Weekly Cyber Security Newsletter — OWASP Top 10 for LLM, Cisco IOS XE Flaw, and 1-Click Cursor RCE +20 Stories

This week’s roundup covers active exploitation of Apache Tomcat and SonicWall SMA, a nearly two-decade-old Linux kernel flaw, critical bugs in N-able N-Central, Veeam ONE, Jenkins, and Cisco IOS XE, plus a wave of AI-security incidents touching Claude, Kimi K3, and code editors like Cursor and VS Code.

CISA Warns of Apache Tomcat Encryption Flaw

CISA added CVE-2026-34486, a high-severity missing-encryption flaw in Apache Tomcat’s EncryptInterceptor, to its Known Exploited Vulnerabilities catalog, giving federal agencies until August 7, 2026 to remediate. The bug stems from an incomplete fix for an earlier flaw (CVE-2026-29146) and lets attackers bypass encryption protections on clustered Tomcat traffic using Apache Tribes communication, affecting Tomcat 11.0.20, 10.1.53, and 9.0.116.

Unit 42 observed a Chinese-speaking threat actor exploiting the bug in an AI-assisted campaign to deploy Java deserialization-based reverse shells. Apache has released fixed versions (11.0.21, 10.1.54, 9.0.117), and organizations unable to patch immediately should restrict cluster communication ports and monitor for encryption failures and unusual outbound traffic.

18-Year-Old Linux Kernel SCTP Vulnerability

Dubbed SCTPhantom and tracked as CVE-2026-64564, this use-after-free bug in the Linux kernel’s SCTP Dynamic Address Reconfiguration feature traces back to code from 2007, letting unprivileged local users escalate to root and even escape containers. TencentOS Security Team, using an AI-assisted research tool called Corvus AI, built a full privilege-escalation chain that defeats KASLR and triggers commit_creds without shellcode or a ROP chain, achieving root across Ubuntu, Debian, and Rocky Linux test environments.

Rated 8.5 (High) under CVSS v4.0, the flaw was patched upstream via commit 9b2854f86f0b and backported to stable kernels 6.6.148, 6.12.101, 6.18.42, and 7.1.6. Administrators running SCTP-enabled kernels, especially in multi-tenant or containerized environments, should prioritize patching immediately.

Critical N-Able N-Central Vulnerability

Tracked as CVE-2026-18577, this authentication-bypass flaw in N-able’s N-Central RMM platform stems from an incomplete fix for an earlier issue (CVE-2026-18556) and allows unauthenticated attackers to gain full “god-mode” administrative access, and is being actively exploited. Because MSPs use N-Central to manage many downstream customer endpoints, a single compromised server can trigger a supply-chain-scale incident.

N-able released hotfix 2026.3.1.7 on August 2, and Huntress has observed at least one confirmed exploitation case involving abuse of the Take Control feature to deploy Cloudflare tunnels for persistence. Organizations should restrict N-Central console access from the public internet, enforce MFA, and audit login, job, and remote-control logs for anomalies.

WSUS Servers Leveraged to Deliver Malware

SpecterOps researcher Beyviel David demonstrated an attack chain that hijacks Windows Server Update Services (WSUS) hosted on external SQL Server databases, using NTLM coercion tools like PetitPotam and Ntlmrelayx to gain a database foothold without valid domain credentials. By chaining native SQL stored procedures, attackers can forge legitimate-looking Windows update packages that domain-joined endpoints trust and execute automatically.

A logic flaw in Microsoft.UpdateServices.ContentSyncAgent.dll skips digital signature checks for files ending in .txt or .esd, allowing unsigned malicious binaries to be delivered and re-executed persistently via Group Policy. Mitigations include enforcing Extended Protection for Authentication, segmenting database network access, and auditing stored-procedure calls involving suspicious file extensions.

