Researchers, including teams at Anthropic and EPFL, demonstrated that self-propagating instructions can spread from one AI agent to another through the editable prompt and state files that autonomous agent harnesses use to carry context between sessions. In simulated multi-agent coding setups, a payload written into a shared file could infect the next agent that read it. The researchers call the risk real but currently limited, noting there is no sign of it spreading in the wild and that compromising one agent usually already grants machine access. Encouragingly, adding a single short warning paragraph to an agent's system prompt cut propagation to nearly zero across the payloads they tested.
Researchers flagged a typosquatting campaign, tracked as StubMaker, that planted sixteen malicious packages on RubyGems to deliver a Windows information stealer. The packages imitate popular Ruby dependencies with clumsy misspellings, betting that a developer will mistype a name during installation. Once installed, the malware harvests browser credentials, cryptocurrency wallets and seed phrases, and Telegram data from the developer's machine. The campaign's name refers to its trick of faking a build toolchain so a malicious install looks like a routine one. It is the latest reminder that open-source package registries remain an easy delivery route for stealers aimed at developers.
GitLab shipped an out-of-band critical patch for a flaw that lets an unauthenticated attacker remotely modify or delete public projects and user data through a GraphQL directive. Tracked as CVE-2026-19478 and scored 9.4, it affects self-managed Community and Enterprise installations; GitLab.com and Dedicated are already fixed. The company released it outside its normal twice-monthly schedule, and the fixed versions are 19.2.4, 19.1.6, 19.0.8, and 18.11.11, with the 18.2 through 18.10 branches left in the affected range and needing an upgrade. A second, lower-severity GraphQL flaw involving cross-site request forgery was fixed in the same release. GitLab reports no known exploitation yet.
A critical flaw in Forminator Forms, a WordPress plugin with more than 600,000 installations, lets unauthenticated attackers upload executable PHP files and take over a site. Tracked as CVE-2026-15748 and scored 9.8, the bug chains weaknesses in the plugin's upload handling: an attacker smuggles a forged record through a Select field that declares itself a file upload, then slips a PHP file past a blocklist that only checks exact extensions. Exploitation requires a form with both a file upload field and a select field, and it affects all versions up to 1.56.1. Because it needs no authentication, automated scanners can hunt for vulnerable sites at scale.
Researchers at SSD Secure Disclosure published a two-stage exploit chain that gains full Android kernel access on devices using Unisoc modem firmware, triggered by a VoLTE video call. The first stage, disclosed earlier this year, is remote code execution in the modem via a malformed call; the new second stage abuses a memory-isolation weakness in the modem to disable its protections and reach kernel memory. Pulling it off requires the attacker to run a rogue 4G network and the victim to answer the call. The affected firmware is shared across several Unisoc chipsets used in budget phones from brands like Motorola, Realme, and Xiaomi, and there is no fix from the chipmaker.
Researchers at Wiz found that a public Snowflake code repository could be hijacked through nothing more than a crafted GitHub issue title. A workflow that ran when issues were opened dropped the attacker-controlled title straight into a command, so an unauthenticated user could run code on the GitHub Actions runner and steal a Jira API token used by the automation. The notable twist is how the bug arrived: it was introduced days earlier by an AI tool meant to fix security issues, and an AI code reviewer approved the change. Snowflake fixed it by passing the title safely as an argument rather than expanding it into a command.
A South Carolina loan company disclosed a data breach that exposed the financial information and Social Security numbers of nearly 750,000 people. According to reporting, the breach affects anyone who received a loan through the company or who inquired about a loan product through a third party, meaning the exposure reaches beyond direct customers. Social Security numbers combined with financial details are among the most useful data for identity theft and fraud, and such records frequently end up for sale on criminal marketplaces. Lending and debt-related companies remain a favored target because they concentrate exactly this kind of sensitive financial and identity data.
Attackers began exploiting a critical SAP Commerce Cloud flaw within days of its patch, even though no public proof-of-concept exists. Tracked as CVE-2026-58231 and scored 10.0, the improper-authorization bug in the Data Hub Adapter lets an unauthenticated attacker abuse a default authentication client and send crafted input to reach arbitrary code execution. Threat intelligence firm Defused saw the first exploitation attempts hit its honeypots three days after SAP's August patch, classified as automated mass scanning of internet-facing deployments. Shadowserver tracks more than 4,200 exposed SAP Commerce Cloud systems, mostly in Europe and North America. Prior critical SAP flaws have been used by state actors and ransomware crews.
The Netherlands cyber agency warned that attackers are exploiting a recently patched macOS flaw to gain root on internet-exposed Macs and install cryptocurrency miners. Tracked as CVE-2026-65400 and scored 9.8, the authentication flaw in the Screen Sharing component lets a network attacker authenticate to the built-in remote desktop service, which uses VNC on port 5900, without valid credentials due to flawed state management. Apple fixed it in emergency updates on August 6 for macOS Tahoe, Sequoia, and Sonoma. Screen Sharing is off by default, but any Mac with it enabled and reachable from the internet is at high risk, and several have already been compromised to run Monero miners.
A newly disclosed zero-day in GeoServer, the widely used open-source geospatial server, is already drawing exploitation attempts, according to watchTowr. The flaw is a SQL injection issue that can lead to remote code execution, and it remains unpatched, with no CVE assigned yet. It was first disclosed publicly by a researcher on August 12, and attackers commonly begin probing internet-facing servers as soon as such details appear. GeoServer instances are frequently exposed to the internet to serve mapping and location data, which makes an unpatched code-execution flaw in the platform an attractive and reachable target. Defenders should treat exposed instances as at risk until a fix ships.
TrustStrike Labs