Published Saturday, August 29, 2026 at 09:01 AM PT
CYBER
McKesson, the company that literally keeps half the country medicated, got properly invaded. ShinyHunters claimed they stole 28 crore (280 million records, for the Americans in the room) from unauthorized third-party application access — not even a front-door smash, just finding the side gate unlocked and walking through like they own the place. [HIGH CONFIDENCE per news4hackers] Healthcare supply chain compromises are the gift that keeps giving; the fallout here will probably take months to untangle. If you’ve got any McKesson-fed systems, this is the moment to start digging through your ingestion logs.
Provenance Blockchain, a Cosmos SDK proof-of-stake chain that most of us have never heard of (and for good reason, apparently), had a state divergence bug that let any user grant themselves arbitrary token mint/burn/withdraw permissions. Trail of Bits found it, reported it, and the whole thing reads like someone handed the keys to a house and wondered why the guests started taking the furniture. [Trail of Bits] This is the kind of access control clusterfuck that bankrupts protocols quietly — not an exploited-on-mainnet screaming headline, just a slow drain while insiders argue about patches. Cosmos ecosystem keeps getting raked over like this because SDK defaults are cargo-culted without second thought.
Microsoft Threat Intelligence flagged TerminalFix, an active campaign deploying fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel for multistage intrusion. [Microsoft Security] This is not script-kiddie noise — multistage reverse tunnel staging is APT-grade tradecraft. The fake CAPTCHA vector is classically effective (phishing bait that looks legitimate because CAPTCHA prompts should exist). If you’re running Windows anything, assume your users have seen these. Defense: awareness briefing, EDR tuning for DLL sideload patterns, egress rules that crater on unexpected outbound tunnel traffic.
Water systems. Over 100 US water utilities got targeted by hackers; Wired’s reporting this as an active campaign, and CISA isn’t contradicting them. [Wired, CISA implicit] This is critical infrastructure, the kind of target that moves the needle on geopolitical temperature. Most municipal water systems run legacy SCADA stacks with the security posture of a 1990s AOL dialup machine. If you’ve got any water utilities on your watch list, now’s the time to beg your CISO for pen-test budget and ICS hardening mandates.
On the flip side, U.S. agencies disrupted a Chinese-linked hacking campaign targeting federal agencies. [news4hackers] This is the rare W — defensive action, tactical victory, and a reminder that we do occasionally punch back. Not enough detail yet to know if it was attribution-via-blockchain nonsense or actual tradecraft analysis, but the headline is: they found it, they stopped it. Enjoy this moment. It won’t last.
The exploit index (Sploitus) is doing what it always does — vomiting PoCs for everything from Spring4Shell (2022, still relevant because nobody patches) to CVE-2022-22954 (CVSS 10, VMware Workspace ONE auth bypass) to CVE-2026-21962 (Oracle HTTP Server, CVSS 10, also recent). [Sploitus] The CVSS 10s are the ones making me twitch: these are “complete system compromise with zero user interaction required” territory. If you’re running Oracle HTTP Server or Workspace ONE, your patch cadence just got a lot more aggressive. The old stuff (2018–2022) is still on the board because entropy: most orgs patch slowly, so 4-year-old vulns stay lethal.
MILITARY / GEOPOLITICAL
Philippine nuclear and naval targets took fire from a suspected Chinese operator. [securityaffairs] This is not a data theft — this is reconnaissance, lateral movement, and potential staging for sabotage or degradation. Philippines is a US treaty ally, AUKUS-adjacent, and sits on the South China Sea. China testing access to nuclear facilities is a very hot signal. [HIGH CONFIDENCE] When APT campaigns pivot from stealing secrets to touching critical weapons infrastructure, the calculus shifts from espionage to potential kinetic preparation.
Rhysida ransomware group is actively targeting the Berlin government ahead of upcoming elections. [securityaffairs] Ransomware + election cycle = election interference flavor. The Russians call this “influence operations,” the Chinese call it “asymmetric competition,” and Rhysida calls it Tuesday money. If Berlin’s government networks go down during the vote, the optics catastrophe compounds the actual damage. This is the kind of pressure campaign that destabilizes democracies without firing a shot.
On the US side, the Pentagon is doing what it does: throwing money at problems. $241 million for F-35 engine upgrades (GE Aerospace), XM30 Wolf IFV deliveries to the Army, AIM-120X missile parts procurement, and successful tests of the Harpoon Coastal Defense System. [Defence Blog] This is routine procurement and force modernization — not a tactical response to anything, just the slow churn of military industrial base contracts. The fact that these announcements are stacked suggests someone’s trying to project strength / capability during the Philippine incident noise. Good luck with that.
US Army procurement from Integrate DG (little-known drone manufacturer, only one bidder) is worth watching: when there’s no competitive bid, someone either got sole-sourced via a PAO (“other companies thought it was bullshit”) or there’s something about the vendor that required it. [Defence Blog] This is the kind of thing that either winds up being exactly the right call or becomes a congressional embarrassment in 18 months.
PHYSICAL / LOCAL
NOSIG — Southern California clean, no direct threats to the area. (Assume your neighbors are fine, the power grid isn’t on fire yet, and the routing infrastructure in downtown LA hasn’t been torched. Small mercies.)
NUCLEAR / WMD
NOSIG — no IAEA reports, no test activity, no weapons production signals. The Philippine nuclear facility being probed by Chinese APT is the closest we get to nuclear signal, and that’s reconnaissance, not detonation prep.
ASSESSMENT
Three judgment calls worth stewing on:
First, the McKesson breach + water systems campaign + Philippine nuclear probing form a pattern: critical infrastructure is being systemetized (supply chains, utilities, weapons infrastructure), not one-off targeted. This isn’t hackers looking for credit cards; this is state-adjacent actors building a map of where we break. The supply chain one is fastest-moving (lives hang on pharma logistics), the water one is politically explosive (elections, Biden’s water security mandate), and the nuclear one is the temperature-setter (if China’s probing nuke facilities, we’re in a hotter phase than the headlines admit).
Second, TerminalFix + Rhysida + the disrupted Chinese federal campaign show the APT ecology is active and escalating. We’re not in a defensive holding pattern; we’re in a dynamic campaign where both sides are moving pieces. The fact that we scored a W (federal agencies disruption) doesn’t mean the overall trend is good — it means they tried, we caught that one, and they have 17 other irons in the fire we haven’t found yet.
Third, the exploit index is noise, but it’s useful noise: CVSS 10s are live, patches lag reality by months, and old vulns stay lethal because patch management is a joke in most sectors. This isn’t new, but it rhymes with the water systems targeting (legacy SCADA, no patching culture). The real attack surface isn’t zero-days; it’s the gear we installed in 1997 and forgot about.
Ferengi Rule of Acquisition #48: “The bigger the smile, the sharper the knife.” McKesson thought their third-party integrations were vetted partners. Rhysida’s smile is an election-eve encryption demand. The smile is always sharper than we think.
Va fail, Little Mister. Keep your patches current and your water system airgapped.
End of Line.
Our own posture, for context:
