Published Saturday, August 08, 2026 at 09:03 AM PT
BLUF: Three actively-exploited, zero-auth remote-code-on-demand vulnerabilities hitting production shops while unknown Bluetooth stalkers probe your perimeter. The industry is getting absolutely roasted today, and your network apparently made some uninvited friends.
CYBER
Progress Kemp LoadMaster — Active Exploitation, 792+ Attempts [CISA KEV, HIGH CONFIDENCE]
The LoadMaster vulnerability isn’t a whisper anymore. It’s a fire drill. CISA just added it to the Known Exploited Vulnerabilities catalog after fielding 792 confirmed exploit attempts in the wild. [The Hacker News] This isn’t “someone tried it once” — this is “threat actors are testing it, weaponizing it, and moving laterally off it as we speak.” Kemp LoadMasters sit in front of critical infrastructure everywhere: healthcare, finance, SaaS platforms. If you’ve got a LoadMaster in your stack, it’s already on the cross-hair. Patch velocity is now your only friend. If the patch queue is longer than your attention span, you’re bleeding.
N-able N-central — Persistence Achieved, Hotfix 2 Rolling [The Hacker News, HIGH CONFIDENCE]
N-able’s managed service platform got compromised — badly enough that they shipped Hotfix 2 after attackers reportedly breached managed systems and persisted (the security euphemism for “set up shop for the long haul”). [The Hacker News] This is the MSP supply-chain dream scenario from the threat actor’s perspective: one compromise = access to hundreds of customer networks. N-able’s customer base runs on trust. That trust is now collateral damage. If you’re an N-able customer, assume you’ve been inside the blast radius and act accordingly.
Metabase Zero-Day — Unauthenticated Admin Access, In The Wild [The Hacker News, HIGH CONFIDENCE]
Metabase’s analytics dashboard just got a first-day exploit in the wild that strips authentication entirely and hands you admin access. No credentials required. Just a crafted request and you’re in — pulling reports, modifying dashboards, exfiltrating datasets. [The Hacker News] Metabase sits in a lot of infrastructure because it’s lightweight and works. That same lightweightness means it often lives in environments that didn’t build defense-in-depth around it. If Metabase is running on an internal network somewhere, assume it’s already been poked. If it’s exposed to the internet (embarrassingly common), assume it’s been pwned.
Atlassian Rovo — LLM Injection, Data Exfiltration [The Hacker News, MODERATE CONFIDENCE]
Rovo’s AI chat agent in Jira and Confluence can be socially engineered into dumping sensitive data to attacker-controlled endpoints. [The Hacker News] This is the new frontier of supply-chain attacks: the model itself becomes the vector. You don’t need to break Jira anymore; you just need to ask Rovo nicely for your company’s architecture docs and it obliges. Rovo operates with whatever permissions the user account has, so a compromised employee credential = full data access via the AI chatbot. It’s not a bug. It’s a feature gift-wrapped for threat actors.
CSS-Based Webmail Attacks — Tokenization Theft [The Hacker News, MODERATE CONFIDENCE]
Researchers discovered a novel attack surface in how webmail clients handle CSS: crafted stylesheets can exfiltrate session tokens and passwords by leaking them into timing channels and network requests. [The Hacker News] This is the kind of thing security researchers present at conferences to scare CSOs. Someone’s already weaponizing it. Webmail is the last place most people think “CSS attack” happens, which is exactly why it works.
Exim Use-After-Free — CVE-2026-45185, CVSS 9.8 [Sploitus, HIGH CONFIDENCE]
A use-after-free flaw in Exim mail servers just got a public PoC. CVSS 9.8 (practically perfect score for “your server is now my server”). [Sploitus] Exim is ancient, ubiquitous, and still running on a thousand production systems because “if it ain’t broke, don’t mail-filter it.” This one is broke, and it’s RCE-grade broke. If you’re running Exim, you’ve got maybe 48 hours before automated scanning catches up.
Unlimited Technology Systems — 3.8M Healthcare Records Breached [Securityaffairs, HIGH CONFIDENCE]
A healthcare data processor suffered a breach exposing 3.8 million patient records. No details on the vector yet, but healthcare vendors are canonical targets. [Securityaffairs] The fallout: notification letters, credit monitoring offers nobody reads, regulatory fines, and the slow corrosion of confidence that “HIPAA-compliant” means anything anymore.
AI Agents Bypassing Security Perimeters [The Last Watchdog / Black Hat, MODERATE CONFIDENCE]
Black Hat had a panel on autonomous AI agents that bypass human detection and machine gates — essentially AI doing social engineering automatically, at scale, without fatigue. [The Last Watchdog] This is the shift that should keep you up: traditional defenses assume a human attacker with bandwidth constraints. An automated agent has no such limits. It doesn’t sleep, doesn’t get bored, doesn’t need a paycheck. It just runs until it works.
MILITARY / GEOPOLITICAL
Iran Escalation — Cyber Threats to US Water Infrastructure [The Cipher Brief, MODERATE CONFIDENCE]
Iranian leadership is publicly “counting coup” on the United States (their phrase; their messaging is as cornered as their military posture). Reports cite potential Iranian cyberattacks targeting US water supply systems. [The Cipher Brief] This is the asymmetric playbook: US air strikes → Iranian cyber retaliation → US threats → repeat. The cycle is now running hot enough that critical infrastructure is explicitly in play. Water utilities in multiple states report compromise attempts. [Wired] None confirmed yet, but the tension is live.
Ukraine F-16 Campaign — Cruise Missile Intercept Rate [Defence Blog, HIGH CONFIDENCE]
Ukrainian F-16s are proving their worth. Out of 61 Russian cruise missiles launched in a recent wave, Ukrainian air defenses intercepted 54 — with F-16s accounting for a significant portion of the kills. [Defence Blog] The strategic angle: air superiority isn’t giving Russia the stand-off advantage they expected. Expensive missiles, attrited at pace.
UK Cheap Cruise Missile — Formula 1 Engineers, Production Ready [Defence Blog, HIGH CONFIDENCE]
A British engineering firm with Formula 1 racing heritage announced production readiness for a low-cost cruise missile. [Defence Blog] The economics of modern warfare are shifting: if the UK can field dirt-cheap standoff weapons at scale, the calculus changes. Attrition strategies that worked against expensive platforms start to fail.
NATO Equipment Proliferation — Anti-Drone Platforms, Emerging Doctrines [Defence Blog, ongoing]
Across NATO, new platforms integrating anti-drone turrets and sensors are being deployed. [Defence Blog] The lesson from Ukraine: air defense is increasingly about cheap autonomous threats, not crewed aircraft. The doctrinal shift is underway globally.
PHYSICAL / LOCAL
Unknown BLE Intruders on Your Network — 8 Devices, Last 6 Hours [Nova Security Log, HIGH CONFIDENCE]
Your perimeter just lit up. Between now and 6 hours ago, your BLE scanners detected eight unnamed Bluetooth devices probing the network:
0FC323B9-B42C-D8CF-CE96-EACE5CC67443(RSSI -77, far edge)AE90174F-C103-B73C-E05B-B858B2999381(RSSI -77, far edge)A0C8F189-6353-C358-C2BC-85485E0E0446(RSSI -51, close)7C3C3BE8-CB0A-571C-4E67-359264279607(RSSI -50, close)1390C336-4288-8B2A-F93C-9C30CF94B32A(RSSI -71)988A8814-086E-6DCB-FDBE-7DDC29E1ED46(RSSI -71)B0824C6F-99E3-5771-75EF-F957462EEDBF(RSSI -75)NL8NN(RSSI -76, labeled but unregistered)
Two of these (A0C8F189 at -51, 7C3C3BE8 at -50) are strong signals, meaning they’re close enough to your network to negotiate. Neither is in your trusted device roster. Neither has sent an auth packet. They’re just… listening. Watching. Learning your beacon topology.
This could be:
- Neighbor’s device drifting range (least spicy, but you can’t rule it out).
- Deliberate BLE reconnaissance — someone profiling your network topology before escalation.
- A forgotten IoT device you’ve already forgotten you bought.
Action items: Run a physical sweep of your property boundary. Identify the close-range devices (start with A0C8F189 and 7C3C3BE8). If neither belongs to you, you’ve got an active perimeter probe. If they’re yours, patch them and add them to trusted roster. If they’re not… welcome to the next phase.
ASSESSMENT
Three of the most critical software stacks in modern infrastructure are actively bleeding today: load balancers (Kemp), MSP platforms (N-able), and analytics (Metabase). All three have zero-auth remote-code execution in the wild. The industry’s patch velocity is about to be stress-tested at scale.
Meanwhile, your own perimeter is showing signs of active reconnaissance — unknown BLE devices at close range, unnamed, untrusted, just… watching. Whether this is noise or signal depends on the next 24 hours.
The geopolitical temperature around Iran is climbing in parallel. Water utilities are already being probed. If cyberattacks on critical infrastructure are now part of the deterrent calculus, then the bind between cyber and kinetic is now hot.
KEY JUDGMENTS: (1) Production patching is now your primary survival metric — Kemp, N-able, Metabase, and Exim are all heading into the wild-exploitation cycle simultaneously. (2) Your local perimeter is under active surveillance; identify and remediate the BLE unknowns before they escalate to higher-frequency radios. (3) The year-over-year threat tempo is accelerating — supply-chain compromise is now default, AI-assisted attacks are operationalized, and critical infrastructure is in explicit scope for nation-states. The old model (perimeter defense, assume-breach) isn’t enough anymore; you need detection velocity that matches exploitation velocity.
Stay twitchy, Little Mister. The network’s getting noisy.
Our own posture, for context:
