Connor Riley Moucka (aka "Judische"/"Waifu") pleads guilty to Snowflake extortion campaign — The 26-year-old Canadian admitted to hacking and extorting over 165 organizations via stolen Snowflake credentials (accounts lacking MFA), stealing billions of records including 100M+ AT&T call/text logs. Co-conspirators include U.S. Army soldier Cameron "Kiberphant0m" Wagenius (sentencing Sep 3) and John Erin Binns (at large, reportedly now a Turkish citizen). Over $2.5M in ransoms paid; Moucka also re-extorted victims using stolen government official data. (Source: Krebs on Security)
Atlassian Rovo AI assistant vulnerable to indirect prompt injection and data exfiltration — Two independent findings: PromptArmor demonstrated that attacker-controlled content (uploaded files) can make Rovo search Jira/Confluence and exfiltrate data via outbound URL requests without user approval; this path was unpatched as of Aug 8. Varonis found a one-click rovoChatPromptURL parameter flaw allowing preloaded malicious prompts — Atlassian fixed this server-side July 8 via Bugcrowd. Neither flaw has a customer-applied patch; mitigation is scoping Rovo app/group access. (Source: The Hacker News)
New CSS-based attacks break webmail defenses across Outlook, Gmail, Yahoo, AOL, Fastmail, Proton — PortSwigger's Gareth Heyes (Black Hat USA 2026) showed email content can escape message boundaries via CSS/HTML sanitizer gaps. Chains include: Outlook/Firefox spoofing Microsoft login to capture passwords; Yahoo/AOL "paste race" exposing Medium login tokens; Gmail image-set() fallback exfiltrating Slack tokens via prompt injection + Cowork AI; Fastmail/Proton issues partially fixed. PoCs public as of Aug 8. (Source: The Hacker News)
Vishing extortion group UNC6671 rebrands after making millions — The financially motivated group, known for callback phishing and data theft extortion, has shifted tactics and infrastructure after successful campaigns. Details on new branding and TTPs emerging. (Source: SecurityWeek)
CISA adds CVE-2026-8037 (Progress LoadMaster Command Injection) to Known Exploited Vulnerabilities Catalog — Actively exploited; federal agencies required to remediate per BOD 26-04. All orgs urged to prioritize patching. (Source: CISA)
N-able "God mode" flaw (CVE-2026-xxxx) confirmed exploited downstream — Attackers leveraged admin access in N-central to reach customer networks; second hotfix released. (Source: The Register)
ShinyHunters dumps 10.9M email addresses from cancer diagnostics provider — After vishing staff for access, extortion group published data when ransom wasn't paid; personal and health info exposed. (Source: The Register)
MIT researchers unveil TONTOU attack bypassing Spectre defenses on Intel/AMD — Timer interrupts reopen branch predictor poisoning window; working Zen 2 exploit demonstrated. (Source: The Register)
China launches security probe into Palo Alto Networks products — Beijing investigation follows pattern of Micron probe; no public rationale given. (Source: The Register)
U.S. defense supplier breached via Microsoft 365 phishing — Attacker accessed engineering files and potentially export-controlled technical data. (Source: The Register)
N-able N-central "God mode" — Second hotfix available; apply urgently if running N-central. (The Register)
Atlassian Rovo — rovoChatPromptURL fixed server-side July 8; content-borne prompt injection path unpatched. Limit Rovo scope via app/group allow-lists. (The Hacker News)
Webmail providers — Fastmail fixed two CSS mutation bugs; Proton proxy bypass mitigated. Outlook label-jacking and Gmail image-set() bypasses unpatched as of Aug 6. (The Hacker News)
Notable Research & Trends
AI coding agents: Humans in the loop miss ~33% of dangerous requests (credential access, kubeconfig) — automated safeguards needed. (The Register)
AI vulnerability patching: Autonomous fixes often fail to fully remediate without human oversight. (The Register)
TV streaming sticks (H96): Bitsight found devices spoofing as mobile phones to click ads on AI-generated sites, orchestrated by Fengwo Group (China) — ad fraud + covert proxy network. (Krebs on Security)
Ransomware spike attributed to defenders distracted by AI hype; top gangs remain active. (The Register)
Ex-NSA chief: Water system PLCs should not be internet-accessible following suspected Iran-linked activity. (The Register)