Daily Cybersecurity News – August 8, 2026

What happened

Metabase warned that a maximum-severity flaw in its business intelligence and data visualization software has been exploited in the wild as a zero-day.

The vulnerability (CVSS 10.0, no CVE assigned) lets an unauthenticated remote attacker inject arbitrary SQL into the Metabase application database to gain administrator access. With that access, attackers can alter configuration, steal stored credentials for connected databases, read accessible data, and export it.

Metabase Cloud instances were already updated. One affected organization, PC maker Framework, reported that customer names, login IPs, addresses, phone numbers, and emails were accessed; no order or payment data was taken.

Who is affected

Self-hosted Metabase instances on versions >= x.58.0 < x.58.23 (fixed in x.58.24), >= x.59.0 < x.59.20 (fixed in x.59.21), >= x.60.0 < x.60.16 (fixed in x.60.17), >= x.61.0 < x.61.10 (fixed in x.61.11), >= x.62.0 < x.62.8 (fixed in x.62.9), and >= x.63.0 < x.63.3 (fixed in x.63.5).

Metabase Cloud was impacted but patched. Any organization running exposed self-hosted Metabase with the vulnerable versions and publicly reachable endpoints is at risk.

Why it matters

Unauthenticated admin takeover of a BI platform gives direct paths to connected data warehouses and credentials, turning a single app compromise into broad data theft or further lateral movement.

Operators of analytics tools often grant them wide database access; a zero-day here creates high-value targets for attackers seeking credentials and sensitive business data.

How it could have been prevented

Apply the security patches for the listed fixed versions immediately.

As a temporary workaround, block the "/api/session/reset_password" endpoint. After updating, revoke all active sessions by deleting rows in the core_session table of the application database, review and remove unrecognized API keys and unexpected admin accounts, rotate credentials for connected databases, and check data warehouse logs plus Metabase activity/query history for signs of unauthorized access.

Watch for the IoC pattern: POST /api/session/reset_password returning 400 followed by GET /api/user/current returning 200.

What happened

A cluster of nearly 800 malicious packages was published to the npm registry in a campaign delivering cross-platform RAT and infostealer malware targeting Windows, macOS, and Linux.

The packages use AI-generated or randomly typed typo-squatted names. Unlike typical npm attacks that abuse preinstall/postinstall hooks, these instruct developers via README to load them with require(). That executes a downloader called WEL1DROPPER, which detects OS and architecture then fetches a matching payload from Cloudflare Workers domains (or falls back to DNS TXT records from wel1[.]ru domains for chunked Base64 payloads).

Final payloads run detached: Windows versions patch ETW/AMSI, check for sandboxes, set persistence via Registry Run key and scheduled task; macOS uses LaunchAgent and similar checks; Linux deploys an UPX-packed ELF that leads to the Sliver C2 framework. Sonatype tracks the campaign as Flooding Dropper.

Who is affected

Developers and organizations that install npm packages matching the malicious set, especially those that follow README instructions to require() untrusted packages.

Any Windows, macOS, or Linux system where such a package is loaded is exposed to the RAT/infostealer.

Why it matters

Supply-chain attacks via popular package registries can reach thousands of downstream projects and build systems with a single malicious publish.

Cross-platform RATs plus credential and data theft, combined with evasion (AMSI/ETW patching, sandbox checks) and persistence, give attackers durable access for further compromise or data exfiltration.

How it could have been prevented

Audit recently added npm dependencies and lockfiles; remove any unrecognized or suspicious packages, especially those with odd AI-like or typo-squatted names.

Avoid blindly following README instructions to require() packages. Use package allow-lists, software composition analysis tools, and integrity checks (e.g., npm audit, lockfile verification). Monitor for connections to the listed Cloudflare Workers and wel1[.]ru domains, and inspect temporary directories for unexpected binaries. Rotate credentials if compromise is suspected.

What happened

A use-after-free bug in Linux's SCTP networking code, present since 2008, can be turned into full root privileges on the host; Tencent researchers demonstrated using it to escape a container and reach the underlying machine.

Tracked as CVE-2026-64564 (named SCTPhantom by its finders), the flaw involves dynamic address reconfiguration (ASCONF). The kernel checks a delete request against the packet's source address but acts on a path selected via a different address inside the message, freeing a transport then reusing the dangling pointer.

Fixes shipped in stable kernels 6.1.6? Wait, source: 7.1.6, 6.18.42, 6.12.101 and 6.6.148 (released August 3). No public exploit code was available at disclosure, and it is not in CISA KEV. The issue is local and requires SCTP to be reachable. Tencent reported root on tested builds of Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS; their container escape kept default seccomp and needed neither CAP_NET_ADMIN nor CAP_SYS_ADMIN in later variants.

Who is affected

Linux systems running kernels older than the fixed stable releases that have SCTP enabled and reachable, including container hosts where unprivileged or lightly privileged containers can access SCTP sockets.

Distributions may backport fixes without changing the upstream version string, so check vendor advisories. Exposure is limited by the need for local access and SCTP availability.

Why it matters

Local privilege escalation to root plus reliable container escape undermines isolation assumptions in cloud and multi-tenant environments.

Even without remote reachability, an attacker who lands in a container or low-privilege process can break out to the host, compromising neighboring workloads and the entire node.

How it could have been prevented

Update to fixed kernel versions (or distribution backports) that include the SCTP ASCONF transport fix: stable kernels including 6.6.148, 6.12.101, 6.18.42, and 7.1.6 as reported.

Where immediate update is impossible, restrict SCTP usage, disable unused SCTP features via sysctls if safe for your workload, tighten seccomp profiles and user-namespace policies for containers, and limit socket creation privileges. Verify your specific distribution's tracker rather than relying solely on kernel version strings.

What happened

ClickFix-style social-engineering attacks are delivering a Go-based macOS malware that steals cryptocurrency assets, browser-stored passwords, Apple iCloud Keychain data, and cached credentials.

Victims are tricked into pasting a command into the Terminal app. This runs a Bash profiler/loader that collects system details and fetches a Mach-O payload matching the CPU architecture. The stealer prompts for credentials via a fake "unexpected system error" dialog, then exfiltrates data.

Notably, it includes a "DRAIN" routine that checks crypto wallet balances and can siphon a portion (including calculated 1% amounts) or all funds to attacker-controlled wallets for Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. Payloads and C2 infrastructure link to Aeza Group, a sanctioned Russian bulletproof host. Related ClickFix activity has also distributed other macOS stealers and abused Windows binaries.

Who is affected

macOS users who fall for ClickFix lures and paste the malicious command into Terminal, especially those with cryptocurrency wallets, browser-saved passwords, or Keychain data.

Any system where the profiler successfully retrieves and runs the architecture-matched payload is compromised.

Why it matters

ClickFix bypasses many technical controls by abusing user trust and legitimate Terminal execution, making it effective against relatively security-aware users.

The partial-drain crypto feature is particularly stealthy and damaging; combined with broad credential theft it enables both immediate financial loss and account takeover.

How it could have been prevented

Educate users never to paste unsolicited commands into Terminal, especially from web pages, emails, or chat. Enforce least-privilege accounts and consider application controls that restrict unexpected shell or network activity from user-launched processes.

Monitor for suspicious Terminal/Bash activity, unexpected credential prompts, and connections to known bad infrastructure (including Aeza-linked hosts). Use hardware wallets or air-gapped cold storage for significant crypto holdings, keep browsers and macOS updated, and review Keychain and browser password stores after any suspected incident. Deploy endpoint detection that flags LaunchAgents, detached processes, and crypto-wallet access patterns.

What happened

PortSwigger's AI-assisted research system HTTP Terminator, built by James Kettle, generated and validated new HTTP desynchronization techniques after exploring roughly 30,000 candidate vectors drawn from RFC fragments.

It identified about 700 vulnerable targets (including banks, government infrastructure, security products, and an airport) in authorized testing. New findings include novel desync triggers, a dual-matching Content-Length pattern, a "dangling-byte" technique that improves response queue poisoning (RQP) reliability by eliminating a race, and the broader concept of Shared-Parser Confusion (where response-processing rules are misapplied to requests).

A separate human-guided cascade exposed a desynchronization zero-day in Apache Traffic Server that has since been patched. One multipart/byteranges Content-Type technique alone hit more than 200 sites in the test set.

Who is affected

Web applications and infrastructure that still use HTTP/1.1 between front-end and back-end servers, especially those with complex parsing or request-body handling differences.

Organizations running Apache Traffic Server (prior to the patch for the discovered issue) and any sites vulnerable to the new desync/RQP vectors demonstrated in the research.

Why it matters

HTTP request smuggling and desync attacks can let attackers poison connection state, steal other users' responses (including session cookies or API keys), or bypass security controls.

AI-assisted discovery at this scale shows both the accelerating pace of novel technique generation and the persistent risk of HTTP/1.1 parsing discrepancies in real-world stacks.

What happened

Two security researchers bought inexpensive domains including noreply.net and noreply.us (and deleteduser.com) and configured them as catch-all email listeners. Hundreds of companies and organizations have been inadvertently sending them sensitive information.

Since December 2024 one domain alone received over 400,000 messages (roughly 700 per day on average), including attachments; combined recent volume exceeded 11,000 messages in a month. Emails originated from more than 14,000 "from" addresses across 6,200 root domains. Content has included injury reports from a city government, pizza order confirmations, school platform account setup emails, service orders, and test platform credentials.

The messages are almost entirely automated system mail. Researcher Cory Solovewicz (who presented at Defcon) has been notifying affected organizations so they can fix misconfigurations rather than publicly naming them.

Who is affected

Any organization whose systems are configured to send mail to addresses on placeholder or catch-all domains such as @noreply.net, @noreply.us, or similar "deleted user" style domains—especially automated notifications, account lifecycle messages, or systems that rewrite departing employees' addresses.

Recipients of the leaked data (in this case researchers) and the original data subjects whose PII or business information is exposed.

Why it matters

Sensitive corporate and personal data is leaving organizational control through simple email configuration mistakes that many teams never audit.

In the wrong hands the same stream would enable fraud, spear-phishing, credential stuffing, or competitive intelligence; the volume and diversity of senders show the problem is systemic rather than isolated.

How it could have been prevented

Audit all systems that generate automated email (HR, ticketing, CRM, DevOps, notification services, account provisioning) for hard-coded or rewritten recipient domains. Never use real public domains as "black-hole" or no-reply sinks unless you control and monitor them.

Implement outbound email DLP or monitoring for unexpected external domains, enforce SPF/DKIM/DMARC properly, and periodically review bounce and delivery logs. When employees leave, retire addresses internally rather than rewriting to external placeholder domains. Treat any no-reply or catch-all pattern as a potential data-exfiltration path and validate where those messages actually go.

What happened

Research testing the vulnerability-patching ability of two popular commercial models—OpenAI's ChatGPT 5.5 and Anthropic's Claude Opus 4.8—found that generative AI is more likely to produce an incomplete or exploitable patch, or to introduce entirely new bugs, than to fully remediate a flaw.

1Password researchers evaluated the models on six high-impact, high-complexity CVEs (including a kernel "Copy Fail" issue that can yield root in Linux cloud environments). Overall success rate—full remediation of all known exploit paths with no erroneous behavior changes—was 47%.

Models frequently fixed only a subset of vulnerable paths, added fragile guard code that passed tests without addressing root causes, or subtly altered application behavior. Separate Veracode research across many models found an average security pass rate around 56% for AI-generated code, with 44% of tests introducing a detectable OWASP Top 10 vulnerability. Newer specialized models were not included in these particular tests.

Who is affected

Development and security teams that rely on general-purpose LLMs to generate or apply security patches without rigorous human review and testing.

Any codebase where AI-suggested fixes are merged after only superficial validation is potentially exposed to residual or newly introduced vulnerabilities.

Why it matters

As AI coding assistants become default tools, broken or incomplete patches can create a false sense of security while expanding the attack surface.

High-complexity vulnerabilities are exactly where automated help is most tempting and where partial fixes are most dangerous; operators need realistic expectations about current model reliability for security-critical changes.