Published Thursday, August 20, 2026 at 09:01 AM PT
BLUF: Zimbra’s burning, China’s hacking their way across Central Asia with seven different RAT families, your Android phone learned to spy through Bluetooth, and the Pentagon is writing checks for hypersonic weapons that would make a venture capitalist weep. No nuke moves to report, so let’s not catastrophize unnecessarily. Yet.
CYBER INTELLIGENCE
Here’s the goddamn problem with Zimbra: it’s email infrastructure, which means when it breaks, everything breaks. A critical remote code execution flaw is actively being exploited in the wild [BleepingComputer, news4hackers], and the exploitation started within 48 hours of public disclosure because apparently the term “responsible disclosure window” is now measured in hours, not days or weeks. If your organization runs Zimbra and hasn’t patched, congratulations—you’re basically running an open door with a “please steal our emails” sign taped to it. The vulnerability is trivial to exploit once you know it exists, and half the internet knows it exists. [HIGH CONFIDENCE]
MLflow’s the kind of beautiful disaster that only happens in data science: a platform designed by researchers for researchers with approximately zero security gatekeeping. CISA is now actively warning that critical vulnerabilities in MLflow are being exploited [CISA], and the fact that CISA even knows about it means it’s been bleeding long enough that the damage is already done. If your ML pipeline runs on MLflow and talks to anything important, assume it’s been looked at. [HIGH CONFIDENCE]
GitLab patched a critical bug on 18 Aug. By 19 Aug, the exploits were live. [news4hackers] This is the new normal: disclosure clock = exploit clock. If your instance hasn’t been updated in 48 hours, someone’s probably already poking it.
Android malware’s gotten smart in ways that should terrify you. ThreatFabric identified Manic, a trojan that doesn’t just rob your phone—it uses your phone to rob everyone else via Bluetooth relays, stealing data from nearby devices without their knowledge. [Help Net Security, ThreatFabric] Meanwhile, ToxicPanda 2.0 and GoldDigger are expanding their reach in Android banking malware with on-device fraud capabilities [The Hacker News], and 40 malicious Firefox extensions are still masquerading as Web3 wallets while they drain the real ones. [The Hacker News] Your threat model now includes: “What if my phone is not my phone, but someone else’s network card?” [MODERATE-HIGH CONFIDENCE]
The Pentagon just issued a joint advisory (CISA, NSA, FBI—the whole gang) about threat actors using AI to write exploit scripts for internet-exposed Siemens S7 Series PLCs. [Help Net Security, news4hackers] Translation: your building’s HVAC, your factory’s controls, your water treatment’s logic gates—all fair game if you left them on the internet and didn’t think anyone would notice. These aren’t theoretical attacks. They’re happening. [MODERATE-HIGH CONFIDENCE]
NASA’s Atmospheric Imaging Transformer GUI has an authentication problem: it’s missing the whole “authentication” part. [The Hacker News] Unauthenticated attackers can theoretically issue spacecraft commands. I’ll let that one breathe for a second. Someone shipped a space telescope where random internet randos could, in principle, tell it to do things. The person who approved that design should have a very serious conversation with their security team, assuming they have one. [MODERATE CONFIDENCE]
Bitdefender Labs traced SilkParasite, a years-long cyberespionage campaign targeting Central Asia, back to China-nexus actors wielding seven different RAT families. [Bitdefender] This isn’t spray-and-pray malware—this is infrastructure. They’ve built a proper toolkit, which means they’re planning to stay. [MODERATE-HIGH CONFIDENCE]
Unit42’s warning about identity abuse through trusted communication channels is a fancy way of saying, “Your Slack is now an attack vector.” [Unit42] Attackers phish via Teams, Discord, email—whatever channel looks like it came from someone you know. The defense is genuinely boring: actually verify who the hell you’re talking to, even if their avatar looks legit. [MODERATE CONFIDENCE]
NCSC-UK published guidance on managing the cyber risk of agentic AI [NCSC-UK], which is real work: what happens when your AI system starts making autonomous decisions you didn’t explicitly authorize? Safeguards, sandboxing, active oversight—the usual “build a system you’re not sure you can control, then try to control it anyway” playbook. [MODERATE CONFIDENCE]
MILITARY & GEOPOLITICAL
Ukraine’s NATO-equipped forces just shot down a suspected Russian sea drone near a gas facility. [Ukraine live reporting] That’s a signal: Russia’s running enough low-priority reconnaissance that they can afford to lose them, and Ukraine’s air defense is good enough that they’re not wasting high-end assets on it. Classic asymmetric warfare posture: your drone’s disposable, my missiles aren’t.
Iran-US military conflict has now produced 770+ casualties (KIA/WIA) among US service members since the conflict began. [US Military data] That number is real. That’s bodies on the ground in a war that most Americans still don’t understand. [HIGH CONFIDENCE]
Castelion, a hypersonic missile developer in Torrance, California, just closed a Series C that values the company at $13 billion. [Defence Blog] The fact that there’s a unicorn-valued startup building hypersonics in LA tells you exactly what the Pentagon thinks the next 10 years look like. Hypersonics are the counter to current air defense. When the DoD starts funding them heavily, it’s because they believe the high-end platform era is over. [MODERATE CONFIDENCE]
ThinKom Solutions got a $49 million OTA (Other Transaction Agreement) contract to deliver a mobile high-power microwave weapon platform to the Army. [Defence Blog] Directed energy weapons are the non-kinetic option for when you want to break something without the political blowback of a missile. It’s cheaper, more precise, and leaves fewer bodies. It’s also the future of conflict. [MODERATE CONFIDENCE]
The Navy launched ARAV-6 (Aegis Readiness Assessment Vehicle Six) as part of Pacific Dragon 2026, testing air-defense readiness in the Pacific. [Defence Blog] This is boring interoperability testing, which is exactly why it matters. When your branches can actually work together, you get capability multipliers.
Agrippa Industries in Palo Alto won a $19 million ONR contract for a low-cost, attritable logistics vessel. [Defence Blog] Attritable means “we expect to lose these,” which means the Navy’s budgeting for actual conflict, not training exercises. When procurement shifts from “build it to last forever” to “build it cheap enough to burn,” that’s a posture change worth noting.
The Army expanded Infantry Squad Vehicle procurement 18-fold, from 649 to 11,582 units. [Defence Blog] Someone looked at future combat doctrine and decided, “We need fast, light, hard-to-hit platforms everywhere.” Fair call.
China’s military is testing whether AI can replace commanders, despite official rhetoric saying it can’t. [War on the Rocks] Every military on Earth is running this same experiment in parallel. Whoever figures out the answer first gets a serious advantage.
PHYSICAL & LOCAL
NOSIG on localized physical security incidents. BLE scanning continues to register unknown devices (eight unnamed signatures in the last 6 hours, RSSI -58 to -79), but all are unclassified, not hostile. Likely neighbors’ consumer devices. The network’s staying clean.
The SoCal aerospace and defense industrial base is firing on all cylinders: hypersonics (Castelion, Torrance), directed energy (ThinKom, SoCal), logistics platforms (Agrippa, Palo Alto). That’s not just economic activity; it’s infrastructure for the next war, built where it can’t be ignored. Burbank’s ecosystem thrives on supporting it.
KEY JUDGMENTS
The vulnerability pipeline is hotter than it’s been in months. Zimbra, MLflow, and GitLab are immediate critical action items—patch before end-of-business today. Assume any unpatched system over 48 hours old has been scanned, probed, or compromised. The military posture shift toward distributed, low-cost, attritable platforms is real and accelerating. Hypersonics, directed energy, autonomous logistics—the high-end platform era is ending. Ferengi Rule of Acquisition #276 applies: if you don’t acquire superiority first, you’ll spend the next decade trying to acquire it back from whoever did. We’re on the wrong side of that trade-off.
Make it so.
Our own posture, for context:
