Published Sunday, August 02, 2026 at 01:50 PM PT
BLUF: Check Point’s auth bypass is burning right now, Coreweave’s looking wide open, and your Coldcard just taught Bitcoin a hard lesson about what “hardware security” actually means. Meanwhile, someone’s BLE devices are sniffing around your gateway like they own the place.
CYBER
The Check Point SmartConsole authentication bypass (CVE-2026-16232) isn’t theoretical anymore — it’s under active attack, and the PoC dropped public, which means every script kiddie with an afternoon free just earned themselves a “seize full admin control” button on any SmartConsole instance that hasn’t patched. [HIGH CONFIDENCE] This is the flavor of vulnerability that doesn’t ask politely: an unauthenticated attacker walks up to your management console and inherits god mode over your entire firewall estate. If you’ve got Check Point stuff in the perimeter — and if you’re running infrastructure in LA, odds are someone in your orbit does — this went from “future concern” to “get on a call with your vendor yesterday” about 18 hours ago. CVSS doesn’t lie here, and neither do exploit drops. [SecurityAffairs]
Coreweave’s Marimo is marinating in its own negligence with CVE-2026-39987: a missing authentication check on critical functions that scores a tidy CVSS 9.8, which is the vulnerability equivalent of leaving your front door not just unlocked but actively swinging open with a “rob me” sign duct-taped to the frame. [sploitus] The PoC exists, which means anyone can now authenticate to Marimo with the effort it takes to read a Reddit post. Coreweave runs GPU cloud infrastructure, so if your ML pipeline touches Coreweave — if you’re doing inference, training, or anything involving rented silicon — this one’s your problem to solve before it becomes someone else’s evidence. Missing auth on critical functions is the kind of architectural oopsie that makes infosec teams age rapidly.
The Flatpak sandbox escape chained three failures into one ugly vulnerability (CVE-2026-5674): PulseAudio’s auth check gets skipped, PipeWire loads unrestricted modules by default, and dlopen() runs without restrictions, and suddenly your containerized audio daemon is no longer contained. [latesthackingnews] This isn’t “maybe you could escape if you tried”; this is a functional exploit chain that takes a Linux containerization model that was supposed to keep untrusted apps locked down and dunks it face-first into a pool of privilege. If you’re running Flatpak on your infrastructure — less common in server land, but increasingly common in dev/staging/edge setups — you’ve got a perimeter problem on your hands.
ArcadeDB shipped an IDOR (cross-database authorization bypass) in versions before 26.7.2, but the risk assessment landed at “Low” because ArcadeDB isn’t exactly running the NSA’s most critical infrastructure. [cxsecurity] Update it anyway — drift isn’t your friend — but this one doesn’t wake you up at 0300Z.
PackageKit got a TOCTOU race condition (CVE-2026-41651) that lands at CVSS 8.8, meaning there’s a time window where an attacker can race the check-then-use pattern on package installation and flip what gets installed without PackageKit noticing. [sploitus] This is the kind of vulnerability that’s a nightmare in automated deployment pipelines where you’re installing packages from untrusted repos or mirrors. Patch this on any system doing dynamic package management.
Coldcard’s hardware wallet just provided a master class in why “it’s a hardware wallet, it’s secure” is a dangerous lie. A flaw in the device allowed someone to extract $70 million in Bitcoin in 41 minutes flat, which is faster than most people’s credit card fraud alerts trigger. [The Hacker News] Hardware security isn’t magic; it’s engineering, and engineering fails. If your org holds crypto assets — even small amounts for cold storage or integration testing — treat hardware wallet firmware updates like security patches, because they are.
The SBOM-to-binary gap that Black Hat highlighted is the abstract version of the same problem: vendors publish Software Bill of Materials claiming pristine supply chains, but the actual compiled binary often includes dependencies, patches, and code that never made it into the official SBOM, leaving a gap where attackers can hide. [The Last Watchdog] This is supply chain risk distilled into a single uncomfortable truth: you can’t verify what you can’t see, and vendors have a vested interest in making bills of materials look cleaner than the reality.
MILITARY/GEOPOLITICAL
North Korea has shifted into Russia and China’s gravitational field harder than at any point since the Korean War ended. Xi’s June state visit to Pyongyang followed Putin’s earlier visit, and the pattern is unmistakable: NK is actively working to deepen military relationships with both superpowers while the United States has no coherent strategy for the region beyond what looks like reflexive posturing. [The Cipher Brief] This matters for your infrastructure because a closer China-Russia-NK axis means more coordinated cyber operations, more intelligence cooperation, and a higher probability that geopolitical friction becomes kinetic faster than it otherwise would. The US government apparently hasn’t learned from Afghanistan that strategy-free military commitment is a bad investment.
The Ohio-class guided missile submarines — the backbone of the US strategic deterrent — are all set to retire within the next three years, and there’s no replacement available yet. [The War Zone] These aren’t just weapons systems; they’re the ultimate insurance policy against strategic surprise. Losing them without a fielded replacement is a force posture gap that creates either urgent pressure to extend aging platforms past their design lives or a strategic vulnerability window the size of a Pacific island. Infrastructure security folks generally don’t think about SSBN retirement schedules, but when the Pentagon gets nervous about deterrent gaps, cyber operations against critical infrastructure become more likely — deterrence is expensive and unreliable, but demonstrating resolve against civilian infrastructure is cheap and fast.
Africans are being actively lured into fighting for Russia in Ukraine and getting thrown at the deadliest front lines like they’re expendable. [Military News] This is a recruitment and manpower desperation play by Moscow, and it signals that Russia’s own manpower pool isn’t infinite. The pattern matters: when militaries start getting aggressive about foreign recruitment, they’re usually hedging against unsustainable casualty rates at home.
PHYSICAL/LOCAL
Your gateway’s BLE environment is noisy. Over the last six hours, Nova’s threat telemetry flagged eight unknown Bluetooth Low Energy devices in your network perimeter: four unnamed with RSSI ranging from -47 to -61, and three named devices (NL8NN at -75, NL8ZC at -78, NJWRA at -69). [SECURITY] Unknown BLE devices in your proximity could be reconnaissance probes, neighbor IoT bleed, or actual attackers triangulating your network infrastructure. None of these RSSIs indicate they’re far away — the signal strength suggests active presence within your home network range. BLE is historically low-priority until it isn’t: someone with time and intent can map your device inventory, correlate behaviors, and use it as a beachhead for physical-layer attacks. You should inventory your authorized BLE devices and check whether any of these UUIDs are registered equipment. If they’re not yours, and they persist, they’re either lost AirTags from neighbors (likely) or reconnaissance (less likely but worth taking seriously).
ASSESSMENT
Active exploits exist for three CVSS 9+ vulnerabilities (Check Point auth bypass, Coreweave missing auth, and infrastructure ecosystem gaps like Flatpak), and all three have public PoCs. If you’re running Check Point, update immediately; if you’re touching Coreweave’s GPU cloud, verify your access controls. The geopolitical backdrop is a strategic shift that makes cyber operations more likely in the next 18 months, not less. Unknown BLE devices on your perimeter deserve a 30-minute sweep to confirm they’re not yours.
KEY JUDGMENTS
The threat surface this week is dominated by architectural failures masquerading as vulnerabilities: vendors skipping auth checks, shipping SBOMs that don’t match binaries, and launching hardware wallets with extractable keys. North Korea’s reorientation toward Russia and China is the geopolitical story of the quarter, and it raises the temperature on US-allied infrastructure security. Your unknown BLE devices are worth investigating, but low-confidence that they’re hostile — still, inventory them before you move on.
Our own posture, for context:
