Full Daily Digest

The attack leveraged a critical firmware misconfiguration in Coldcard wallets, where seed generation relied on a deterministic PRNG (Yasmarang) instead of the STM32 hardware RNG. This reduced entropy to 40-72 bits, far below the 128-bit security expected for BIP-39 seeds. Attackers could brute-force seeds offline by reconstructing PRNG states from device UID and timer data, then cross-referencing derived addresses with blockchain data. Affected models include Mk2-Mk5 and Q-series wallets running vulnerable firmware versions. Mitigation requires generating new seeds on patched firmware, as updates don’t retroactively secure existing seeds. Multisig setups and BIP-39 passphrases offer partial protection, but seed replacement is the only definitive fix. The incident underscores the need for rigorous entropy validation in cryptographic hardware.

The Hacker News · 2026-08-01 · Incidents: A Coldcard firmware flaw enabled $70M Bitcoin theft by exploiting weak seed generation.

Balance Theory’s platform addresses a critical gap in cybersecurity investment management by combining contextual organizational data with proprietary market intelligence. The use of AI agents and automated workflows enables CISOs to detect investment triggers, optimize cost and coverage outcomes, and rationalize security programs continuously. This approach mitigates the risk of misallocated resources, ensuring that every dollar spent maximizes impact. The platform’s ability to document investment rationales and monitor changes enhances accountability and adaptability. However, reliance on AI-driven decisions introduces potential risks, such as algorithmic biases or over-automation, which could lead to suboptimal outcomes if not carefully managed. Enterprises adopting such platforms should maintain human oversight and regularly audit AI-driven recommendations to ensure alignment with organizational priorities.

SecurityWeek · 2026-08-01 · Tools: Balance Theory raises $19M to expand its AI-driven platform for optimizing enterprise cybersecurity investments.

The vulnerability exploits libvips' 'unfuzzed' file operations in Active Storage, enabling attackers to upload crafted files and read arbitrary server files, including environment variables. This exposes credentials like secret_key_base, which can escalate to RCE. The flaw specifically impacts Rails applications using libvips for image processing and accepting untrusted uploads. Mitigation requires updating to patched Rails versions (7.2.3.2, 8.0.5.1, 8.1.3.1) and libvips 8.13+. Organizations must also rotate all exposed secrets, as patches do not remediate prior exfiltration. The attack path is low-complexity but high-impact, targeting a common web framework configuration.

SecurityWeek · 2026-08-01 · Vulnerability: Ruby on Rails patches a critical RCE flaw (CVE-2026-66066) in Active Storage, allowing unauthenticated attackers to read arbitrary files and escalate to code execution.

The critical flaw (CVE-2026-48449) in Adobe Campaign Classic stems from incorrect authorization, enabling attackers to execute arbitrary code in the context of the current user without requiring any interaction. This poses a severe risk to enterprises using ACC for marketing automation, as exploitation could lead to full system compromise. The SQL injection vulnerability (CVE-2026-48448) further exacerbates the risk by allowing arbitrary file reads, potentially exposing sensitive data. The Adobe Bridge vulnerabilities, including untrusted search path and out-of-bounds write issues, highlight systemic weaknesses in Adobe's software stack. Mitigation requires immediate patching to ACC v7.4.3 and applying the latest Adobe Bridge updates. Organizations should also monitor for unusual activity in ACC instances, given the high exploitability of these flaws.

The Hacker News · 2026-08-01 · Vulnerability: Adobe patches a CVSS 10.0 flaw in Campaign Classic allowing arbitrary code execution without user interaction.

The CaptiveCrunch campaign demonstrates a highly targeted approach, leveraging compromised hotel Wi-Fi networks to manipulate DNS responses and redirect users to fake browser updates. Attackers gain administrative control over captive portal gateways, enabling DNS spoofing and traffic redirection. Victims are coerced into executing malicious commands, facilitating the deployment of CornFlake RAT, which captures webcam images, microphone audio, and keystrokes. The campaign also employs ChocoShell, an in-memory PowerShell stealer, to harvest Microsoft 365 and Azure tokens, enabling session replay attacks. Mitigation strategies include using full-tunnel VPNs to bypass compromised DNS resolvers and avoiding software updates offered through captive portals. The campaign's attribution to Storm-2945, a sub-cluster of APT29, underscores the persistent threat posed by state-sponsored actors in the hospitality sector.

The Hacker News · 2026-08-01 · Incidents: Attackers hijack hotel Wi-Fi to deliver fake updates, deploying CornFlake RAT for surveillance, attributed to Storm-2945, a sub-cluster of APT29.