a rebranded name through mainstream e-commerce platforms (VulnCheck, 2026-08-05). The implant is a customised build of the open-source rctl remote-control tool. VulnCheck's framing is the point of the research: this is not a memory-corruption bug in a parser but a component in the vendor's product, started at boot by the vendor's own init script, shipped across twenty models (VulnCheck, 2026-08-05).
Operationally, the device registers itself outbound to hardcoded command-and-control hosts with a short unauthenticated message carrying a device-class label and the unit's MAC address, and from that point there is no handshake, no key exchange, no negotiation — whatever the server sends afterwards is handed to a shell and executed as uid 0, with a separate command spinning up an interactive reverse shell (VulnCheck, 2026-08-05). The implant hides in plain sight by taking the name of a kernel worker thread, which in a process listing sits alongside the genuine kernel threads it imitates (VulnCheck, 2026-08-05). Because control depends only on reaching the device's chosen server rather than on any credential, whoever controls that infrastructure — or anyone who takes it over — controls every unit that still calls home. VulnCheck's guidance is to segment or replace: for anything carrying real traffic it advises replacing the device, or at minimum moving it behind strict egress control and treating its LAN as untrusted, noting that disabling the init script with shell access still leaves you trusting the rest of an image that shipped the implant (VulnCheck, 2026-08-05). No vendor remedy exists to weigh against that: VulnCheck states it did not notify Zbtlink, because there is no patch to coordinate and an early warning would reach whoever operates the command infrastructure rather than the device owners (VulnCheck, 2026-08-05).
Triage: routers legitimately make outbound connections for firmware update checks, NTP and vendor telemetry, so outbound-from-CPE alone is normal. The discriminators are that this connection persists as a long-lived channel rather than completing a transaction and closing, that the traffic is command-carrying in both directions rather than a fetch, and that it targets a fixed vendor-independent host on a high port rather than a documented update endpoint on standard ports.
There is no handshake, no key exchange, no negotiation.
HPE Aruba Networking published HPESBNW05100 on 2026-08-04 for two vulnerabilities in the REST API interface of its SD-WAN Orchestrator, describing them as authentication bypass via spoofed HTTP headers that could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions, with successful exploitation permitting an attacker to view and modify potentially sensitive information on the target system (HPE Aruba Networking, 2026-08-04). Both carry CVSS v3.1 9.8 on the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the vendor scopes the exposure tightly: only the 9.6.x software branch is affected, specifically 9.6.2.x builds at 9.6.2.40208 and below and 9.6.3.x builds at 9.6.3.40137 and below, with no branches outside 9.6.x.x affected at all (HPE Aruba Networking, 2026-08-04). Both were reported through HPE Aruba's bug-bounty programme, and the vendor states it is not aware of any public discussion or exploit code targeting them as of the advisory's release (HPE Aruba Networking, 2026-08-04). CERT-FR carried the advisory to its constituency the next day, but scopes it wider: its systems-affected list adds EdgeConnect SD-WAN Orchestrator 9.7.0.x builds below 9.7.0.43264 alongside the two 9.6.x branches (CERT-FR, 2026-08-05). The vendor is authoritative for its own product and the recommended upgrade target is unchanged either way, but an operator sitting on a 9.7.0 build below 9.7.0.43264 should know that one of the two advisories covering these CVEs places them inside the affected set.
The reason this is worth acting on ahead of the routine cycle is not the score but the class and the company it keeps. An SD-WAN Orchestrator is the control plane for an organisation's wide-area network — the system that pushes policy and configuration to every branch appliance — so authentication bypass on its API is reach into the network fabric rather than into one host. This lands in the same short window in which a directly comparable product, Arista's on-premises VeloCloud Orchestrator, was confirmed exploited through an unauthenticated command injection on an interface exposed by default (covered here on 2026-07-28). Nothing in the HPE Aruba advisory connects the two, and this entry does not: the point is that attacker attention is demonstrably on this product class right now, which is an argument for treating the exposure question as urgent even while exploitation of these particular CVEs remains unreported.
Veeam published two security bulletins on 2026-08-04 covering ten vulnerabilities. CERT-FR carried both products and the full set the following day (CERT-FR, 2026-08-05); NCSC-NL's advisory of the same date covers only Service Provider Console and its four CVEs, and does not mention Veeam ONE or the 10.0 agent-host flaw at all (NCSC-NL, 2026-08-05) — worth knowing if your patch intake is driven by a single national feed. In Veeam ONE, CVE-2026-64633 is described by the vendor as allowing remote unauthenticated code execution on the agent host and is scored CVSS v4.0 10.0 with no privileges and no user interaction required (Veeam, 2026-08-04). Its siblings in the same product are CVE-2026-58075 (8.7), an unauthenticated arbitrary file read from the host that the vendor says can be leveraged to escalate privileges locally; CVE-2026-58074 (8.6), arbitrary code execution on the server by a high-privileged user; CVE-2026-64631 (8.6), SQL injection by a low-privileged user extracting database contents; CVE-2026-64634 (8.4), local privilege escalation into the Reporter service context; and CVE-2026-64630 (5.3), retrieval of report data outside a shared link's scope (Veeam, 2026-08-04). All affect Veeam ONE 13.0.2.6723 and all earlier version 13 builds, and all are resolved in 13.1.0.7034 (Veeam, 2026-08-04).
In Veeam Service Provider Console, CVE-2026-58073 (CVSS v4.0 9.5) allows an unauthenticated attacker to impersonate a managed agent and obtain that agent's credentials — though the vendor's own vector records high attack complexity, which is the one meaningful brake on the four (Veeam, 2026-08-04). CVE-2026-58072 (9.0) permits arbitrary file write on the management server leading to remote code execution; CVE-2026-58067 (8.7) lets an unauthenticated attacker exhaust host memory for denial of service; and CVE-2026-58071 (8.2) allows an unauthenticated attacker to reach the proxied appliance API as Portal Administrator during a short window after an administrator session begins (Veeam, 2026-08-04). These affect Service Provider Console 9.2.1.33875 and all earlier version 9 builds, resolved in 9.3.0.35057 (Veeam, 2026-08-04).
No party — vendor or CERT — reports exploitation of any of the ten. The reason this still warrants attention ahead of the ordinary patch cycle is what the two products are: Service Provider Console is the multi-tenant management plane through which service providers administer customer backup estates, and Veeam ONE is the monitoring platform over that same estate. An agent-credential impersonation flaw on the former and an unauthenticated code-execution flaw on the latter both land on infrastructure that holds broad, standing access into the systems an organisation would rely on to recover — and backup infrastructure is a recognised pre-encryption target rather than a bystander.
A vulnerability allowing remote unauthenticated code execution on the agent host.
An attacker who already holds administrative access to a LiteLLM proxy — through leaked master-key or proxy-admin credentials, a prior vulnerability chain, or a supply-chain compromise — can use the gateway's legitimate model-update management API to change a model's configured backend address, silently routing that model's traffic through infrastructure they control and exposing the provider API keys that resolve at request time (Cloud Security Alliance, 2026-08-05). With traffic rerouted, the interesting part is what the relay does next: it abuses LiteLLM's own post-call callback hooks, the extension points the platform provides for logging and response processing, so that an attacker in control of these hooks can inject arbitrary text into a response or, more consequentially, forge a tool call that was never produced by the underlying model (Cloud Security Alliance, 2026-08-05). The technique originates in research published two days earlier under the handle wunderwuzzi (Embrace The Red, 2026-08-03).
The consequence worth internalising is architectural rather than novel-exploit. Because the manipulation happens after the model has already generated its output, it bypasses prompt-level defenses entirely (Cloud Security Alliance, 2026-08-05). Every control an organisation has invested in at the prompt layer — system-prompt hardening, input filtering, injection detection, guardrail models — sits upstream of the tamper point and cannot see it. If the agent downstream of the gateway acts on tool calls, a forged tool call is an instruction to act, and it arrives carrying the gateway's own authenticity.
This is post-compromise, and that framing should govern how urgently it is treated: it is not a way in, it is what a foothold on the gateway is worth. But it inverts a common assumption about AI-agent architecture, in which the gateway is treated as plumbing and its admin credential as ordinary application configuration. On this evidence the gateway is a control-plane component whose compromise is not contained by anything downstream of it. The reporting also notes that a capable attacker reverts the rerouted configuration once finished, which removes the most visible artifact of the compromise (Cloud Security Alliance, 2026-08-05) — so a point-in-time configuration review is exactly the check that will come back clean.