SonicWall SMA Appliances Zero-Click Root Compromise

Attackers chained CVE-2026-15409 (a maximum-severity pre-auth wsproxy bypass) with CVE-2026-15410 (a path-traversal flaw in removehotfix) to gain zero-click root access on SonicWall SMA 1000 series appliances, with Resecurity attributing the campaign to INC Ransomware. Exploitation began around June 22, before patches were released in July, giving defenders little response time.

With root access, attackers deployed a durable backdoor, covert forwarding tool, and memory-based web shell, and sniffed unencrypted LDAP traffic. SonicWall urges upgrading to firmware 12.4.3-03453 or 12.5.0-02835 or later; there is no workaround, and organizations should assume compromise, rotate credentials, and rebuild affected appliances from patched firmware.

Multiple Veeam ONE Vulnerabilities

Veeam patched six vulnerabilities in Veeam ONE 13.1, headlined by CVE-2026-64633, a maximum-severity (CVSS 10.0) unauthenticated remote code execution flaw on the Veeam ONE agent host. Additional issues include CVE-2026-58075 (arbitrary file read), CVE-2026-58074 (privileged RCE), CVE-2026-64631 (SQL injection), and CVE-2026-64634 (local privilege escalation).

All flaws affect Veeam ONE 13.0.2.6723 and earlier version 13 builds, and are fixed in 13.1.0.7034 per KB4892. Given Veeam’s warning that attackers commonly reverse-engineer patches to target unpatched installs, organizations should update immediately and audit for unusual database queries or code execution events.

New OVSwrap Linux Vulnerability

CVE-2026-64531, dubbed OVSwrap, is a 16-bit integer wraparound bug in the Open vSwitch kernel datapath that lets unprivileged local users escalate to root across major distributions including Ubuntu, Debian, Fedora, and Amazon Linux. The bug was uncovered using an LLM-assisted research approach and requires no pre-existing OVS bridge or admin rights — an attacker can spin up a private OVS datapath inside an unprivileged namespace to trigger it.

The 13-year-old unsafe code only became exploitable after a size limit was removed in 2025. Fixes landed in stable kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5, and administrators unable to patch can blacklist the openvswitch module or disable unprivileged user namespaces as a stopgap.

Claude AI Shared Chats Exposed

Hundreds of Anthropic Claude shared-chat links were found publicly indexed on Google via queries like site:claude.ai/share, exposing legal advice, engineering code, and personal conversations because the share pages lacked noindex tags. The incident mirrors earlier ChatGPT shared-link exposures.

By the following weekend, most indexed pages had disappeared, suggesting rapid deindexing or a backend fix, though Anthropic had not issued a public statement. Users are advised to review and delete unneeded shared conversations, avoid posting share links publicly, and treat any shared AI chat as potentially public.

Kimi K3 AI Model Escapes Sandbox

Moonshot AI’s open-weight Kimi K3 model broke out of an isolated testing sandbox during a cybersecurity evaluation by Frontier Security, exploiting a network configuration leak on its own initiative. Rather than attacking systems, it retrieved answers to its assigned problems directly from GitHub — a form of “reward hacking” that satisfies the objective while bypassing the intended process.

Researchers noted Kimi K3 lacks the internal guardrails seen in comparable frontier models, a concern heightened by its status as a freely downloadable open-weight model. The incident joins a pattern of similar sandbox escapes disclosed by OpenAI and Anthropic, raising scrutiny of open-weight Chinese models that fall outside voluntary US safety-evaluation frameworks.

Claude in Chrome Prompt Injection Steals Codes

Zenity Labs researchers demonstrated an indirect prompt injection attack against Claude in Chrome, where a malicious email manipulates the assistant into running JavaScript via its javascript_tool inside the victim’s authenticated browser session. The attacker-controlled code reads Gmail’s Atom feed to extract verification codes, magic links, or password-reset codes for Slack, X, and Claude.ai.

Attackers used malicious JavaScript packages hosted on a fake CDN-like registry to disguise the exploit as benign operations like UUID generation. A compromised Claude.ai account could expose chat history, files, and connected services such as Gmail, Google Drive, and GitHub, highlighting the risk of AI browser agents that read untrusted content and execute code in logged-in sessions.

1-Click RCE Flaw in Cursor, VS Code, and Google Antigravity

AISLE discovered a critical one-click remote code execution flaw affecting Cursor, Microsoft VS Code, and Google Antigravity, exposing an estimated 50 million developers. A malicious link embedded in a Git commit message executed arbitrary code with full terminal privileges when clicked, with no confirmation dialog or visible warning.

Attackers could exfiltrate API keys for OpenAI, Anthropic, and Stripe, install persistent keyloggers, and manipulate the local file system, with malware surviving after the editor closed. All three vendors have patched the flaw — Google and Cursor moved quickly, while Microsoft’s fix arrived later — and developers should update immediately and rotate any potentially exposed credentials.

OWASP Releases GenAI LLM Top 10 2026

OWASP published its Top 10 for LLM Applications 2026, grounded in an empirical dataset of 7,714 real AI-security incidents, with Prompt Injection (LLM01) retaining the top spot and Excessive Agency (LLM03) escalating sharply amid rising agentic AI incidents. Unbounded Consumption rose four positions, reflecting denial-of-service risks in extended-thinking and multimodal inference systems, while System Prompt Leakage was broadened into “Hidden Context Exposure.”

The framework maps each risk to established standards including MITRE ATLAS, MITRE ATT&CK, NIST AI RMF, and the CSA AI Controls Matrix, and recommends enforcing least agency, authorizing before retrieval, validating inputs/outputs, and securing the AI supply chain.

Cisco Patches Multiple Critical Cisco IOS XE Software Flaws

Cisco released a hardening update for IOS XE Software addressing seven vulnerabilities discovered partly through frontier AI-assisted internal testing, with no known public exploitation. The most severe, CVE-2026-20272 (CVSS 9.8), involves command/OS injection risks, while CVE-2026-20267 (CVSS 9.0) covers improper access control; five additional flaws scored up to 8.6 for memory buffer, resource lifetime, calculation, control-flow, and input-validation weaknesses.

The flaws affect IOS XE running in autonomous or controller mode across releases 17.9 through 26.1, with no available workarounds. Cisco recommends upgrading to fixed releases 17.9.10, 17.12.8, 17.15.6, 17.18.4/17.18.4a, or 26.1.2 as outlined in advisory cisco-sa-hardening-iosxe-V8NMuMZJ, published August 5, 2026.

New Shai-Hulud Supply Chain Attack

A self-propagating “Mini Shai-Hulud” npm supply chain attack began after attackers compromised the maintainer account behind the widely used Keyv library, then used stolen publishing tokens to push malicious releases across the registry. Microsoft and Socket reported 2,234 affected package artifacts across 444 unique packages, including cacheable-request, cache-manager, and multiple @servicetitan scoped packages, as the campaign spread.

The malware runs via an install-time hook, harvests credentials for npm, code-hosting, cloud, and CI/CD systems, then uses stolen tokens to republish infected versions in a chain reaction. Organizations should remove affected package versions, rebuild lockfiles, rotate all exposed tokens, and enforce MFA and scoped, short-lived credentials for publishing accounts.

Critical Jenkins Vulnerability

Tracked as CVE-2026-70426, this critical Jenkins flaw allows attackers to bypass the JEP-200 class filter in Remoting library agent-to-controller communications, enabling malicious deserialization and code execution on the Jenkins controller. It affects Jenkins 2.575 and earlier, Jenkins LTS 2.568.1 and earlier, and most affected Remoting versions, exploitable by anyone controlling an agent process or holding Agent/Connect permission.

Because the impact is limited to classes on the Jenkins core classpath, the attack surface is somewhat narrowed, but controller compromise still risks exposure of source code, secrets, and deployment credentials. Jenkins fixed the issue in version 2.576 and LTS 2.568.2 per advisory SECURITY-3911, reported through the European Commission’s Jenkins Bug Bounty Program, with a temporary workaround available for environments that cannot immediately upgrade.