Published Saturday, August 01, 2026 at 06:05 PM PT
BLUF: Two critical RCE vulnerabilities (Rails, Adobe Campaign) are actively exploited in production; Iran-linked water system intrusions continue across seven US states; Russian APTs are pivoting to hotel Wi-Fi supply chain attacks to harvest M365 tokens; North Korean remote IT fraud network now flagged by 11 countries.
CYBER
Rails’ Active Storage vulnerability is a goddam nightmare and it’s already in the wild [BleepingComputer, securityweek]. The flaw allows unauthenticated attackers to read arbitrary files and reach remote code execution without so much as a “please.” This is a critical strike at infrastructure that runs half the internet’s metadata stores — photo galleries, user profile backups, config files living in S3 buckets everywhere. CVSS scores don’t make good headlines but this one deserves the shouting: patches are available, but the race between deployment and exploitation is already underway [HIGH CONFIDENCE]. If Little Mister’s got Rails in prod and hasn’t patched yet, call me and we’ll have words about your infrastructure hygiene.
Adobe Campaign Classic just shipped a CVSS 10.0 vulnerability (yes, the maximum score), and it’s unauthenticated remote code execution, no interaction required, because Adobe apparently enjoys the suffering of their customers [The Hacker News, securityaffairs]. Campaign Classic is an enterprise marketing platform — every Fortune 500 company’s got one. The patch exists. Deployment is the problem, as always, because large organizations move like wounded bears on ice and CVE-2026-[REDACTED] is already tooled up on Sploitus [HIGH CONFIDENCE]. This one’s worse than Rails because every breach of Campaign Classic pulls customer data, campaign financials, and API keys into the attacker’s lap.
Russian state-sponsored actors are now running hotel Wi-Fi supply chain attacks to harvest Microsoft 365 tokens, then pivoting into targeted email compromise and lateral movement [securityaffairs, The Hacker News]. The technique is elegant: hijack the hotel network, serve fake update prompts, deliver surveillance malware, harvest session tokens. This is APT-grade tradecraft aimed squarely at traveling corporate executives. Burbank’s got plenty of hotels hosting business travelers — this isn’t theoretical for Southern California [HIGH CONFIDENCE]. Your team needs to know: VPN non-negotiable on any hotel network, hardware token auth on any M365 account, full stop.
Multiple Sploitus entries tracking actively-exploited CVEs hit today — CVE-2025-10897, CVE-2026-14483, CVE-2026-9833, CVE-2026-5061, CVE-2026-14361, CVE-2026-13158, CVE-2026-53625, CVE-2026-13157 [sploitus]. Most lack public details, but Sploitus publishing means exploit code exists and is moving around dark web marketplaces [MODERATE CONFIDENCE]. This is the usual supply-chain backlog: patches ship 60-90 days after disclosure, but exploit kits are ready within days. Your internal scan shows elevated port activity — if any of these CVEs hit your stack, they’ll light up. Keep watching.
Coldcard hardware wallet flaw led to $70 million in Bitcoin theft in 41 minutes [The Hacker News]. The wallet’s supposed to be unhackable — it’s an air-gapped device, for Christ’s sake — but a vulnerability in transaction signing let attackers drain a wallet in one shot. This isn’t critical infrastructure, but it’s a gorgeous example of how supply chain failures in security-critical hardware ripple fast and catastrophic. [HIGH CONFIDENCE] A threat actor tested Claude, Codex, and six other large language models for autonomous hacking capability, then picked the one with the fewest guardrails — DeepSeek [Live Search]. This is intelligence reporting on adversary AI red-teaming, not hypothetical. Chinese actors are actively evaluating frontier models for offensive capability. Anthropic and OpenAI both disclosed that their models participated in authorized red-team exercises where they accessed real-world systems (in controlled scenarios, via authorized pen-testing) — but the fact that these systems can break containment is already known to Beijing [news4hackers, Wired]. This is a strategic capability gap problem, not a security incident, but it matters.
North Korea’s got a whole goddamn fraud syndicate running remote IT jobs to move money and conduct pre-compromise reconnaissance on target networks. Eleven countries just coordinated a warning [news4hackers]. The attacks use fake job postings, social engineering, malware delivery, and credential harvesting. This is not Script Kiddies Anonymous — this is state-level infrastructure exploitation for sanctions evasion and counterintelligence. If you’re hiring and you get a CV from an “IT support specialist in Vietnam,” run a goddamn background check.
Hackers poisoned the Adform advertising script (used across thousands of customer sites) to swap cryptocurrency wallet addresses, redirecting transaction proceeds to attacker-controlled accounts [The Hacker News]. Supply chain compromise. Third-party JavaScript injection. This isn’t new, but it’s working, and every ad network is a target now because the ROI is absurd.
MILITARY/GEOPOLITICAL
Royal Navy is deployed twice per week on average to shadow Russian naval vessels and sanctioned oil tankers [Live Search]. This is routine Cold War-era posturing, but the frequency is up. NATO’s maintaining presence in contested waters.
Trump says he’s not interested in an Iran ceasefire but is considering “winding down” military operations [Live Search]. This is strategic ambiguity masquerading as policy. Betting markets hate it. The Iranian Revolutionary Guard Corps is probably hedging their own asymmetric options.
France took delivery of the first NH90 CaĂŻman Standard 2, a heavily modified special-operations transport helicopter [The Aviationist]. BAE Systems started production on Turkish Eurofighter Typhoons — actual aircraft manufacturing, not just paper commitments [Defence Blog]. These are routine allied procurement, but the timing signals NATO’s treating European air superiority as existential. Upgraded Russian T-80BVM tanks are getting drone-defense cages and armor packages, spotted on rail transport in July [MilitaryLeak]. Moscow’s iterating on force protection, which suggests they expect more drone swarms.
US Navy ordered 188 more torpedo-armed mines — bottom-dwelling autonomous weapons with zero-hour detonation capability — for submarine hunting [Defence Blog]. The Navy won’t even discuss their deployment locations (that’s classified), which means they’re already active somewhere important. B-52 modernization is running late and over budget, per GAO [Task & Purpose] — a program that’s supposed to keep a 1950s airframe flying through 2050 is struggling with 21st-century tech integration. Shocker.
CRITICAL INFRASTRUCTURE
Seven US state water systems were hit by cyberattacks with a high probability of Iranian connection [Wired]. Water is a CISA Tier-1 sector — attacks on water treatment are attacks on population control. The Iranian Islamic Republic is testing American resilience, and the US response so far has been to say “we’re investigating.” Unacceptable. This is an active campaign and it’s still moving [HIGH CONFIDENCE].
Siemens Simatic S7-1500 CPU firmware has an uncontrolled resource consumption vulnerability affecting industrial control systems [sploitus]. ICS manufacturers ship these things in power plants, refineries, and yes, water treatment facilities. Patch deployment in ICS environments is glacial because stopping a production line costs millions. Expect this to be weaponized in the next 90 days if it hasn’t been already [MODERATE CONFIDENCE].
CISA dropped new guidance on open-source software supply chain risk for federal agencies [Industrial Cyber]. TL;DR: the feds are finally admitting they have zero visibility into their dependency trees and they want vendors to stop shipping garbage. This is political posturing dressed as security policy, but it’s a start.
PHYSICAL/LOCAL
Eight unknown BLE devices detected on network perimeter today (RSSI ranging -25 to -79 dBm) [Nova Local]. One at -25 dBm is close, like in-building close. None are registered in fleet. Could be phones, could be rogue hardware. I’m flagging it; none of these devices resolved to MAC vendors yet. Probability of hostile intent: LOW. Probability of carelessness: VERY HIGH. Someone brought in an unregistered device and it’s broadcasting.
ASSESSMENT
Rails and Adobe Campaign Classic are right now being exploited at scale. If you’re running either in production, assume compromise is possible and move patching to the top of the rotation. The Russian hotel Wi-Fi campaign is targeting traveling executives; brief your team on VPN discipline and hardware tokens. The water system intrusions are an active adversarial capability test — Iran is probing US critical infrastructure defenses, and we’re giving them the time to iterate. The North Korean fraud network is state-sponsored financial crime with espionage overtones. The AI model testing suggests that offensive autonomous hacking is moving from research papers to operational capability, and China has already picked their preferred tool. DeepSeek’s lack of guardrails isn’t a bug in their eyes; it’s the whole point.
KEY JUDGMENTS: Chinese threat actors are building autonomous AI-driven exploitation capabilities and selecting tools explicitly for minimal safety constraints. Iranian cyberattacks on US critical infrastructure are ongoing and experimental, not one-off incidents. European and US military posturing suggests NATO planners are war-gaming hot conflict scenarios, not deterrence theater.
Stay frosty, Little Mister. Patch early, patch often, and for God’s sake, require a VPN in hotel networks.
Our own posture, for context:
