Floating servers exposing Bitcoin firmware and Rails RCE flaws.

Daily Cybersecurity News – August 2, 2026

August 2, 2026 2:23 PM 9 min read

Coldcard Firmware Flaw Enabled $70M Bitcoin Theft

Critical

Affected firmware versions

Mk2/Mk3: 4.0.0 through 4.1.9 (fixed in 4.2.0)
Mk4/Mk5: anything before 5.6.0
Q: anything before 1.5.0Q
Edge builds: before 6.6.0X (Mk4/Mk5) or 6.6.0QX (Q)

What happened

An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, stealing 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and linked it to a firmware flaw in Coldcard hardware wallets from Coinkite.

A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator (PRNG) instead of the STM32 hardware RNG. An attacker who can constrain the device UID, timer state, and prior RNG history can reproduce candidate seeds offline, derive addresses, and match them against public blockchain data.

Coinkite released emergency firmware on July 31 for all affected models, but it does not fix existing seeds. Effective entropy was estimated at roughly 40 bits on Mk3 and about 72 bits on later models.

Who is affected

Owners of Coldcard Bitcoin hardware wallets (Mk2, Mk3, Mk4, Mk5, and Q models) who generated seeds on vulnerable firmware versions.

Specifically: Mk2/Mk3 versions 4.0.0–4.1.9 (fixed in 4.2.0); Mk4/Mk5 before 5.6.0; Q before 1.5.0Q; and corresponding edge builds. Seeds created with strong dice rolls or strong unique BIP-39 passphrases are less or not affected by this bug alone. Multisig setups are safer if not entirely built from affected devices.

Why it matters

Hardware wallets are trusted for offline key storage, yet a PRNG fallback reduced entropy enough for practical offline seed recovery and mass address sweeping. Once a weak seed is created, patching firmware does not remediate it—coins must be moved to a new seed.

This shows how subtle build-config and library-fallback errors in crypto hardware can lead to catastrophic, irreversible loss at scale, undermining the core security promise of air-gapped devices.

How it could have been prevented

Immediately update to the latest Coinkite emergency firmware for your model. Generate a completely new seed on the patched firmware (or with verified high-entropy dice rolls) and transfer all funds to addresses derived from the new seed. Do not restore the old seed to any wallet.

Use a strong unique BIP-39 passphrase and prefer multisig with non-affected devices or software wallets where possible. Verify receive addresses carefully and consider air-gapped verification practices. Clear any cached data if relevant and monitor blockchain for unexpected activity.

Relevant professional terms

Hardware wallet: A physical device that stores cryptocurrency private keys offline to protect them from online hacks.
Deterministic PRNG: A pseudorandom number generator whose entire output sequence is fully predictable once its initial seed state and any inputs are known, offering no true entropy after setup.

Source: The Hacker News

Ruby on Rails Patches Critical File Read and RCE Flaw

Critical

What happened

Ruby on Rails released patches for a critical vulnerability tracked as CVE-2026-66066 (CVSS 9.5) that allows unauthenticated attackers to read arbitrary files from the server, including process environment variables, and potentially escalate to remote code execution.

In default configurations, Rails apps displaying image variants via Active Storage and libvips can be abused: libvips marks certain file operations as unsafe for untrusted content, but Active Storage did not disable them. An attacker uploads a crafted file to invoke these operations and disclose secrets such as secret_key_base or external credentials, enabling further RCE or lateral movement.

The issue is fixed in Active Storage 7.2.3.2, 8.0.5.1, and 8.1.3.1. Users must also update libvips to at least 8.13. No confirmed active exploitation is recorded; EPSS is low at 1.7%.

Who is affected

Ruby on Rails applications using Active Storage for image processing with the libvips library that accept image uploads from untrusted users.

Affects versions prior to the patched Active Storage releases (7.2.3.2, 8.0.5.1, 8.1.3.1). Applications not using image variants or libvips, or that do not allow untrusted uploads, are not impacted.

Why it matters

Arbitrary file read can expose critical secrets in the process environment, turning a file disclosure into full RCE or broader compromise without authentication. Rails powers many production web apps and APIs, so the blast radius includes any internet-facing instance with the vulnerable image-processing path enabled.

