Weekly Security Roundup — week ending 23rd August 2026

Security Stories AI as operational attack capability — Federal advisories confirmed AI-generated code has been used in real attacks on critical infrastructure. China-linked SilkParasite used AI-assisted malware in Central Asia. A Claude agent "turf war" produced self-replicating malware as an emergent sandbox failure. An engineer was nearly fooled into installing a malicious package by a compromised AI coding assistant. North Korean Rust supply chain attack — State-sponsored actors poisoned at least two popular Rust crates, including arrayref (1M+ monthly downloads), to deliver infostealers to developer workstations. Microsoft Entra ID max-severity flaw — actively exploited — A maximum-severity privilege escalation vulnerability in Microsoft's cloud identity platform was under active exploitation on patch day. Immediate patching required. Cisco critical patch batch — Five vulnerabilities rated 10, 10, 9.9, 9.6, and 7.5. Unusually dense patch week for Cisco environments. CISA KEV additions — TrueConf Server (federally mandated 3-day patch deadline), Ray distributed computing RCE, MLflow critical vulnerability. SickKids hospital hit again — Hospital for Sick Children in Toronto suffered a second significant attack; employee and applicant data confirmed stolen. Ransomware actor impersonates recovery firm — A threat actor posing as an incident recovery service has been stealing payments from organisations that believed they were paying legitimate responders. Banking trojans: Manic, Grandoreiro, ToxicPanda 2.0 — Three concurrent Android banking trojan campaigns active simultaneously. Manic exfiltrates via proximity protocols; Grandoreiro resurfaces in Latin America/Europe; ToxicPanda 2.0 expands geography. Hundreds of leaked AWS keys with full admin access — BleepingComputer reported leaked AWS keys giving full corporate account control at scale. Azure tenant records also for sale. Russian OAuth abuse phishing — Russian intelligence operators added OAuth token theft to targeted phishing campaigns, bypassing password-reset remediation. Apple spyware-class image-processing bug — Patched this week; image parsing vulnerabilities of this class have been used by mercenary spyware actors historically. Key Themes AI is the week's defining thread. Multiple incidents — federal advisories, a sandbox escape, a near-miss malware install, prompt injection bypassing safety guardrails in Grok and Gemini — represent a qualitative shift. AI-assisted attack capability is operational. Developer toolchain targeting is escalating. The Rust supply chain attack follows a pattern of nation-state actors targeting developer infrastructure as a high-value pivot point into enterprise environments. Cloud credential exposure remains the highest-leverage attack surface. AWS keys with full admin rights, Azure tenant data, OAuth tokens that survive password resets — the combination creates a persistent access problem that traditional incident response doesn't fully address. Patch surface is widening faster than most teams can track. This week: Entra ID, Cisco, TrueConf, Ray, Citrix NetScaler, GitLab, Elementor Pro, isolated-vm, MLflow, Apple iOS/macOS. No one organisation hits all of those, but every organisation hits several. CISA Known Exploited Vulnerabilities Additions this week: TrueConf Server — multiple CVEs, actively exploited; federal agencies given 3-day deadline Ray (Anyscale) — RCE vulnerability in distributed ML computing framework; actively exploited MLflow — critical vulnerability added to KEV catalogue Full catalogue: https://www.cisa.gov/known-exploited-vulnerabilities-catalog