Notable developments in infrastructure, security and cloud. Headlines and summaries are written in our own words; follow the link for the original source.
Gen's H1 2026 report describes two distinct attack chains: one used compromised corporate email accounts and browser tampering to deliver banking-focused malware; the other monitored clipboard contents and swapped copied cryptocurrency addresses to redirect payments. For MSPs and sysadmins this highlights the need to strengthen email and browser defenses, enforce endpoint protection, and manually verify payment addresses.
North Carolina Ports Authority confirmed a cyberattack impacted IT systems at Port of Wilmington, Port of Morehead City and Charlotte Inland Port. The incident slowed operations and caused service disruptions; MSPs and sysadmins should promptly check client infrastructure status and review access controls, backups and incident response plans.
Chinese authorities have opened an unexplained review into the security of Palo Alto Networks products and have not provided a reason; a similar action was previously taken against Micron. Such probes can signal supply-chain and regulatory exposure; MSPs and sysadmins should monitor vendor advisories, verify patches and certificates, and review contingency plans.
USENIX Security is seeing more submissions influenced by AI and has adjusted reviewer and triage processes to cope. Automated content or ethical abuses are not yet widespread, but the heavier review load and verification of results are emerging concerns for the conference and its community.
A new Linux kernel vulnerability called Zapscape (CVE-2026-64561) can be exploited when nested virtualization is exposed, allowing a privileged actor in an L1 guest to abuse KVM/x86's shadow MMU and execute code on the host. This breaks isolation for hosts and tenant VMs; providers should apply patches, limit nested-virtualization exposure and tighten admission controls.
Cisco has released updates to remediate 12 vulnerabilities in Catalyst SD‑WAN and IOS XE software. The SD‑WAN issues affect devices regardless of their configuration, while IOS XE is vulnerable when running in standalone or controller roles. Three flaws score CVSS 9.8 — prioritize patches and verify affected devices promptly.
MIT CSAIL researchers Daniël Trujillo and Mengjia Yan describe INTERRUPT INJECTION, where an unprivileged Linux process times a hardware interrupt to occur between kernel predictor sanitization and its next use, allowing the branch predictor to be re-contaminated. The technique can defeat Spectre v2 mitigations on Intel and AMD; tests on AMD Zen 2 with Linux 6.14 and default protections succeeded.
Several vulnerabilities and exploit stories stood out this week: Odysseus RCE, claims of one-click account takeover affecting Samsung, and debate over an iCloud backdoor. Simple attack vectors—exposed servers, recycled bugs, malicious packages and poisoned agent instructions—pose risks to client infrastructure; prioritize access controls, patching and multi-factor checks.
A Go-written malware delivered via the ClickFix campaign is targeting macOS hosts to exfiltrate crypto wallets, browser-stored passwords, Apple Keychain entries and cached credentials. MSPs and sysadmins should harden browser/Keychain access, rotate exposed credentials and monitor for unusual data exfiltration from client Macs.
A Forescout scan on August 3 found 4,407 Rockwell PLCs reachable from the internet, including 2,844 in the United States. The scan located 22 controllers in cities hit by recent water utility attacks, 19 of which used the same mobile carrier network, though no compromises were confirmed. Administrators should audit remote access and enforce stronger network segmentation for industrial devices.
Coinspect found that CryptoJS.lib.WordArray.random() produced insufficient randomness, leading to weak keys when Ill Bloom-based wallets generated recovery phrases. On-chain analysis indicates at least $5.7M was taken in two sweeps since late May; admins and MSPs should urgently audit dependencies and key-generation processes.
Researchers reported that iCloud Private Relay can leak a user's real IP via WebKit proxy bypasses. The dual-hop design that sends Safari requests via its two-relay path can be circumvented, undermining privacy guarantees and affecting IP-based access controls, logging and geofencing; administrators should monitor Apple fixes and review configurations.
Connor Riley Moucka admitted to computer fraud and a conspiracy that targeted over 165 organizations using Snowflake, and confessed to stealing call and text history for more than 100 million AT&T customers. The scale underscores risks to cloud tenant security and the need for strict access controls, monitoring and incident response for MSPs and admins.
Pre-filled deep links in "Ask AI" buttons on commercial sites can carry hidden prompt payloads that silently modify LLM session memory and recommendation behavior. MSPs and sysadmins should treat such inputs as untrusted, isolate session state, and validate or strip prefilled parameters to prevent manipulation.
A recent series of intrusions targeting hedge funds, private equity and other financial firms has been attributed to UNC6671, a group reported to be linked to BlackFile. These extortion and data-exfiltration operations pose significant risk to client and transaction data; MSPs and sysadmins should review detection, network segmentation, secure backups and incident response readiness.
Switzerland's federal IT office reported attackers exploited vulnerabilities in Microsoft SharePoint servers to compromise roughly 200 accounts. MSPs and sysadmins should prioritize access reviews, patching and log analysis, and check customer environments for credential exposure or data exfiltration.
Researchers disclosed TONTOU, a new CPU speculative-execution attack that circumvents recent Spectre v2 mitigations and a working exploit can extract password hashes from Linux systems. Sysadmins and MSPs should verify microcode and kernel updates, restrict untrusted code execution, and tighten isolation in multi-tenant environments.
An IT team affixed sticky notes with login details to laptops to simplify sign‑in; when those notes remained exposed others were able to access the devices. For MSPs and sysadmins this highlights the need for physical credential protection, password managers, screen locks and remote management or credential rotation procedures.
Headlines and summaries are written by RADAR in its own words. Copyright belongs to the respective publisher; use the source link for the full text.