Cybersecurity Brief — 2026-08-18

SafePal Hardware Wallet Order Data Exposed (≈39,800 Customers)

An authorization flaw in an order-tracking plug-in exposed names, email addresses, shipping addresses, phone numbers, and purchase details for ~39,798 SafePal customers. Wallet credentials, seed phrases, private keys, and financial data were not included. SafePal notified affected customers Aug 16; the exposed orders were placed Mar 2, 2025 – Apr 11, 2026. A threat actor has since advertised a matching dataset on a cybercrime forum. SafePal has fixed the flaw, cut retention to 90 days, and rebuilt its order pipeline. (Source: The Hacker News)

CISA Adds Actively Exploited Ray Flaw (CVE-2025-62593) to KEV Catalog

CISA added CVE-2025-62593 (CVSS 9.4) in Ray, a popular Python-native AI/ML distributed computing framework (43.5k GitHub stars), to its Known Exploited Vulnerabilities catalog. The flaw enables remote code execution via DNS rebinding attacks against developers running Ray in browsers (Firefox, Safari) — no authentication on critical endpoints (/api/jobs, /api/job_agent/jobs/). Exploitation has been observed in the wild by the RondoDox DDoS botnet (since Nov 2025) and in the "ShadowRay 2.0" cryptomining campaign targeting GPU clusters. FCEB agencies must patch by Aug 20, 2026; fixed in Ray 2.52.0. (Source: The Hacker News)

macOS Screen Sharing Bug (CVE-2026-65400) Under Active Exploitation

The Dutch NCSC warns that CVE-2026-65400 (CVSS 7.1) in macOS screen sharing is being actively exploited. When port 5900 is internet-accessible (opened by enabling Screen Sharing), attackers gain root access and have deployed Monero miners. Apple patched the flaw last week for macOS Tahoe, Sequoia, and Sonoma. Mitigation: disable Screen Sharing when not needed (System Settings → General → Sharing), keep port 5900 firewalled, and apply the update immediately. (Source: Ars Technica)

Massive Supply-Chain Attack via LiteLLM Compromises 2,500+ Organizations

A supply-chain attack on LiteLLM (an open-source AI/ML gateway) — itself compromised via a prior attack on the Trivy vulnerability scanner — exfiltrated terabytes of credentials during a 40-minute window in March 2026. CloudSEK and Hudson Rock identified ~434,000 CI/CD pipelines with exposed secrets: cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing creds, and AI provider keys. Confirmed victims include Microsoft, Amazon, Cisco, Samsung, Salesforce, and others. The teen-led TeamPCP group claimed responsibility; independent researcher Kevin Beaumont confirmed the data is legitimate. (Source: Ars Technica)

Chrome Deploys Device-Bound Session Credentials (DBSC) to Block Cookie Theft

Chrome (Windows/macOS) now supports Device-Bound Session Credentials, a W3C-standardized defense that binds session cookies to a hardware-rooted key stored in the TPM (Windows) or Secure Enclave (macOS/iOS). This neutralizes infostealer malware and adversary-in-the-middle (AiTM) attacks that steal session cookies to bypass 2FA/passkeys. The feature is rolling out in recent Chrome versions; sites opt in via the DBSC response header. (Source: Ars Technica)

DecryptAds Launches: Free Tool Exposes AdTech Supply Chains & Geo-Risk Partners

Security researcher Zach Edwards (Infoblox) launched decryptads.com, a free service that continuously scrapes and cross-references ads.txt, app-ads.txt, and sellers.json files to map the full adtech supply chain for any site or app. It flags "geo-risk" partners in adversarial nations (China, Russia) and sanctions-linked entities. Analysis of espn.com revealed 143 ad partners and 19 registered data brokers; Between Digital (a Russian firm routing payments through sanctioned Alfa Bank) appears on espn.com and multiple U.S. military news sites (armytimes.com, defensenews.com, etc.). The tool enables detection of malicious ad networks, cloned declarations, and AI-generated slop sites. (Source: Krebs on Security)