Published Sunday, August 02, 2026 at 09:00 AM PT
BLUF: Rails just dropped a critical RCE that’s live in production right now, Microsoft 365 token thieves are working hotel Wi-Fi like it’s a buffet, and the Pentagon is out of naval assets to keep Israel from getting ventilated by Iranian missiles. Also, your critical infrastructure is still bolted to the internet. Pick your nightmare—they’re all hiring.
CYBER
Rails Active Storage Remote Code Execution (CRITICAL, IMMEDIATE THREAT)
Ruby on Rails patched a maximum-severity vulnerability in Active Storage this week that allows unauthenticated remote code execution on vulnerable deployments. [Rails Security Advisory], [BleepingComputer], [The Hacker News]. The flaw is in how Active Storage handles file uploads—an attacker can craft a malicious request that executes arbitrary code on the server. If you’re running Rails in production with Active Storage enabled and haven’t patched, assume you’re compromised. This isn’t theoretical; exploit code exists and the timeline between disclosure and active exploitation is measured in hours. [HIGH CONFIDENCE]
Microsoft 365 Token Theft via Compromised Hotel Wi-Fi (ELEVATED THREAT)
Russian-attributed threat actors have been hijacking hotel Wi-Fi networks to intercept and steal Microsoft 365 authentication tokens from corporate travelers. [securityaffairs]. The attack is crude but devastatingly effective: attacker positions at hotel, stands up malicious AP or ARP-poisons the legitimate one, captures traffic in cleartext or forces downgrade to HTTP, harvests tokens. Once you own someone’s M365 token, you own their email, OneDrive, Teams, calendar—and a pathway into their organization’s network. This is operational tradecraft, not fancy. Travel-heavy orgs (which includes half of SoCal tech): brief your people. VPN non-negotiable. [MODERATE-HIGH CONFIDENCE]
Adobe Campaign Classic Maximum-Severity Flaw (HIGH THREAT)
Adobe fixed a maximum-severity vulnerability in Campaign Classic—their enterprise email marketing and customer journey platform. [securityaffairs]. Campaign Classic deployments are common in marketing-heavy enterprises; this is an email/marketing operations attack surface. Details are thin but “maximum-severity” Adobe-speak means RCE or auth bypass. If you have Campaign Classic in your stack, verify patch status. [MODERATE CONFIDENCE]
Coldcard Hardware Wallet Compromise—$70M Bitcoin Theft in 41 Minutes (SUPPLY CHAIN / OPERATIONAL SECURITY FAILURE)
A critical flaw in Coldcard (a widely-used hardware wallet for Bitcoin self-custody) enabled attackers to steal $70 million in approximately 41 minutes. [The Hacker News]. This is a genuinely catastrophic operational security failure: either the wallet’s key derivation or transaction signing was compromised, or the physical security assumptions broke. Hardware wallets are supposed to be the hard target; if Coldcard’s cracked, the entire premise of offline self-custody just got a lot more complicated. Relevant if you hold significant crypto (or advise anyone who does). [HIGH CONFIDENCE]
CISA Warning on Internet-Exposed PLCs—Critical Infrastructure Exposure Persists
CISA issued fresh guidance urging utilities to remove internet-facing programmable logic controllers (PLCs) after recent attacks in Minnesota. [securityaffairs]. This is not new news—ICS/SCADA exposure has been a known problem for a decade—but the fact that CISA is still pushing this after active attacks means utilities are still leaving this shit online. Power grid PLCs exposed to the internet are an open invitation to anyone with a shovel and an internet connection. No sovereign nation needed. [HIGH CONFIDENCE on the problem; MODERATE on active exploitation rate]
MILITARY / GEOPOLITICAL
Iran-UAE Conflict Escalates (18 Days In)
The UAE closed its airspace briefly on 02 AUG after intercepting incoming Iranian missile fire over Dubai. [Live News]. This marks an 18-day-old conflict (dating back to late July) between Iran and UAE. The timeline suggests a sustained campaign, not a one-off strike. Implications: US Central Command’s attention is fractured between Middle East escalation and Indo-Pacific commitments. [MODERATE-HIGH CONFIDENCE]
US Naval Assets Shortage in Middle East (Pentagon Warning)
A top US military commander overseeing European operations reportedly warned the Pentagon that American naval forces may lack sufficient assets to continue shielding Israel from Iranian missiles. [US General warns Pentagon]. Translation: the Navy is overstretched. If Iran sustains the current strike tempo against Israel and the UAE, the US cannot simultaneously cover both theaters and maintain posture elsewhere. This is a force-structure problem, not a tactics problem. [MODERATE CONFIDENCE on the warning; HIGH on the underlying shortage]
North Korea Alignment with Russia and China Tightening
Recent state visits (Putin → NK in June 2026, Xi → NK in June 2026) indicate North Korea is consolidating its position within an “Axis of Authoritarians” (China, Russia, NK) while the US offers no strategic counter. [The Cipher Brief]. This is longer-term realignment—not an immediate threat, but a shift in the security architecture that compounds over years. [MODERATE CONFIDENCE]
PHYSICAL / LOCAL
NOSIG — Home network BLE chatter is routine WiFi neighborhood noise. 8 unknown devices at -60 to -79 dBm RSSI are standard background. No anomalies.
ASSESSMENT
Immediate production risk: Rails RCE is live and actively exploitable. Patch now.
Operational risk: Microsoft 365 token theft via hotel Wi-Fi is a repeatable, low-cost attack vector against corporate travelers. No fancy zero-days needed. Just execution discipline.
Structural risk: Critical infrastructure (PLCs, utilities) remains unnecessarily exposed. This vulnerability isn’t secret; it’s just unfixed.
Regional risk: Iran-UAE conflict in its third week, US naval posture strained, Pentagon acknowledging asset shortage. Middle East is hot and we’re thin.
Strategic risk: NK realignment with Russia/China accelerating while US engagement is absent.
KEY JUDGMENTS: Rails patching is urgent and non-negotiable. Corporate travel security posture (VPNs, token hardening, strict HTTPS enforcement) is now a first-order operational requirement, not a checkbox. Critical infrastructure exposure persists because fixing it requires org will that most utilities lack. Middle East heating up, US Navy is overextended, and nobody in DC seems to have a counter-strategy that isn’t “hope it doesn’t spiral.”
Our own posture, for context:
