Daily Cybersecurity News – August 10, 2026

What happened

Three separate research efforts demonstrated practical ways to defeat passkey protections without breaking the underlying FIDO2 cryptography.

SpecterOps presented Pass-the-Passkey research showing Windows stored past YubiKey signatures in cleartext readable by authenticated unprivileged users; chaining this with Microsoft Entra ID passkey validation weaknesses enabled privileged-user impersonation that still satisfied phishing-resistant MFA policies. The related Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5).

Unit 42 detailed Pass-ta-key attacks against Google Password Manager synced passkeys in Chrome on Windows, including recovery of private keys via the Security Domain Secret. Independent researcher Dirk-jan Mollema showed malware in a signed-in Windows session can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric prompt, then complete Entra ID authentication.

Who is affected

Windows 10/11 and Server users with passkeys or Windows Hello for Business, Microsoft Entra ID environments enforcing phishing-resistant MFA, and Chrome users with Google Password Manager synced passkeys.

Organizations relying on passkeys as a primary phishing-resistant control are exposed, especially those with endpoint compromise risk. Microsoft has released updates for CVE-2026-34348 covering multiple Windows releases.

Why it matters

Passkeys are marketed as highly phishing-resistant replacements for passwords, yet these attacks show surrounding implementation flaws (logging, validation, session handling, and synced-key protection) can still enable account takeover or privileged impersonation.

Two of the attacks require prior malware or session compromise, limiting remote unauthenticated risk, but they undermine the assumption that passkeys fully contain post-compromise damage. Privileged Entra ID impersonation is particularly damaging for enterprise identity security.

How it could have been prevented

Apply Microsoft's security updates for CVE-2026-34348 immediately. Enforce least-privilege access, maintain strong endpoint protections, and adopt Zero Trust principles as recommended by Microsoft.

Services accepting WebAuthn assertions should strictly enforce requested user-verification flags. Monitor for unusual Windows Hello for Business authentications lacking device ID claims and unexpected device registrations. Treat passkey stores, browser memory, and recovery flows as high-value credential material. Prefer device-bound over purely synced passkeys where feasible and ensure endpoint detection covers credential-related process activity.

What happened

Tenet Security researchers presented Ghostjacking at DEFCON 2026, showing how attackers poison logs and alerts in trusted platforms so that organizations' own AI coding agents execute attacker instructions using already-granted privileges.

A single fake bug report or blocked-request log entry (recorded word-for-word by Cloudflare's managed rules, for example) is read by an AI agent asked to review events; the agent then rewrites DNS, reroutes traffic and email, steals credentials, or plants backdoors in its own config, memory, and tools. The technique succeeded 9 out of 10 times against Claude Code on Cloudflare's recommended setup and worked similarly against Datadog (via publicly exposed frontend keys) and Sentry (including using its Seer AI to vouch for the next agent).

Researchers also demonstrated a self-exploit technique in which one AI helps craft an attack another AI accepts, plus a now-patched Claude Desktop sandbox escape for exfiltration. Nothing triggers standard EDR, WAF, or IAM alerts because every step uses authorized agent actions.

Who is affected

Organizations using AI coding assistants (such as Claude Code) integrated with Cloudflare (used by ~42% of Fortune 500 and carrying ~20% of internet traffic), Datadog (~48% of Fortune 500), or Sentry (used by ~4 million developers).

Tenet estimates 15,000+ organizations exposed based on public artifacts; half of Fortune 500 companies are described as vulnerable. Confirmed examples include a trillion-dollar tech company, a global payments provider, and a leading AI research lab running the exposed Cloudflare setup. More than 2,700 public Datadog keys were found.

Why it matters

AI agents are increasingly given broad access to code, infrastructure, DNS, monitoring, and credentials. Because they cannot reliably distinguish legitimate instructions from traps embedded in data they are told to read, trusted platforms become the delivery mechanism for domain takeover and persistent access.

The firewall and other controls never fail—they become irrelevant. This creates a high-blast-radius, low-detection supply-chain-style risk for any organization accelerating agentic AI adoption without hardened boundaries around what agents can read and act upon.

How it could have been prevented

Deny outbound network access by default for AI agents and require human approval for any commands they propose to run. Never allow data an agent reads to become an executable instruction without sanitization or human review.

Audit and restrict every tool and platform an agent can access; treat reachable tokens and keys as high-risk. Review Cloudflare, Datadog, and Sentry integrations for public keys or overly permissive logging that agents consume. Tenet open-sourced agent-jackstop hardening for Cursor and Claude Code as a starting point. Assume agents will be manipulated and apply least-privilege plus continuous monitoring of agent actions.

What happened

CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog and urged immediate patching of a critical OS command injection flaw in Progress Kemp LoadMaster that enables unauthenticated remote code execution.

The vulnerability (CVSS 9.6) exists in the handling of the apiuser parameter to the accessv2 endpoint due to improper input sanitization and an uninitialized heap buffer in the escape_quotes() function. An attacker can spray command-injection content into adjacent memory, leading to arbitrary command execution as root via system(). It was disclosed June 4, 2026 (alongside CVE-2026-33691) and affects LoadMaster GA 7.2.63.1 and older plus LTSF 7.2.54.17 and older, as well as ECS Connection Manager, Connection Manager for ObjectScale, and MOVEit WAF.

Proof-of-concept code was published by watchTowr on June 29; eSentire observed exploitation attempts starting immediately afterward. CISA confirmed active exploitation and gave federal agencies a short deadline to remediate.

Who is affected

Organizations running vulnerable Progress Kemp LoadMaster load balancers/ADCs (especially edge-facing appliances), plus related ECS Connection Manager, ObjectScale Connection Manager, and MOVEit WAF products.

LoadMaster devices are commonly placed at the network perimeter with visibility into internal services, amplifying impact. Federal civilian executive branch agencies face a mandatory patching deadline under BOD 22-01.

Why it matters

Unauthenticated root-level RCE on a network-edge appliance provides ideal initial access for further lateral movement, data theft, or ransomware. Confirmed in-the-wild exploitation plus high EPSS probability make this an urgent threat.

Compromise of load balancers can expose or redirect critical traffic and serve as a foothold into internal networks. The short CISA deadline underscores the severity for both government and private-sector operators of the same technology.

How it could have been prevented

Immediately apply the vendor patches for CVE-2026-8037 from Progress for all affected LoadMaster and related products. Prioritize internet-facing and edge appliances.

If patching is delayed, restrict access to management/API interfaces via network controls, monitor for anomalous API calls to accessv2 or related endpoints, and review logs for signs of exploitation. Follow CISA KEV guidance and inventory all Progress ADC deployments. Consider temporary isolation of unpatched devices where feasible.

What happened

Security researcher Bill Swearingen developed noRecognition, a reinforcement-learning system that after roughly 31 million tests generates computer-created patterns capable of preventing common surveillance cameras and license-plate readers from detecting people, faces, or vehicles.

The patterns, when printed on clothing or objects, scramble the detection algorithms so that cameras continue recording but fail to trigger object, person, or facial-recognition alerts. In a public Def Con 2026 demonstration, a vehicle wrapped in one of the patterns successfully evaded a Flock camera. The model defeats 11 open-source detection algorithms, including those powering Flock license-plate readers, Axon body-worn cameras, and Clearview AI systems.

Swearingen keeps the strongest patterns offline to hinder countermeasures by camera vendors and is crowdfunding merchandise featuring the designs.

Who is affected

Operators and users of algorithmic surveillance systems that rely on the tested open-source or commercial detection models (Flock, Axon, Clearview AI and similar). Individuals seeking privacy from automated tracking in public spaces.

The technique does not stop video recording itself—only automated detection and alerting—so human review of footage remains possible.

Why it matters

Widespread deployment of AI-powered cameras and ALPR systems has created persistent, automated tracking infrastructure that most people never opted into. Effective adversarial patterns restore a degree of practical anonymity against algorithmic detection without disabling cameras.

For privacy advocates and builders of surveillance systems, this demonstrates that detection models remain brittle to carefully optimized physical-world perturbations and that an arms race between detectors and evasions is likely. Real-world Def Con validation increases credibility beyond lab results.

What happened

Microsoft Threat Intelligence warned that the China-linked, financially motivated group Storm-1175 began deploying a new ransomware strain called StormEncryptor on August 2, 2026, likely by exploiting CVE-2026-18577 in N-able N-central.

CVE-2026-18577 (CVSS 8.1, added to CISA KEV) is an authentication bypass (incomplete patch for a prior issue) that grants unauthenticated administrative “god-mode” control of vulnerable N-central servers. Because managed service providers use N-central as an RMM tool to administer client endpoints, one compromised server becomes a gateway to every managed machine, enabling rapid cascading ransomware deployment. The group previously used Medusa ransomware and is known for high-velocity campaigns that move from access to encryption in under 24 hours.

N-able detected zero-day exploitation as early as July 31, issued emergency hotfixes on August 2 and August 6 after attackers bypassed the first patch, and contacted a limited number of affected customers. Huntress observed rapid downstream movement in incidents and found more than half of reachable cloud N-central instances still unpatched shortly after fixes were available.

Who is affected

Managed service providers (MSPs) and their customers running unpatched N-able N-central (versions through 2026.3.1 prior to the hotfixes). Thousands of MSPs use the platform, creating potential for broad downstream impact similar to prior RMM supply-chain incidents (Kaseya 2021, ConnectWise ScreenConnect).

Huntress confirmed some of its customers were impacted. Organizations in healthcare, professional services, and finance have been historical targets of the same actor.

Why it matters

RMM tools sit at the center of IT operations for many MSPs and their clients. Unauthenticated admin access turns a single server compromise into a mass ransomware distribution platform with cascading blast radius across entire client bases.

Confirmed active exploitation, KEV listing, rapid encryption timelines, and historically incomplete patching create urgent risk. The pattern mirrors previous high-impact RMM supply-chain ransomware events and shows threat actors continue to prioritize these high-leverage entry points.

How it could have been prevented

Immediately apply N-able’s latest emergency hotfixes for CVE-2026-18577 (2026.3 Hotfix series) on all N-central instances—cloud and self-hosted. Inventory and prioritize internet-reachable servers.

If immediate patching is impossible in high-risk environments, consider temporary isolation or shutdown of N-central while accepting loss of visibility and remote management. Restrict network access to the management interface, enable strong monitoring for anomalous Take Control sessions or new tunnels (e.g., cloudflared), and review downstream endpoints for ransomware indicators. MSPs should notify clients and verify patch status across their installed base. Follow CISA KEV guidance.

What happened

OpenAI announced it is pausing certain internal activities involving its upcoming frontier model Astra after preliminary evaluations showed significant advances in agentic coding and cybersecurity capabilities.

Under the company’s Preparedness Framework, the results were strong enough that OpenAI cannot yet rule out the model reaching the “critical” cybersecurity threshold—defined as the ability to independently discover previously unknown vulnerabilities in secure systems or to plan and execute sophisticated cyberattacks against well-protected targets with little or no human guidance. Astra has not been formally classified as critical and was not involved in prior Hugging Face testing incidents; evaluations continue.

In response, OpenAI has implemented enhanced security controls including isolated testing environments, restricted network and tool access, stronger model-weight protection and encryption, additional monitoring, and sandboxed execution. Activities that do not meet these requirements have been paused. External government agencies and independent AI safety organizations will be invited to evaluate the model before any deployment decision.

Who is affected

OpenAI’s internal research and development teams working on Astra, plus future users and integrators of the model once released. Broader AI safety and cybersecurity communities monitoring frontier-model risk thresholds.

No public deployment has occurred; the pause is precautionary and limited to non-compliant internal activities.

Why it matters

This is one of the first public cases of a leading AI lab deliberately slowing frontier-model work specifically because of cybersecurity capability concerns. It signals that agentic models are approaching thresholds where they could materially lower the skill and effort required for sophisticated attacks.

The decision operationalizes OpenAI’s Preparedness Framework and may influence how other labs handle dual-use cyber capabilities. For defenders and policymakers it highlights both the accelerating offensive potential of AI and the emerging practice of pre-deployment external evaluation and hardened internal controls.