The Watch
Breaches, disclosure, and the vendors selling the fix — what actually changed for defenders today.
Polish authorities are investigating a compromise at clinical software supplier MyDr that may have exposed data on nearly 19 million people and more than 12,000 medical facilities.
Reality
New implementation guidance for BOD 26-04 sets forensic triage steps that begin when a CVE hits the KEV catalog: evidence first, patching second, containment only after both.
Reality
SSD Secure Disclosure says a Unisoc modem flaw lets attackers cross from modem code execution into kernel memory. There is no patch, no CVE, and no vendor response.
Reality
Pokemon Center and Valve are both writing to European customers about an intrusion at fulfillment provider CEVA Logistics. Neither company's own defenses were the deciding variable.
Reality
A public proof-of-concept for CVE-2026-54121 shows an Enterprise CA vouching for a forged Domain Controller identity. Microsoft's July 14 fix adds a missing check, not judgement.
Reality
QUIRSO says a suspected China-nexus actor turned CVE-2026-59310 into a backdoor, a reverse SSH binary and Babuk-derived ransomware, with 361 victim IPs across 47 countries.
Reality
Birmingham and Durham researchers rewrote a DIMM's configuration chip in software to alias in-use memory, then reached into VBS enclaves, revived blocklisted drivers and killed EDR.
Reality
CVE-2026-65400 let an attacker on the network authenticate to Screen Sharing without valid credentials. Apple's note names macOS Tahoe only, so treat wider backport claims as unconfirmed.
Reality
ProjectDiscovery says an audit of Markdown Preview Enhanced turned an ordinary repository file into arbitrary file write. Editor extensions run with developer privileges and go uninventoried.
Reality
Huntress says a public proof of concept needs only an IP address to pull any file off unpatched Macs, driving a helper process that carries Full Disk Access.
Reality
A six-agency #StopRansomware advisory dated August 10, 2026 gives defenders named CVEs, tooling and file extensions for a group that took about nine months to turn a variant into a business.
Reality
The 36th round since March 2022 pulls named CARR hackers, an alleged bulletproof hosting operator and a GRU unit commander into New Zealand law, and into NZ screening files.
Reality
A researcher claims a 100% reliable bypass of the Malware Protection Engine fix for CVE-2026-50656 on Windows 11 25H2 and Server 2025. There is no second patch to apply.
Perspective Coverage
6 publishersGoogle's new passthrough repository mode keeps no image copy, so every pull goes live to JFrog. That shifts the provenance boundary and parks a registry credential in Secret Manager.
Reality
The company says none of its offensive agents have broken out of their sandboxes so far. The useful part is the threat model, not the clean record.
Reality
Malwarebytes reports seven in ten 18-to-22-year-olds met an AI-related scam last year, against half of the general population. The gap is widest on synthetic media.
Reality
Schneier and Sanders say June's IPO filings ended governance by founder intent at OpenAI and Anthropic. The operator question underneath it is what happens to a dependency that cannot be priced.
Reality
OpenAI's Ultrafast mode for GPT-5.6 Sol, running on Cerebras, is up to 14 times faster than standard processing. The company is already using it for its own incident response, which cuts both ways.
Reality
Client fixes shipped in June and July. The exploit route only went public this month, and Zoom scores the bugs well below the firm that found them.
Reality
Deloitte's readiness survey names data foundations, agent governance and integration cost as the brakes on agentic AI. None of those is a model problem, and two are security's problem.
Reality
Version 1.1 of the Agentic Security Initiative's guide enumerates T1 through T17, up from fifteen. Cite the version, and stop reviewing agents one tool call at a time.
Reality
A UK sentencing is the week's single security item measured in results rather than warnings, and the arithmetic is unflattering: 730 days of custody against 117 identified victims.
Reality
An SC World buyers guide argues discovery breadth is the wrong procurement metric, and that a platform which cannot show finding-to-closure rates is selling inventory, not governance.
Reality
A vendor essay on AI package hallucination makes a defensible case: a package name that does not exist yet cannot be scanned, so the control has to sit at selection.
Reality
This week's disclosures turned on human trust and third-party exposure: social engineering at Levi Strauss, warehouse disruption at CEVA Logistics, and an AI agent that walked through an auth gap.
Reality
Nine of eleven MCP marketplaces accepted proof-of-concept malware with zero review, and a fake agent skill cleared both Cisco's and NVIDIA's scanners to reach roughly 26,000 corporate agents.
Reality
CrowdStrike argues AI security evaluations have converged on vulnerability discovery because it is easy to score, while most breaches still start with stolen credentials, phishing and trusted access.
Reality
A Washington panel says electrotech widens the grid's attack surface while deepening reliance on Chinese components. One state's answer is an AI cybersecurity officer in every agency.
Reality
CVE-2026-64629 is an out-of-bounds read in Siemens' Parasolid, triggered by reading a file. The remediation is a version bump on two separate branches, with no listed workaround.
Reality
CVE-2026-58231 lets an unauthenticated attacker reach code execution via the Data Hub Adapter. Onapsis says the fix is patch then re-deploy, with an IP filter set as the stopgap.
Reality
Reality