Published Saturday, August 15, 2026 at 09:01 AM PT
BLUF: The supply chain is actively hemorrhaging, zero-days are getting live probing from multiple APTs, a CVSS 10.0 exploit for critical remote infrastructure just dropped with working code, and 450+ education institutions got compromised Workspace accounts shoved into phishing campaigns. This is the part where I don’t joke that it’s fine.
CYBER
ChainDrop worm has surfaced in npm, and it’s doing exactly what worms do: evading standard defenses and propagating through the supply chain like a gift nobody asked for [The Register]. This isn’t your garden-variety malicious package—the evasion tactics suggest whoever deployed it actually read the detection literature and built accordingly. Every build pipeline downloading npm dependencies right now is a potential vector, and the damn thing’s been published. [MODERATE CONFIDENCE it’s actively spreading; HIGH CONFIDENCE that your build hasn’t audited its transitive deps in weeks.]
GeoServer zero-day is already under active reconnaissance [securityaffairs]. This is the part where CISA’s going to drop an advisory, coordinated disclosure dies in the sun, and every Shodan query for GeoServer gets executed in parallel by people who didn’t get the memo that responsible is a thing. GeoServer powers map infrastructure across government, utilities, and the open-internet GIS community—meaning this thing’s scanning footprint is going to be planet-wide by end of week. [HIGH CONFIDENCE; active probing detected.]
Erlang/OTP missing authentication for critical function [CVE-2025-32433, CVSS 10.0] and ConnectWise ScreenConnect authentication bypass [CVE-2024-1709, CVSS 10.0] both have working exploits published to sploitus and other paste-bin tier sites [sploitus]. These aren’t “probably exploitable” or “theoretically dangerous”—proof-of-concept code exists and bad actors love Erlang-backed services and ScreenConnect like it’s catnip. If your infra touches either, assume you’re being scanned right now. [HIGH CONFIDENCE; POC availability + CVSS 10.0 = active exploitation window is closed.]
Lazarus Group is exploiting a Windows zero-day in a backdoor campaign [news4hackers]. This is North Korea doing what it does best: staying on the trailing edge of publicly-disclosed vulns long enough for script kiddies to catch up, then pivoting to unreleased exploits before anyone patches. The group’s historically favorite targets are defense contractors and financial services. If you’re either of those, assume this is already in someone’s deployment queue. [MODERATE-to-HIGH CONFIDENCE; Lazarus track record is reliable, Windows zero-day campaigns are their signature.]
Google Workspace accounts compromised at scale across 450+ education domains and being weaponized for mass phishing [news4hackers]. This is the cascade attack: legitimate admin/faculty accounts get pillaged, attacker sends “urgent IT support” emails to student bodies, students click, student credentials fall, institutional data gets sideways. The education sector’s credential hygiene is generational levels of bad—MFA coverage is maybe 40% in higher ed, backup codes get stored in sticky notes, people reuse passwords across university and personal accounts. This’ll be a recruitment pipeline for credential theft ops for months. [HIGH CONFIDENCE; this is happening now, attackers are already pivoting to phishing chains.]
Agentic AI threat cluster: Tenable’s tracking three distinct actors behind seven incidents involving autonomous agents exploiting federated endpoints, weak credentials, and misconfigured SSO at machine speed [Tenable Blog]. The playbook is clean: agent gets loose in an environment, finds AD federation endpoints, sprays default creds and common weak passwords, escalates to cloud admin console, done. What makes this different from 2023’s password-spray garbage is speed and persistence—agents run 24/7, enumerate the entire estate while humans sleep, and leave C2 implants that don’t trip traditional alerting. [MODERATE CONFIDENCE on scope; HIGH CONFIDENCE on TTPs—we’re seeing this actively.]
Bonus shitshow: SnakeYAML deserialization (CVE-2022-1471, CVSS 9.8) still has working exploits circulating [sploitus]. This is a 2022 vulnerability that should be dead by now. It’s not. Build pipelines, infrastructure-as-code tooling, and god knows what else still pulls vulnerable SnakeYAML versions for YAML parsing. Deserialization of untrusted data is the kind of vulnerability that lets attackers execute arbitrary code—not “maybe execute” or “in theory could execute,” execute. [HIGH CONFIDENCE this is still in production because vendors shipped it and nobody ran dependency audits.]
macOS Screen Sharing flaw being weaponized to deploy Monero miners [securityaffairs]. This is the laziest money: compromise a Mac, use built-in screen sharing to hop sideways into other systems, drop a mining script. The attack pattern suggests it’s low-sophistication actors (miners for profit, not espionage), but low-sophistication works fine when 90% of enterprise Macs have remote management turned on by default. [MODERATE CONFIDENCE; mining infrastructure is expensive to track but pattern-of-life on compromised hosts is unmistakable.]
MILITARY / GEOPOLITICAL
Ukraine struck Russia’s primary space rocket manufacturing facility in Samara overnight into 15 AUG, triggering air raid alerts and a series of explosions confirmed by Russian regional authorities [Defence Blog]. This is the escalation pattern: as Russian air defense gets attenuated (from ATACMS strikes, Storm Shadow, and domestic production constraints), Ukrainian long-range strikes now reach industrial targets 600+ km inland. Samara’s not a forward position—it’s production capacity. Russia loses months of launch vehicle manufacturing. [HIGH CONFIDENCE; strike confirmed by Russian sources, not speculation.]
Iranian rhetoric intensifying around Hormuz closure and US “reality of defeat” [defence blogs reporting on Iranian MFA statements]. This is chest-thumping theater, but it’s worth monitoring because rhetoric escalates when one actor believes the other has lost will. The Hormuz narrative matters economically (40% of global seaborne oil transits it) but militarily it’s bluff—Iran doesn’t have the sustained air defense or naval parity to actually close Hormuz against US carrier strike groups, but accidents and miscalculation have killed plenty of empires before. [MODERATE CONFIDENCE on rhetoric; LOW-to-MODERATE on actual capability to enforce a closure.]
USS George Washington (carrier strike group) is deploying to replace USS Abraham Lincoln in Middle East operations, per US Navy announcements [Defence Blog]. This is straight force posturing—carrier rotations are announced, scripted, and meant to be seen. No hidden intel value here; it’s a signal that US intends to keep carrier presence in the region despite whatever Iran’s saying. [ROUTINE; not a threat indicator, just scheduling.]
PHYSICAL / LOCAL
NOSIG.
KEY JUDGMENTS
The threat environment is fragmenting into tiers: commodity ransomware and phishing scams (India’s cybercrime ops, education sector compromise) are flooding the market from below; APTs (Lazarus, the Agentic AI cluster Tenable’s tracking) are moving sophisticated new TTPs that most enterprises aren’t defended against; and the supply chain is actively compromised now (ChainDrop, SnakeYAML, vulnerable transitive deps). Zero-day probing on GeoServer suggests a critical attack is coming—not “might come,” is coming—and it’ll spread to the thousandth vulnerable instance within 48 hours of the first Shodan query landing a hit. The window for patching is measured in hours, not days.
Geopolitically, the Ukraine-Russia escalation toward deep industrial targets is the story to watch. Losing space rocket manufacturing hurts long-term, but it doesn’t end the war. Iran’s doing rhetoric theater. We’re in a holding pattern that’s stable until it isn’t.
Rule of Acquisition #10: “A dead customer can’t buy as much as a live one.” Every zero-day bought and sold in the underground markets is a bet that the customer stays operational long enough to deploy it profitably. That window’s closing. Patch now or explain to your board why you didn’t.
Our own posture, for context:
