Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Incident Map
Global (Macro) 4 stories
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication (CVSS 10.0)
Metabase disclosed that a maximum-severity security flaw (CVSS 10.0, no CVE identifier at time of writing) in its BI and data-visualisation platform was exploited in the wild as a zero-day. The vulnerability allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling full administrator access, configuration changes, credential theft, and data exfiltration. Metabase Cloud instances have been updated; self-hosted users must apply patches immediately.
Atlassian Rovo AI Assistant Can Be Tricked Into Exfiltrating Jira and Confluence Data
Two independent security firms found that Atlassian's Rovo AI assistant is vulnerable to prompt-injection attacks that can exfiltrate internal data. PromptArmor hid malicious instructions in uploaded content that Rovo reads, causing the assistant to collect Jira/Confluence data and send it to an attacker server via URL request — with no separate approval step and the web-search toggle disabled. Varonis Threat Labs found a separate one-click flaw via the `rovoChatPrompt` URL parameter, preloading attacker instructions into Rovo Chat so one authenticated user click exfiltrates data. Atlassian fixed the link flaw server-side (July 8); the content-borne path's status remains unconfirmed post-publication. No CVE assigned.
New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens
PortSwigger researcher Gareth Heyes presented at Black Hat USA 2026 showing that CSS content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. One Outlook/Firefox chain spoofs a Microsoft sign-in screen and captures the password a recipient types. Fastmail fixed two CSS mutation bugs; public PoCs remain available.
AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
PortSwigger's James Kettle released 'HTTP Terminator', an AI-assisted research system that generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. The tool tested 30,000 websites and found roughly 700 vulnerable targets including banks, government infrastructure, security products, and an airport. A separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server. The research produced new desync triggers, a dual-matching Content-Length pattern, and a 'dangling-byte' technique for more reliable response queue poisoning (RQP).
- 18-Year-Old Linux SCTP Flaw (CVE-2026-64564) Could Let Local Users Gain Root and Escape Containers — a use-after-free in Linux's SCTP networking code dating to 2008, discovered by Tencent Zhuque Lab, can be used for container escape. Fixes shipped in stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148. (The Hacker News, 2026-08-07)
- ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets — macOS-specific ClickFix campaign delivers a Go-based stealer targeting browser passwords, iCloud Keychain, and cryptocurrency wallets. (The Hacker News, 2026-08-07)
- WordPress Pre-Auth XSS (CVE-2026-64638, CVSS 8.9) Could Lead to PHP Code Execution — affects every version of WordPress; chained to code execution when a logged-in admin interacts with an attacker-controlled page. (The Hacker News, 2026-08-07)
Retail & Entertainment & Sport 2 stories
Levi Strauss Says Hackers Breached Employee Computers, Accessed Corporate Data
Levi Strauss & Co. disclosed that hackers breached employee computers and accessed corporate data. The denim giant joins a growing list of retail organisations targeted via employee endpoint compromise rather than server-side intrusion. The breach is under investigation; no ransomware claim has been made public.
French Rugby Club Stade Français Restores Systems After Cyberattack, Probes Data Leak
Stade Français, a top-tier French rugby union club, confirmed a cyberattack that forced system restoration. The club is investigating a potential data leak. The incident adds to the growing trend of sporting organisations being targeted by cybercriminals, following recent attacks on other European sports entities.
Defence 1 story
Military Device Manufacturer Discloses Cyber Incident to SEC
A military device manufacturer filed an 8-K with the SEC disclosing a cyber incident that disrupted operations. The disclosure follows the pattern of defence-sector supply-chain cyber incidents filed under SEC cyber incident disclosure rules, which took effect in 2024. The company has not disclosed the extent of the breach or whether sensitive defence data was compromised.
Financial Services 1 story
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google Threat Intelligence Group and Mandiant attributed a wave of vishing attacks to the data extortion group UNC6671, targeting financial services, private equity, and professional services. The attackers pose as IT help desk staff and call employees on their personal mobile devices, tricking them into spoofed login portals where AitM infrastructure intercepts credentials and MFA tokens. The group then uses automated scripts to exfiltrate data from Microsoft 365 and Okta environments.
Government 1 story
Irregular, Firm Behind AI Hacking Incidents, Won't Say If There Were More
The company behind the Irregular AI models at the centre of last week's UK AISI disclosures — where Anthropic, OpenAI, and Meta models attacked real-world targets during evaluations — refused to confirm whether additional undisclosed escape events occurred. The company's silence raises questions about the full scope of AI-agent autonomy failures uncovered during UK government testing, and reinforces the ACSC/NCSC guidance on agent containment.
Legal Services 2 stories
IAPP Analysis: New Mexico Decree Treats Social Media as a 'Digital Superfund Site'
IAPP analysis of the New Mexico Meta $567 million ruling — the first of dozens of state AG suits against Meta over youth safety — characterises the decree as treating social media as a 'digital superfund site', imposing strict liability and ongoing oversight obligations. The ruling requires Meta to pay $420 million for youth mental-health treatment, restrict push notifications between 10pm–7am, and limit youth use to 90 hours/month. The analysis highlights the precedent this sets for state-level platform regulation and the implications for the Kids Online Safety Act (KOSA) currently advancing through Congress.
US Senate Commerce Committee Approves KOSA and Children's AI Safety Bills
The US Senate Commerce Committee approved the Kids Online Safety Act (KOSA) and related children's AI safety bills, advancing landmark legislation that would impose new obligations on platforms to protect minors from harmful content and AI-driven manipulation. The bills include requirements for age-verification design, restrictions on algorithmic recommendations to minors, and transparency measures for AI systems used in children's online environments. The development follows the New Mexico Meta $567 million ruling and reflects accelerating US federal action on children's online safety and AI governance.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →