Adobe released updates for Campaign Classic that close CVE-2026-48449, a CVSS 10.0 vulnerability allowing arbitrary code execution without any user interaction, and CVE-2026-48448, an SQL‑injection flaw. No evidence of active exploitation exists, but admins should upgrade to ACC v7.4.3 build 9398 immediately.
Coinkite disclosed that Coldcard firmware versions 4.0.1‑4.1.9 generate seeds with only ~72 bits of entropy, letting attackers enumerate private keys. The flaw enabled a July 30 sweep of 1,196 wallets, stealing 1,082.65 BTC (≈$70 M) in 41 minutes. Updated firmware for all models is now available and users must migrate seeds.
A GitHub security advisory (GHSA‑xr9x‑r78c‑5hrm) reveals that Rails’ Active Storage variant processing with libvips can be abused to read any server file and, because environment secrets such as secret_key_base are exposed, can lead to remote code execution. Upgrading Active Storage (or libvips ≥ 8.13) and rotating all secrets mitigates the risk.
Google's Gemini‑powered agent harness scanned Chrome's codebase and uncovered a sandbox‑escape bug that had lingered for over 13 years. The discovery helped the team ship a record number of fixes, proving AI can surface hidden vulnerabilities at scale and accelerate Chrome's security lifecycle.
Microsoft disclosed that attackers hijacked hotel captive‑portal Wi‑Fi to push counterfeit browser updates that install the CornFlake remote‑access trojan. The Go‑based RAT, linked to the Storm‑2 sub‑group of Russia’s SVR‑backed APT29, can spy via webcam, microphone, keystrokes and steal credentials. Travelers should use trusted VPNs and reject unsolicited updates.
After months dormant, XCSSET v40 returned with memory‑resident code, polymorphic payloads and file‑less persistence, making detection harder than ever. It spreads through compromised Xcode projects on GitHub, infecting thousands of macOS apps and stealing credentials. Unit 42 outlines its C2 rotation and offers concrete mitigation steps for developers.
A compromised JavaScript tracking file served by adtech platform Adform was injecting code that monitors clipboard and replaces Bitcoin, Ethereum or TRON addresses with an attacker‑controlled wallet. The supply‑chain attack briefly affected any website using Adform’s trackpoint‑async.js, forcing visitors to unknowingly send payments to the thief; Adform removed the code and warned clients to clear cookies.
You’re caught up.
That was all 7 stories in the 1 August issue.