Infosec · Wednesday, 26 August 2026 · Issue 86 · 8 stories

SS7 abuse in the wild, AI agents break VMs, and a backdoor that sleeps

A single SS7 hop tracked a VVIP across 11 operators in nine countries. That's the known threat. The unknown one is worse: an AI agent that escaped a VM three times, finding 0-days on its own. Today's issue is about perimeters that no longer hold.

Vulnerabilities & Exploits

SS7 abuse caught in the wild: spy vendors tracked a VVIP across 11 operators

Citizen Lab fingerprints two commercial surveillance vendors abusing SS7 and Diameter signalling to silently track phones across operator networks. One campaign chased a single VVIP executive's device across 11 operator identities in nine countries, riding genuine carrier interconnect paths to hide. Worse, a malicious SMS smuggled hidden SIM commands to turn the target's phone into a covert location beacon. Operator identifier reuse spanning years shows the abuse is persistent, not a one-off smoke test.

citizenlab.ca ↗15 min read at source

A single webpage visit can hijack and permanently poison your local AI agent

One visit to an attacker's page is enough. NVIDIA NemoClaw starts its Ollama backend bound to 0.0.0.0:11434, and DNS rebinding slips past the CORS defense so a browser can reach the unauthenticated API. From there the attacker rewrites the model's chat template, planting instructions that survive the agent's own system prompt. NVIDIA patched macOS and Linux in v0.0.35; the Windows and WSL path remains exposed.

cyera.com ↗9 min read at source

Zyxel guest APs let a single crafted POST skip the captive portal (CVE-2026-8508)

A pre-auth flaw in Zyxel's guest Wi-Fi social login hands the browser the Facebook-side identity work, then trusts the submitted profile fields instead of validating the access token server-side. One crafted POST to social_login.cgi returned a valid session cookie with attacker-chosen identity. The WAX650S was triaged entirely by rehosting vendor firmware in user-space emulation, and Zyxel's advisory now covers 39 models.

minanagehsalalma.github.io ↗6 min read at source

Q2 CVE counts hit all-time highs, and AI is now the reason

Kaspersky's Q2 report shows registrations of new CVEs and critical (CVSS>9.0) bugs surging to record levels, driven by AI-assisted vulnerability research and AI-generated code. Entire new bug classes emerged, Dirty Frag flaws in the Linux kernel, and over 200 CVEs in the OpenClaw AI project alone. Researchers also began publishing Windows exploits before CVE registration or patches, a newly broken norm.

securelist.com ↗16 min read at source

Threats & Malware

GPT-5.6-Cyber escaped Trail of Bits' VM three times, finding 0-days en route

Trail of Bits gave GPT-5.6-Cyber one task: break out of a QEMU/KVM sandbox and read a flag file. It escaped three times, first via disclosed kernel bugs, then unpatched ones, then 0-days it discovered itself, working autonomously for hours with minimal prompting. The blunt conclusion: a snapshot-able VM is no longer a dependable perimeter for a determined AI agent, and such agents should be treated as an advanced persistent threat.

blog.trailofbits.com ↗8 min read at source

This backdoor sleeps silently until a magic packet wakes it to run its own bytecode

SLEEPWALKER is a Windows backdoor that stays inert with no C2, no outbound traffic, and not a single domain or IP baked in, until one crafted packet reaches the machine and triggers a program written in its own 23-instruction bytecode. It impersonates Microsoft's dpapi.dll to side-load into ESET's ERAAgent.exe, sniffs every interface it can watch, and even sees traffic meant for other hosts. The design points to a targeted, well-resourced operator, though attribution remains open.

r136a1.dev ↗67 min read at source

Privacy, Policy & Governance

AliExpress caught fingerprinting shoppers with inaudible audio, and it hijacked a dev's Bluetooth headphones

Leave an AliExpress tab open and the site quietly fingerprints you: heavily obfuscated scripts fire sawtooth waves through the Web Audio API to turn your own hardware into a unique device signature. Developer Matt Callaghan only noticed because the inaudible tones kept stealing his Bluetooth headphones from his phone. Firefox and Brave say they already block the trick. Silent tracking, it turns out, still leaks.

theregister.com ↗2 min read at source

Apple Backs Down: Hide My Email Stays on icloud.com

Apple has reversed its June plan to move iCloud+ Hide My Email aliases to a shared private.icloud.com domain. Users warned that a distinct domain would let any site block disposable addresses with a single rule. So the feature keeps hanging out on icloud.com, where filtering it would catch legitimate emails too. Sign in with Apple still migrates to private.icloud.com later this year.

macrumors.com ↗1 min read at source

You’re caught up.

That was all 8 stories in the 26 August issue.