Even after patching, previously exfiltrated secrets remain compromised and must be rotated.

How it could have been prevented

Upgrade Active Storage to 7.2.3.2, 8.0.5.1, or 8.1.3.1 immediately and update libvips to version 8.13 or later.

Treat all secrets readable by the application process (especially secret_key_base and external credentials) as potentially exposed; rotate them. Restrict untrusted image uploads, review Active Storage configurations, and monitor for anomalous file access or upload patterns. Apply defense-in-depth such as least-privilege file permissions and secrets management.

Relevant professional terms

Remote code execution (RCE): A vulnerability that lets an attacker run their own code on a target system, often leading to full control.
Active Storage: Rails framework component for uploading, processing, and serving files (such as image variants) that integrates with libraries like libvips.

Source: SecurityWeek

Adform Script Poisoned to Swap Crypto Wallet Addresses

High

What happened

Attackers modified a JavaScript file (trackpoint-async.js) served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses on customer websites.

The malicious code, active around July 27 2026, watched clipboard copy events, periodically read the clipboard, rewrote matching Bitcoin, Ethereum, and Tron addresses in text nodes and form fields, and hooked input setters and events. It also beaconed page hostname/path to an attacker IP. Adform detected it, removed the code, notified clients, and reported to authorities. The script did not install persistence and only operated while the page was open.

This is a supply-chain attack: one compromised shared resource affected many downstream sites. Cached copies may linger.

Who is affected

Websites and their visitors that loaded the compromised Adform tracking script (s2.adform.net) on or around July 27 2026, particularly any page where users copy or enter crypto wallet addresses for payments or transfers.

Anyone who visited an affected site and copied/pasted a BTC, ETH, or TRX address risks having sent funds to an attacker-controlled address instead. Scale depends on Adform’s customer base using the script broadly.

Why it matters

Clipboard and form rewriting is a silent, high-success theft vector for crypto because users often paste addresses without re-verifying every character. A single ad-tech supply-chain compromise instantly weaponizes hundreds or thousands of legitimate sites against their own users.

No malware install is needed; the damage happens in the browser session. Cached poisoned scripts extend the window after the vendor fix.

How it could have been prevented

Clear browser cache and hard-refresh any sites that use Adform. Always double-check the full wallet address character-by-character (or via QR/address book) before confirming a crypto transfer; never rely solely on paste.

Site owners: verify Adform script integrity, monitor for unauthorized modifications, consider subresource integrity (SRI) where possible, and review third-party script permissions. Users: prefer hardware wallets or address whitelists and be wary of unexpected address changes.

Relevant professional terms

Supply-chain attack: An attack that compromises a trusted third-party component or service so the malicious code reaches many downstream victims automatically.
Clipboard hijacking: Malicious code that monitors and silently replaces cryptocurrency (or other) addresses copied to the system clipboard with attacker-controlled ones.

Source: The Hacker News

Hijacked Hotel WiFi Delivers CornFlake Surveillance RAT

High

Attack chain highlights

Attacker controls hotel captive-portal gateway and DNS resolver.
Device connectivity check is redirected to fake browser/OS update page.
Victim downloads/runs payload (or follows ClickFix / device-code steps).
CornFlake installs with persistence and surveillance capabilities; ChocoShell steals cloud tokens.

What happened

A fake browser or OS update served over hijacked hotel Wi-Fi has delivered CornFlake, a Go-based remote access trojan (RAT) capable of capturing webcam images, microphone audio, keystrokes, screenshots, clipboard data, browser cookies/passwords (including Chrome app-bound encryption), and opening a remote shell.

Microsoft tracks the operation as CaptiveCrunch, attributed to Storm-2945 (assessed as a sub-cluster of Midnight Blizzard / APT29 / Cozy Bear, linked to Russia’s SVR). Attackers gained admin control of captive portal gateways that also act as DNS resolvers, forging DNS answers to redirect connectivity checks to malicious update pages. Some use ClickFix-style instructions; later pages redirect into Microsoft device-code auth flow for MFA-satisfied session theft. Also delivers ChocoShell in-memory PowerShell stealer for M365/Azure tokens.

Observed since early May 2026 across hospitality networks in multiple countries. Victim must still download/execute the payload.

Who is affected

Travelers and business users connecting to compromised hotel or hospitality Wi-Fi networks that use captive portals, particularly those who accept fake update prompts or run provided commands, or who complete attacker-supplied device-code flows.

Microsoft has not named specific hotels or vendors. Affects Windows endpoints primarily; token theft impacts Microsoft 365 and Azure AD users.

Why it matters

Hotel Wi-Fi is ubiquitous for business travelers carrying corporate laptops. Compromising the captive portal + DNS path lets attackers perform highly convincing social-engineering delivery without phishing emails. CornFlake provides full surveillance and credential theft, while device-code abuse bypasses MFA for cloud access.

Nation-state linkage raises the stakes for espionage against high-value targets in transit.

How it could have been prevented

Use an always-on full-tunnel corporate VPN before joining any public or hotel Wi-Fi so DNS and traffic never touch the local gateway. Never accept software updates, certificates, browser updates, or run commands offered via captive portals.

Reject unexpected device-code prompts; block the flow via Conditional Access if unused. Prefer personal hotspots or known-secure networks. Keep endpoints hardened, monitor for unusual persistence (svchost32 service, Run keys, scheduled tasks), and educate travelers on these lures.

Relevant professional terms

Remote access trojan (RAT): Malware that gives an attacker ongoing remote control of an infected computer, including files, camera, mic, and keystrokes.
Captive portal: The login or terms page that public Wi-Fi networks force browsers to before granting internet access; when compromised it can redirect or serve malicious content.

Source: The Hacker News

Adobe Campaign Classic CVSS 10.0 Flaw Enables RCE

Critical

What happened

Adobe released security updates for Campaign Classic (ACC), its enterprise marketing automation platform, fixing a maximum-severity incorrect authorization vulnerability tracked as CVE-2026-48449 (CVSS 10.0). It allows arbitrary code execution in the context of the current user with no user interaction required.

A second high-severity SQL injection flaw, CVE-2026-48448 (CVSS 8.6), can enable arbitrary file-system reads. Both are fixed in ACC v7 7.4.3 build 9398 for Windows and Linux. Adobe states it is not aware of exploitation in the wild. EPSS scores are low (0.5% and 0.4%).

Adobe also patched eight critical/high flaws in Adobe Bridge (CVE-2026-48395 and others) that can lead to code execution or privilege escalation, mostly requiring user interaction to open a malicious file.

Who is affected

Organizations running Adobe Campaign Classic (ACC) versions prior to 7.4.3 build 9398 on Windows or Linux, especially internet-facing or multi-user enterprise marketing instances.

Also users of unpatched Adobe Bridge. Campaign Classic is used by enterprises for large-scale marketing automation, so exposure includes those handling customer data and campaigns.

Why it matters

A CVSS 10.0 no-interaction RCE in an enterprise marketing platform can give attackers immediate code execution, potentially exposing customer databases, campaign assets, and connected systems. Incorrect authorization bypasses access controls entirely.

Combined with the SQL-injection file-read issue, attackers can escalate quickly. Marketing platforms often sit at the intersection of customer PII and internal networks, amplifying impact.

How it could have been prevented

Apply the Adobe Campaign Classic update to v7 7.4.3 build 9398 (or later) on all Windows and Linux instances immediately. Also update Adobe Bridge to the latest patched versions.

Restrict network access to ACC instances, enforce least privilege, monitor for anomalous process execution or SQL activity, and review authorization configurations. Follow Adobe’s security bulletins and enable automatic updates where feasible. Rotate any potentially exposed credentials after patching.

Relevant professional terms

CVSS: Common Vulnerability Scoring System — a standard 0–10 scale that rates how severe a security flaw is based on exploitability and impact.
Incorrect authorization: A vulnerability where the application fails to properly enforce access-control checks, letting attackers perform actions or execute code they should be denied.

Source: The Hacker News