Triage: legitimate operations change model configuration too — adding models, moving between regions, failing over to a secondary provider. The discriminators are that the change is made outside a deployment pipeline or change window, that the new backend address is not one of the organisation's known provider or proxy endpoints, and above all that the configuration is changed and then changed back within a short interval, which is not a shape ordinary operational work produces.
forge a tool call that was never produced by the underlying model
two things changed in the week since the FBI and EPA confirmed water and wastewater utilities in at least seven US states had reported programmable-logic-controller lockouts. The count has grown — water utilities in at least twelve states have now reported cyberattacks on their operational technology, with South Dakota and Georgia announcing incidents and several facilities in Michigan among those remediating, a figure originating with ABC News and relayed by The Record (The Record, 2026-08-05); SecurityWeek reports the same expansion and names Georgia's confirmation as following a pump-station disruption (SecurityWeek, 2026-08-05).
More useful than the count is the second change: a named utility has publicly confirmed a distribution-side consequence as its own. Clayton County Water Authority believes unauthorised cyber activity may have affected its systems in late July, and the incident caused reduced water pressure in parts of the county; the authority issued a precautionary boil-water advisory as a safety measure, and service was restored within hours once testing determined the water was safe (CBS News Atlanta, 2026-08-04). Consequences of that class were not new to the wave — the FBI has said some affected water systems experienced pressure loss and flooding as a result of the activity (CBS News Atlanta, 2026-08-04), and the original entry already carried CISA's statement that it had produced boil-water notices and sustained manual operations. What changes is attribution: those effects were previously federal aggregate reporting, and this is a single identified operator describing what happened on its own network, which is a materially different evidentiary object for anyone arguing an exposure case internally.
The mechanism is unchanged and remains the reason this belongs in a European brief. The FBI's description is that after the devices are accessed remotely, the actors change the passwords and remove the ability of officials to monitor and control the devices (The Record, 2026-08-05). There is no vulnerability in the chain, so there is nothing to patch: the entry condition is reachability plus control of a credential, which is exactly the condition the Censys scan cited in the original entry quantified for Europe — thousands of internet-exposed controllers concentrated in a handful of EU countries and reached predominantly through mobile-carrier connectivity rather than corporate address space. Attribution remains open: federal agencies have declined to publicly attribute the attacks, and no authority has tied the Clayton County incident to any actor (The Record, 2026-08-05).
After the devices are accessed remotely, the actors change the passwords and remove the ability of officials to monitor and control the devices.
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on 2026-08-05, stating it did so based on evidence of active exploitation (CISA, 2026-08-05). That is the delta: the original entry recorded the flaw as patched but with no confirmed exploitation, which was also JetBrains' own position — its advisory states it was not aware of any active exploitation of the vulnerability at the time of publishing, and that advisory has not been revised since 2026-07-27 (JetBrains, 2026-07-27). Neither CISA's alert nor its catalog entry names an exploiting cluster, a victim set, or the observed intrusion path, so the confirmed fact is exploitation itself and nothing beyond it.
Nothing about the underlying flaw has changed. JetBrains describes it as letting an unauthenticated attacker with HTTP(S) access to a TeamCity server bypass authentication checks and execute arbitrary operating-system commands with the privileges of the TeamCity server process, affecting every On-Premises version ever shipped and leaving TeamCity Cloud unaffected (JetBrains, 2026-07-27). CISA's catalog entry names the flaw a deserialization of untrusted data vulnerability (CISA, 2026-08-05); the vendor's own advisory describes the impact without using that term. What changes is the response owed by anyone who was slow to patch. A build server sits upstream of source code, artifact signing and deployment credentials, so the consequence of a week of exposure is not bounded by the server itself. The federal remediation deadline attached to the KEV listing is a US compliance date and carries no operational meaning for this constituency; the exploitation confirmation is what does.
Elastic Security Labs identified a new Shai-Hulud campaign on 2026-08-04 that began by trojanising the monorepo of keyv, a widely used key-value storage library, and embedding a self-propagating worm it names CHAINDROP (Elastic Security Labs, 2026-08-06). Elastic reports over 400 unique npm packages compromised at the time of writing, and quantifies the blast radius through download volume: keyv alone received over 600 million downloads in the preceding month, with flat-cache near 580 million, cacheable-request over 137 million, cacheable over 30 million and cache-manager over 16 million (Elastic Security Labs, 2026-08-06). OX Security published its own first-hand analysis two days earlier and describes a massive Shai-Hulud campaign against npm on its own larger package and download counts (OX Security, 2026-08-04). Elastic frames the wave explicitly as the return of Shai-Hulud rather than a new family, and points to the Dune-derived naming the payload reuses as the similarity to previous Shai-Hulud campaigns (Elastic Security Labs, 2026-08-06).
Execution. The chain starts at a preinstall hook in package.json, abusing a legitimate npm feature that runs arbitrary commands before a package is installed and therefore needs no interaction from the victim beyond the install itself (Elastic Security Labs, 2026-08-06). Every subpackage in the keyv repository was backdoored with a dropper that checks whether the Bun JavaScript runtime is present and, if not, detects the host platform and architecture and downloads Bun directly from its official release page before using it to execute the payload; the temporary Bun directory is deleted afterwards (Elastic Security Labs, 2026-08-06). The payload is cross-platform across Linux, macOS and Windows, and is heavily obfuscated at 711 kilobytes using control-flow flattening (Elastic Security Labs, 2026-08-06). It appears under two filenames — one in packages compromised directly from the keyv monorepo, another in packages trojanised during worm propagation — which share the same hash, so the filename indicates which generation of the infection a defender is looking at (Elastic Security Labs, 2026-08-06).
A second infection route that does not involve installing anything. In Visual Studio Code a folderOpen task under tasks.json runs the dropper when an infected repository is merely opened, and where the stolen credential set includes a GitHub App token the worm commits malicious hooks to up to 50 branches per accessible repository, injecting both a .claude/settings.json and a .vscode/tasks.json into each — so a developer can be infected by opening the repository (Elastic Security Labs, 2026-08-06). That is the operationally important departure: an organisation that responds to a supply-chain wave purely by pinning or freezing dependency installs has not closed the path that fires when an engineer clones and opens the repository, and the AI-assistant configuration file is a trust surface most repository review does not read.
Collection and exfiltration. A collector component scans over 300 unique patterns across credential stores on a developer machine, with notable targeting of AI-tooling credentials for Anthropic, Claude, Codex, Cursor, OpenAI and Gemini, alongside AWS, GCP, Azure and Alibaba Cloud credentials, GitHub personal-access tokens, JWTs and session tokens, HashiCorp Vault tokens, SSH private keys, Kubernetes service-account tokens and npm tokens (Elastic Security Labs, 2026-08-06). Harvested material is gzip-compressed, encrypted under a randomly generated AES-256-GCM key, and that key is in turn RSA-encrypted to the attacker's hardcoded public key (Elastic Security Labs, 2026-08-06). For delivery, CHAINDROP does not hardcode a command-and-control domain: it queries an Ethereum smart contract at runtime to retrieve the current exfiltration endpoint, using multiple RPC providers as fallbacks, so the operator can rotate infrastructure by updating the contract rather than by shipping a new payload (Elastic Security Labs, 2026-08-06). If that path and its successor fail, it falls back to exfiltrating through a public GitHub repository created under the victim's own account with a fixed Shai-Hulud description string (Elastic Security Labs, 2026-08-06).
A containment-sequencing warning the two reports do not agree on. OX Security states the malware carries a dead man's switch that deletes the current machine if the stolen GitHub token is revoked (OX Security, 2026-08-04). Elastic's own guidance is to revoke all GitHub tokens for impacted machines and does not mention any such trigger (Elastic Security Labs, 2026-08-06). Only one vendor reports it and the other does not corroborate it, so treat it as an unconfirmed claim from a first-hand analysis rather than an established property — but sequence around it, because the cost of being wrong is asymmetric. Isolating and imaging a suspected host before revoking its GitHub token loses nothing if the switch does not exist, while revoking first loses the host and its evidence if it does.
Propagation gate. The worm activates only when the credential sweep turns up an npm token meeting two conditions together: package-write permission, and the ability to publish without two-factor authentication (Elastic Security Labs, 2026-08-06). Given a qualifying token it enumerates every package the victim can publish to, downloads each latest tarball from the registry, and republishes it trojanised (Elastic Security Labs, 2026-08-06). That gate is the single most useful fact in the report for a defender, because it converts an unbounded ecosystem-wide risk into a property you can audit on your own accounts.
Triage: developer and CI hosts legitimately run script interpreters from package-manager parents on every build, and legitimately download toolchains, so neither alone discriminates. The separating features are that the runtime is fetched mid-install rather than during provisioning and its directory is removed immediately afterwards; that the process reads credential stores belonging to unrelated tools — cloud CLIs, SSH, Kubernetes, AI assistants — in one burst, which no ordinary build step does; and that outbound blockchain RPC follows the credential reads in the same process tree. Any one of these is weak on its own; the sequence is the signal.
keyv alone received over 600 million downloads last month
Execution is triggered via a preinstall hook in package.json.
package write permissions and the ability to publish without two-factor authentication (bypass_2fa)
CHAINDROP does not hardcode a C2 domain; instead, it queries an Ethereum smart contract
Search every on-premises SharePoint farm in cantonal and communal estates for files created under the web-application or layouts directories between 20 July and 5 August 2026, regardless of current patch level — Graubünden found two planted files on a farm where no account compromise and no data loss were detected, so a clean identity picture does not rule the farm out.
Audit every npm publish token your organisation and its maintainers hold and revoke any that can publish without two-factor authentication — that exact token property, not package popularity, is what decides whether the worm spreads from a compromised developer to your packages.
On any developer workstation or build agent that installed a package from the keyv family since 2026-08-04, treat the AI-assistant, cloud, GitHub, Vault, SSH and Kubernetes credentials present on that host as disclosed and rotate them; the collector sweeps over 300 credential patterns in one pass, so partial rotation leaves the operator a working set. Isolate and image the host before revoking its GitHub token — OX Security reports a trigger that wipes the machine when that token is revoked, so revocation-first destroys the forensic evidence you would need.
Treat any TeamCity On-Premises server that was internet-reachable and unpatched before 2026-08-05 as a compromise-assessment target rather than a completed patch: review build-agent registrations for agents you did not enrol, and rotate the VCS credentials, artifact-repository tokens and signing keys the server holds — an upgrade evicts the entry point but not what was taken through it.
On any cPanel & WHM server that cannot be updated to the patched build this week, revoke the MySQL feature from the cPanel feature lists of accounts that do not need it — WebPros states this blocks the privilege-escalation path without disabling databases that already exist, only preventing their addition and removal.
Move any SD-WAN Orchestrator below 9.6.2.40210, 9.6.3.40140 or 9.7.0.43264 to one of those builds — and include 9.7.0.x instances below 9.7.0.43264 in that sweep even though HPE's advisory scopes them out, because CERT-FR's advisory on the same CVEs scopes them in and the upgrade target is identical; if the change window is further out, apply HPE Aruba's own interim control and confine the Orchestrator CLI and web management interfaces to a dedicated VLAN or firewall policy.
Turn on audit logging for LiteLLM's management API if it is not already recording, and alert on any change to a model's api_base or proxy setting — that configuration write is the one step of this chain that must happen before anything else and the one the attacker later reverts.
Upgrade Veeam ONE to 13.1.0.7034 and Veeam Service Provider Console to 9.3.0.35057 — partial patching does not help here, because both products' full CVE sets are fixed only in those single builds and the 10.0 agent-host flaw needs no credentials.
2026-08-06T0411Z-intel· Claude Opus 5 · window 26 h · 9 entries published
Verification & coverage notes
Window: 26 h, derived from a 24.0 h gap to the previous run (2026-08-05T0412Z-intel), which published successfully. Standard window class — no catch-up disclosure required. Four research domains ran; two of them had to be respawned after provider-side content safeguards terminated the first attempt before any findings were written (see below). Twelve candidates were returned, nine published, two dropped at the relevance gate and one folded into tooling work.
Sub-agent interruptions
Both the first S3 spawn (04:15Z) and the first S2 spawn (04:14Z) were terminated mid-flight by provider-side content safeguards, each before writing a findings file. Both were respawned once and completed normally. The common factor in the two failed spawn messages was a long enumeration of breach, actor and ransomware names carried as dedup context; the respawns replaced that enumeration with a pointer to the coverage file on disk and both completed without incident. The respawned agents were also told to write findings incrementally so a further interruption could not discard confirmed work. No research domain was lost and no coverage was abandoned — but note that the two respawned domains each ran a shorter clock than a first-spawn agent would have, which is a coverage risk worth watching if this recurs.
Borderline drops
borderline-drop: Snowflake mass-extortion actor pleads guilty (US DOJ, 2026-08-05) — a retrospective law-enforcement outcome on a 2024 intrusion campaign. The only transferable lesson is generic multi-factor hygiene on SaaS platforms, which is exactly the class of advice the inclusion gate excludes, and no responder at this organization would act differently in the next seven days because of the plea. The European bank named among the original victims is a victim of the 2024 campaign, not a current home-region development.
borderline-drop: Cl0p's PTC Windchill / FlexPLM extortion moving to mass leak-site publication — the campaign trajectory would be publishable, but the phase change rests solely on one leak-site observatory's scrape of the group's own site, with no victim disclosure and no corroborating journalism. A spot-check of the reporting on this campaign still records that victims had not been listed. Extortion-site claims need victim disclosure or high-reliability reporting behind them, so this is not publishable as sourced. It is a live thread for the next run rather than a rejected story.
Out-of-window items surfaced but not published
Four research publications dated 2026-08-04 fall outside this run's 26 h window and outside the previous run's window as well, so they are recorded here rather than silently dropped: Sophos X-Ops on DFIR-tool abuse by an extortion group (not previously covered — flagged for the weekly sweep), Unit 42's analysis of malware communicating directly to IP addresses, and CrowdStrike's agent-harness escape research. A Cloud Security Alliance note on an MCP-bridge flaw was also dropped because it repackages a disclosure from 2026-07-29 that this pipeline already covered on 2026-07-30.
One item was published despite an out-of-window primary, with the reasoning stated in the entry: the LiteLLM callback-hook technique was originally disclosed on 2026-08-03, with the in-window Cloud Security Alliance research note of 2026-08-05 as the freshest source. It has never been covered here, is not tied to a patch cycle, and its event_date records the original disclosure so the reader is not misled about freshness. Dropping it purely on the date of the first write-up would have left a permanent blind spot on a technique with no CVE and no fixed version to catch it later.
Sourcing and verification
Single-source: 2026-08-06/endlessdoors-zbtlink-router-factory-shipped-root-backdoor — VulnCheck is the only party reporting this vendor-shipped backdoor and the manufacturer has said nothing. Carried at high confidence on the strength of first-hand reverse-engineering and an assigned CVE identifier, with the single-source position stated in the entry. No CVSS is published by the discloser and none is invented here.
Single-source (national-CERT carve-out): 2026-08-06/cve-2026-63077-teamcity-kev-confirmed-exploited — the exploitation finding rests on CISA alone as the authority for its own catalog. The vendor advisory is cited only to establish its position at disclosure; it has not been revised, so it is a nine-day-old snapshot rather than a contradiction.
Single-source (victim carve-out): 2026-08-06/canton-graubuenden-sharepoint-server-breach — every substantive fact traces to the canton as the disclosing victim, with the additional timeline detail coming from its own IT-office head via a news agency. Several outlets carry the story but all republish that one account, so this is one assessor with several publishers and the credibility rating reflects that rather than the publisher count.
The same one-assessor-several-publishers reasoning sets credibility 2 rather than 1 on the Veeam and HPE Aruba entries, where CERT-FR and NCSC-NL restate vendor advisories for their constituencies without independent assessment.
Attribution restraint: the water-sector entry does not adopt the Iran attribution some coverage carries, because the same reporting records that federal agencies have declined to attribute the campaign publicly and no authority has connected the newly-reported Georgia incident to any actor. The twelve-state figure originates with a broadcaster and is reported as such rather than as an agency count.
The link between the two Swiss SharePoint incidents is recorded as the cantonal IT chief's stated possibility, not as a confirmed technical finding, and the registry edge between them is typed related-to rather than anything stronger. Neither Swiss disclosure names a CVE and none is asserted here.
Contradiction: HPE Aruba SD-WAN Orchestrator affected-version scope — the vendor advisory states that no branches outside 9.6.x.x are affected, while CERT-FR's advisory covering the same two CVEs additionally lists 9.7.0.x builds below 9.7.0.43264 in its systems-affected list. Neither side is suppressed: the entry carries both, notes that the vendor is authoritative for its own product, and points out that the upgrade target is the same either way, so an operator on a 9.7.0 build below 9.7.0.43264 acts on the wider scope at no extra cost. The entry's action item was widened to match.
Contradiction: CHAINDROP containment sequencing — OX Security reports a trigger that deletes the machine when the stolen GitHub token is revoked; Elastic advises revoking all GitHub tokens on impacted machines and does not mention such a trigger. One first-hand analysis reports it, the other neither corroborates nor denies it. The entry states the disagreement plainly rather than picking a side, and its action item now tells responders to isolate and image before revoking — the sequence that costs nothing if the claim is wrong and saves the host if it is right.
Deliberate non-update decision, confirmed: the Graubünden entry references the federal BIT incident that an entry from 2026-08-05 already covers, which is flagged for confirmation because a shared entity normally means a candidate should ship as a delta. It ships as a new entry instead because it is a different victim organisation, a different intrusion on a different date, with its own disclosure and its own outcome — the canton reports planted files and no account compromise, where the Confederation reported roughly 200 compromised accounts and no planted-file finding. It is not a delta on the federal story, and the federal entry is referenced only because the canton's own statement invokes it. The sourced connection between them lives on the registry as a typed relation.
Composition checks applied
Every quotation intended for publication was literal-substring-checked against the fetched page before the entry was written, with tags stripped to the empty string rather than to whitespace. That caught four defects in the returned findings that would otherwise have shipped: a dropped leading word in a German-language quote from the Graubünden press release; a Veeam advisory sentence rewritten from "allowing … obtain" to "enables … acquire"; a quote spanning a hard line-wrap in the plain-text HPE Aruba CSAF advisory, which is not a contiguous substring and is therefore not carried as evidence at all; and a cPanel root-cause sentence attributed to the vendor that does not appear on either vendor advisory — it comes from the CVE record via the reporting outlet, and is now attributed there. The Veeam per-CVE scores, affected builds and fixed builds were transcribed from the vendor's own two bulletins rather than from any roundup, and the cPanel CVSS was confirmed against the CNA-assigned score.
Two IOC classes present in the source material were deliberately excluded from entries: the Ethereum contract address CHAINDROP resolves its endpoint from, and the hardcoded command-and-control hosts and payload hash in the ENDLESSDOORS research. Both entries describe the behaviour instead.
A dormant validator check, surfaced for the audit
The residual arithmetic in site/content_model.py reads truth and editorial off the final verification iteration, but the run-record skeleton and every historical record write truth_count and editorial_count. With the keys absent the validator computes an expected residual of zero, so the check has been silently passing on every run rather than validating anything — a record could have declared any residual it liked. It surfaced here only because this run is the first to carry a non-zero residual, which made the mismatch fail loudly instead of quietly.
This run's iteration records now carry both spellings, so the arithmetic is genuinely enforced for this record and the residual of 1 is validated rather than assumed. That is a local workaround, not the fix. The proper repair is to settle on one spelling across the validator, the skeleton in prompts/entry-template.md and the writers, and it should be done by the weekly quality audit rather than mid-run on the publishing path: making a dormant check live can retroactively fail historical records, and that needs a store-wide --all pass to assess rather than a five-minute change with a run waiting to publish.
Coverage and tooling
Coverage gaps: enisa (latest item 2026-07-24, slow policy cadence); cert-at (latest item 2026-06-01, sparse cadence); ncsc-ch-focus (latest post 2026-08-04, outside the window and consumer-awareness material); ccn-cert-es, prodaft (both reachable this run, no in-window content); kela-cyber, push-security, gambit-security (quiet in-window); google-tag (no dated 2026 posts surfaced; broken feed persists); trellix (SPA shell returned no article links this pass); team-cymru, project-discovery, sans-ics (no dated in-window posts enumerable).
Essential-coverage: no misses. All eleven S1 essential-tier sources and all four S2 essential-tier sources were attempted; the one essential source that failed transport (ncsc-ch-security-hub) was recovered within the run by fixing its recipe.
Watchlist: no product or supplier watchlist is configured in the organization profile, so both sweeps are no-ops and the anti-overshoot guideline does not apply. S1 and S4 reported checked=0, hits=0 as instructed.
ATT&CK dataset: the pinned release is v19.1 and upstream v19.2 published inside this window (2026-08-05). The pin is not stale enough to fail validation and every technique id used this run validates as active against v19.1, so the update is left to the weekly run that owns it rather than changed mid-intel-run. Recorded here so the weekly does not have to rediscover it.
Source health: 175/175 sources probed in 82 s, 99 direct-ok, 75 bridge-ok, 1 client-error, and zero sources flagged as needing a bridge or a demotion. No unsolved repair items outstanding at the end of this run.
No new candidate source was added this run; no sub-agent proposed one, and no candidate met the promotion bar in the state digest.