Gitea patched a critical flaw in the self-hosted Git platform that lets an unauthenticated attacker read any file the service account can access, needing only a public repository and crafted Org-mode markup. Tracked as CVE-2026-59774 and scored 9.8, it stems from the markup-rendering endpoint: Gitea initializes its Org-mode library without restricting file access, so the include directive accepts absolute paths and returns their contents. No login or write access is required. Gitea warns it can chain to command execution: read the configuration file, extract the internal token, inject a Git hook, and trigger it during an anonymous clone. It affects versions 1.22.1 through 1.27.0, fixed in 1.27.1.
Researchers disclosed flaws in Paperclip, an AI agent tool, that let attackers run commands on a user's machine through malicious agent imports. The more serious path, CVE-2026-41679 and scored 10.0, needs no account or user interaction against network-reachable deployments running in authenticated mode with the default registration configuration. A second path, scored 9.6, requires a victim to open an attacker-controlled page while Paperclip runs in its default local trusted mode. A third issue exposed sensitive data and control-plane details through API routes that skipped access checks. The fixes, which add import authorization and hostname validation, ship in the version tagged 2026.416.0.
Microsoft Threat Intelligence detailed a macOS ClickFix operation spanning more than 250 domains that now fingerprints visitors before deciding whether to show a malware lure. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download, an anti-analysis layer rather than a change to the attack itself. The lure still requires the victim to copy and run an obfuscated command in Terminal, which fetches scripts and installs an infostealer, in this case Atomic Stealer, that targets credentials, browser data, authentication stores, and cryptocurrency wallets. Many domains follow a dictionary-word naming pattern using the word file.
GitGuardian found 321 live n8n automation instances reachable using API tokens that developers had accidentally committed to public GitHub repositories, and showed four ways an attacker could abuse them. n8n workflows often hold credentials for the services they connect, so a valid API token can expose not just the automation platform but the downstream accounts it touches, from cloud services to messaging and databases. Because n8n is widely self-hosted and frequently wired into sensitive systems, an exposed token can become a path to broader compromise. The finding is a reminder that secrets committed to source control remain one of the most reliable ways in.
A self-propagating worm named ChainDrop tore through the npm registry on August 4, poisoning packages that huge parts of the software world depend on. It began by hijacking the GitHub account behind keyv, a caching library pulled in about 150 million times a week, then spread to sibling and downstream packages, reaching over 1,300 poisoned versions with billions of monthly downloads within hours. A preinstall script harvests credentials from developer and continuous integration environments, including AI agent tokens, cloud keys, and self-hosted CI secrets, then uses stolen npm publishing access to poison more packages. A descendant of the earlier Shai-Hulud worm, it even forged valid-looking build provenance.
cPanel patched a critical flaw that lets an ordinary hosting customer escalate to full database administrator access, running SQL as the database root user. Tracked as CVE-2026-58048 with a score of 9.4, the bug is significant on shared hosting, where many customers use one database server: administrator access there can expose or alter other tenants' data, and depending on the operating system and database configuration, cPanel warns it may extend to operating-system-level compromise. cPanel is one of the most widely deployed web hosting control panels, so the flaw affects a large number of shared and reseller hosting environments. Fixes shipped across several release tiers.
Pillar Security showed that Google's Agent Development Kit repository could be turned against itself through a poisoned pull request or issue. The public repository ran a low-privileged triage agent that responded to outside contributions, and a higher-privileged agent reserved for maintainers. Because the triage agent posted through a bot account that counted as a repository collaborator, a prompt injection could make it post a command that satisfied the privileged workflow's trust check, invoking the maintainer-level agent. That crossed into a job holding a long-lived access token, a Google API key, and a cloud service-account credential, enabling code execution on the runner and secret theft. Google deleted the affected workflows.
TP-Link patched 15 vulnerabilities in the zero-touch provisioning system of its Omada business networking line, which lets IT teams and managed service providers configure switches, access points, gateways, and routers remotely. Forescout's Vedere Labs, which presented the findings at Black Hat, reported hardcoded cryptographic keys and certificates, insecure credential transmission, weak certificate validation enabling interception, a race condition in cloud device adoption, and default credentials. Chained with two previously disclosed command-injection flaws, they let an attacker break the provisioning chain of trust and infiltrate networks. Eleven received CVEs, and some issues also affect TP-Link cameras and smart-home devices. Forescout found over 1,800 exposed controllers.
Manifold Security found 77 malicious extensions on Open VSX, the open marketplace that editors like VSCodium, Cursor, and Windsurf pull extensions from, impersonating legitimate developer tools. Detected between July 26 and August 1, all 77 were linked through a shared exfiltration domain and common code. Fifty-eight sent only basic system information, while the other 19 performed deeper reconnaissance, exfiltrating developer, Git repository, and continuous integration metadata. Manifold found no access to source code, credentials, tokens, or SSH material and did not determine the campaign's goal. The extensions were pulled from Open VSX by August 3, but must still be removed manually from affected machines.
Palo Alto Networks Unit 42 detailed a rebuilt version of XCSSET, macOS malware that spreads through Xcode developer projects. The actors compromise Git repositories and inject a downloader into ordinary files inside a project, so that when a developer builds the cloned project, a hidden loader runs under their own account with no permission prompt. It then infects every other Xcode project on the machine and propagates through shared code. Version 40 hides its logic in memory, generates polymorphic payloads, and adds a Chrome hijacker that drives the browser through its debugging protocol plus a component that trojanizes Telegram. Seventeen modules handle credential, keystroke, clipboard, and browser theft.
TrustStrike Labs