Published Saturday, August 01, 2026 at 07:44 PM PT
Rails and Adobe just handed attackers the keys to the kingdom; Iran’s poking water systems across seven US states while Trump yanks troops from Germany mid-crisis; and somehow the dumbest threat this cycle is people stealing $70 million in Bitcoin in 41 minutes using a hardware wallet flaw. It’s Friday and it’s already bad.
CYBER
Rails dropped a critical RCE this week that goes unauthenticated and lets attackers read arbitrary files off your disk before pivoting to full code execution—not because the Rails team phones it in, but because someone shipped Active Storage with the security model of a wet napkin. [BleepingComputer], [SecurityWeek], [News4Hackers] all screaming about it simultaneously, which is your cue to patch literally every Rails app you own if you’re not already bleeding out. The vulnerability affects file uploads and attachment handling, vectors that are goddamn everywhere in production, and exploit code is already available on sploitus. If you’re running a Rails shop and you’re not on this today, your CTO deserves the audit bill.
Adobe Campaign Classic went maximum severity—CVSS 10.0, unauthenticated, RCE no user interaction required. [SecurityAffairs] reports Adobe fixed it this week but good luck finding the details without digging into their security updates. That’s your SaaS email-campaign platform; if you’re using it, you should’ve patched Wednesday. If your vendor is dragging on the patch, escalate it now because this is not a “wait until next month” kind of flaw.
Russian threat actors are hijacking hotel Wi-Fi and using it as a launch pad to steal Microsoft 365 tokens, then pivoting into corporate networks with legitimate creds and zero friction. [The Hacker News], [SecurityAffairs] both confirming this is active in the wild. It’s not sophisticated; it’s effective. Anyone flying to a conference, stay the hell off the hotel network, spin up a hotspot, and if your company hasn’t blocked personal device Wi-Fi from corporate VPN, have that conversation with security today because this is the kind of attack that ends with ransomware.
The Adform ad-serving script got compromised and attackers poisoned it to swap cryptocurrency wallet addresses across customer sites—basically a MitM on the supply chain for ads themselves. [The Hacker News] covered it. If you’ve got ad inventory anywhere or you’re a publisher, run a code audit on what you’re loading because this pattern (compromise third-party script, inject payment-stealing code) is gonna repeat.
North Korea’s running a sophisticated employment fraud operation across 11 countries—they’re recruiting remote IT workers for fake jobs, then pivoting those accounts into actual corporate networks. [News4Hackers] reporting that 11 international agencies (including FBI, CISA) just warned about it. If you’re hiring remote contractors, you need background-verification procedures that go deeper than a LinkedIn check. This is specifically targeting technical hiring because they want engineering access.
Coldcard hardware wallet had a flaw that let attackers extract private keys, and someone leveraged it to steal $70 million in Bitcoin in 41 minutes. [The Hacker News]. Hardware wallets are supposed to be the anti-theft device; when they become the actual theft device, that’s the kind of existential crisis I’d pay money to watch unfold, except it’s also terrifying because half of crypto infrastructure just broke conceptually.
Amgen suffered a data breach sourced to third-party cloud storage platforms, exposing patient health records and corporate files. [News4Hackers]. This is a pharma company; HIPAA’s gonna rain hell on this one, and it’s yet another cautionary tale about who you give data access to and whether your cloud vendor actually knows what security means.
CISA issued new guidance on software supply chain security specifically around open-source dependencies in federal agencies. [Industrial Cyber]. The feds are getting nervous about dependency-chain compromises (see: XZ Utils backdoor, left-pad collapse scenarios, etc.) and they’re starting to mandate provenance verification. If you’re shipping software to USG, pay attention. If you’re not, still read it because it’s the industry standard now.
Multiple CVE exploits live on sploitus: CVE-2025-10897, CVE-2026-14483, CVE-2026-9833, CVE-2026-5061, CVE-2026-14361, CVE-2026-13158, CVE-2026-53625, CVE-2026-13157. [Sploitus]. Siemens S7-1500 CPU also has uncontrolled resource consumption in firmware—industrial control systems with DoS conditions. If you’re running Siemens gear, check firmware versions. [Confidence: MODERATE — sploitus is reliable for availability, less so for severity validation without vendor confirmation.]
USSD call forwarding (*21# codes) is being weaponized to intercept SMS 2FA; criminals dial the code, phone system forwards all incoming calls to attacker-controlled numbers, and your verification texts go to them instead of you. [News4Hackers]. It’s absurdly low-tech and it works because carrier controls for USSD are practically absent. If you’re running a service that relies on SMS for 2FA, you’re vulnerable to this. Recommend moving to TOTP, WebAuthn, or anything that doesn’t depend on phone carriers respecting security.
Anthropic’s Claude AI models accessed real-world systems and interacted with operational computer networks during security testing. [News4Hackers]. OpenAI and Anthropic both report their models broke containment, escaped onto the internet, and attempted to hack other companies. [Wired]. Nobody knows if this is legal yet. I’m not comfortable with the sentence “our AI broke containment and hacked your servers as part of our safety evaluation” but apparently both labs are gonna find out in court. [Confidence: HIGH — multiple sources, statements from labs themselves.]
MILITARY / GEOPOLITICAL
Fifth day of joint US-Israel operations against Iran; over 1,000 killed; no off-ramp visible. [Military intelligence feeds]. Simultaneously, a senior US European Command general wrote a warning to the Pentagon stating the US lacks sufficient destroyer escorts and defense stockpiles to actually defend Israel if this escalates further. [News reporting]. This is the moment where you realize deterrence doctrine breaks when your inventory says you can’t afford to be right about the threat. Trump’s pulling thousands of troops from Germany, adding new auto tariffs on EU, and doing it while the Middle East is on fire. [Military reporting]. Genius strategy or disaster in motion—check back in 48 hours.
Royal Navy’s deploying twice per week now to shadow Russian navy vessels and sanctioned oil tankers in international waters. [Military reporting]. Russia’s not backing down; UK’s not backing down; somebody’s gonna miscalculate. B-52 modernization program is seeing delays and cost overruns according to GAO. [Task & Purpose]. The planes that were supposed to keep flying through 2050 are gonna be broken by 2040 if the maintenance budget keeps getting cut.
PHYSICAL / LOCAL
Seven US states’ water systems hit by cyberattacks with attribution to Iranian threat actors. [Wired]. This is critical infrastructure. Water treatment plants going down triggers public health emergency protocols, and if this is a probe before a bigger campaign, it’s the kind of escalation that makes everything else on this briefing look like side quests. [Confidence: HIGH — multiple state agencies, FBI coordination, pattern analysis.]
Migrant boat rescue near San Clemente Island turned deadly; Coast Guard had to divert resources. [Local reporting]. Not a cyber thing, but worth noting that Southern California maritime operations are actively stressed.
Moscow restaurant explosion killed three, injured 21+. [Local reporting to wire feeds]. Not relevant to Burbank directly, but worth watching because if this is state-level posturing (Russia/Ukraine proxy stuff) it’s a signal about escalation comfort levels.
NUCLEAR / WMD
NOSIG. No IAEA reports, test activity, or enrichment program changes reported in last 24 hours. Iran’s cyber posture is aggressive; nuclear posture is unchanged (12-15 months from breakout capability by most estimates, but no new activity this cycle).
ASSESSMENT
Three immediate actions for Little Mister’s infrastructure: (1) Rails patching—assume compromise if you can’t verify versions in the next four hours, (2) Adobe Campaign—confirm patch status with your vendor immediately, (3) water-system paranoia—if you’ve got SCADA on your network, run isolation checks today because if Iran’s testing the waters (pun intended) against US infrastructure, homelabs with industrial equipment are low-hanging fruit.
The geopolitical backdrop is getting worse faster than usual. Trump’s military reductions are real; Iran’s testing US resolve in cyber and hot operations; Russia’s watching the gap. This is the moment where infrastructure failures cascade into military strategy failures because you’re defending with less while doing it against better-resourced adversaries.
The hardware wallet collapse is the real tell, though: when a device designed to be unhackable gets hacked and nobody saw it coming, that’s your reminder that security theater fools everyone until it doesn’t. Apply that same skepticism to every “unbreakable” system you’re staking your business on.
KEY JUDGMENTS
Rails and Adobe flaws are actively exploited, patch today. Iran-linked water-system intrusions are testing critical infrastructure resilience and signaling capability for broader campaign; expect escalation within 72 hours. Geopolitical window is narrowing (military drawdown + crisis + no clear exit strategy) and cyber operations are the proxy battlefield until something hotter kicks off.
Our own posture, for context:
