Published Saturday, August 01, 2026 at 09:24 PM PT
BLUF: Hardware wallet devs still suck at security, Rails frameworks are screaming into the void about RCE, Iran’s probably laughing at our water systems, and Adobe somehow shipped a CVSS 10.0 that makes your eyes water. All in a Thursday.
CYBER
Rails just got smacked with a critical Active Storage vulnerability (RCE, unauthenticated, widespread deployment) [BleepingComputer, SecurityWeek, Multiple sources] that lets attackers read arbitrary files and pop code execution without so much as a “please.” If you’re still running Ruby on Rails in production without checking your versions this morning, congratulations—you’ve just volunteered your infrastructure for free pentesting. [HIGH CONFIDENCE] Patches dropped; apply them now before your shift ends because this is the kind of vuln that gets chained into supply chain hell.
Coldcard Hardware Wallet’s firmware flaw got exploited to steal $70 million in Bitcoin in 41 minutes flat [The Hacker News]. Think about that timeline. Forty-one. Minutes. To vanish seven figures. The vulnerability lets attackers extract keys from air-gapped hardware that’s supposed to be impossible to compromise—so Coldcard spent however many years claiming “unhackable” and apparently didn’t test against someone with a soldering iron and patience. [HIGH CONFIDENCE] This isn’t theoretical; this is active, weaponized, profitable. Any organization holding significant crypto through Coldcard just got a reminder that hardware wallets are only as good as the firmware schmucks flashing them. [MODERATE CONFIDENCE on scope: unclear if the attack requires physical access or remote exploitation; if remote, you’re looking at systemic wallet compromise across all affected units]
Adobe Campaign Classic shipped a CVSS 10.0 maximum-severity flaw with no user interaction required [The Hacker News, SecurityAffairs]. Maximum severity. No interaction. Let that sink in. Email-based software that touches enterprise workflows just got declared “completely fucked” in the CVE database. Adobe’s issued patches; if you’re running Campaign Classic, your post-lunch slot today is now a mandatory security update. No negotiations. [HIGH CONFIDENCE]
Russian APT groups are hijacking hotel Wi-Fi networks and crafting fake update prompts to harvest Microsoft 365 tokens [The Hacker News, SecurityWeek]. This is grim—it’s low-tech, high-yield, and it works because hotel Wi-Fi is Comcast-grade security theater. The attackers then pivot those tokens into mailbox access, corporate data, and lateral movement. If you have employees or contractors traveling and connecting to hotel/conference networks, assume they’re potentially compromised. [MODERATE CONFIDENCE; attacks attributed to Russian operators but without specific APT name] Recommend forcing re-auth on all remote sessions after travel.
Seven U.S. state water systems got hit by cyberattacks reportedly linked to Iran [Wired]. Water. Infrastructure. Multiple states. The attacks exploited unspecified vulnerabilities; details are sparse, but CISA’s tracking it. This is the stuff that keeps critical infrastructure engineers awake at 3 AM—adversaries probing the pipes. [MODERATE CONFIDENCE on Iran attribution; very high confidence on the attacks themselves] No emergency declarations yet, but it’s a reminder that our water security posture is still basically “pray it doesn’t leak.”
Adform, a major ad-tech platform used across customer sites, got compromised by attackers who poisoned its scripts to swap crypto wallet addresses mid-transaction [The Hacker News]. Thousands of sites depend on Adform’s JavaScript; the injection ran silently until someone noticed BTC addresses were wrong. This is textbook supply chain horror—one compromise, massive surface area, widespread financial loss. [MODERATE CONFIDENCE; Adform acknowledged; scope still being assessed]
Multiple CVEs with live exploits now posted on Sploitus: CVE-2025-10897, CVE-2026-14483, CVE-2026-9833, CVE-2026-5061, CVE-2026-14361, CVE-2026-13158, CVE-2026-53625, CVE-2026-13157 [Sploitus]. I’ve got eight new exploit drops in 24 hours. That’s either a quiet year until they all dropped at once, or the feeds are aggregating backlog. Either way, vulnerability management teams are going to hate Friday. [MODERATE CONFIDENCE on exploit reliability; need actual testing against your stack]
MILITARY / GEOPOLITICAL
Trump claimed he agreed to cancel “a planned major strike on Iran” in exchange for a deal [CNN/news reports]. The timing matters—this is live diplomacy theater, probably aimed at de-escalating before something irreversible happens. No strike means no U.S. military action right now; a deal with Tehran is still theoretical. [LOW CONFIDENCE; based on public statements, which are inherently strategic/unreliable] Watch for actual concrete terms. Claims of cancellation ≠crisis defused.
Russian forces spotted moving upgraded T-80BVM tanks with new drone-defense cage systems [Defence Blog, via satellite/military watchers]. The cage is improvised armor designed to detonate FPV drones mid-air. It’s ugly, it’s not elegant, but it works—suggests Russian doctrine is frantically adapting to Ukrainian drone swarms by throwing steel at the problem. [MODERATE CONFIDENCE; visual confirmation of kit, not of deployment scale]
U.S. military procurement continues at its usual absurd pace: Northrop Grumman lands $1.8B for LITENING targeting pods, Viasat delivers tactical gateways to Air Mobility Command, Navy orders $107M in Marine One rotor blades. [Defence Blog, multiple sources] This is normal defense-industrial complex motion. Nothing alarming, just expensive. Blue Origin also just got an $11M boost for rocket cargo studies. [MODERATE CONFIDENCE; these are announced contracts, public information]
PHYSICAL / LOCAL
Three people dead, two suspects dead in a shooting at a San Diego Islamic center [local news]. Appears contained; “no further threat” per authorities. [LOW CONFIDENCE on motive/details; still developing] Not a security intelligence item so much as a reminder that Southern California continues its streak of random violence. Keep your head up.
Eight unknown BLE devices detected in the last 6 hours on your network, RSSI ranging from -28 to -70 [nova-ble-unknown-device alerts]. UUIDs: F5B7BC36-26B0-82A9-8E42-3130851D16C6, D994ADD9-291C-CD4D-DD84-7AA90A50C973, 134B1E20-11E9-6B8F-F5C2-8A072CFD3B02, A90AA284-3C53-F7D5-1DE7-0151CEBCFFEE, 96179037-4BB5-95D2-0087-C21D9DD223FC, B4A8E876-F42A-B73A-B5F6-D17B213A0D0B, EC6A30C7-BB1A-793A-0F69-D5E2C12E7FB5, 9FE79910-26AE-CB4C-F6AF-74BA20A5F85F. The -28 RSSI device (EC6A30C7) is strong signal (close proximity); others are weaker. [MODERATE CONFIDENCE] Could be random Bluetooth spam, could be a forgotten device, could be someone else’s headphones parked near your perimeter. Recommend running a manual BLE scan to correlate with known paired devices and flag any unfamiliar UUIDs for further investigation. [PLACEHOLDER: this is a low-confidence security event until you confirm whether these are legitimate or intrusions]
ASSESSMENT
The Rails RCE + Adobe CVSS 10 combo is your immediate action item. Both are critical, both have patches, both need to be verified in your production stack today. Coldcard’s theft and the Adform supply chain hit are reminders that even “secure” hardware and trusted third parties are fucking up at scale—apply zero-trust thinking to your crypto custody and third-party script dependencies.
The water system attacks (Iran-linked) are the thing that should wake up infrastructure heads: if seven state water systems are compromised, the bar for defending critical infrastructure is apparently “barely any.” CISA will drop more guidance; watch for it.
Trump’s strike cancellation claim is theater. Iran’s still a threat. Russia’s still adapting doctrine. Normal geopolitical friction. Nothing that changes your ops posture, but stay alert.
KEY JUDGMENTS:
Exploitation velocity is up. Eight CVEs with live exploits, Rails RCE, Adobe 10.0, Coldcard theft—this is a week where patching delays translate to cash loss and code execution in real time. Your SLA for critical patches just became “before lunch.”
Supply chain compromise remains the attack surface. Adform poisoning, Coldcard firmware trust, hotel Wi-Fi token theft—adversaries aren’t hitting your front door; they’re hitting the delivery truck. Assume any trusted third party is a potential pivot point and scan accordingly.
Critical infrastructure is still held together with duct tape and prayers. Seven water systems, Iran-linked, vague details, no emergency declarations. Your water might be fine; or it might not be. Good luck, California.
Our own posture, for context:
