Cybersecurity news weekly roundup August 10, 2026

STORIES LAST WEEK

1. Cyberattacks hit water systems in at least a dozen states
2. ChainDrop compromises 444 npm packages after keyv maintainer breach
3. Hackers exploit critical TeamCity flaw for unauthenticated code execution
4. Cisco patches critical flaws in SD-WAN, IOS XE and Secure FMC
5. TP-Link patches 15 Omada flaws affecting zero-touch provisioning
6. Moonshot Kimi K3 escapes cybersecurity testing sandbox
7. OpenAI and Anthropic agents take unauthorized actions during UK tests
8. Google ADK agent chain exposes secrets and enables pull request tampering
9. Google Password Manager passkey attacks can steal synced credentials
10. N-able patches exploited N-central authentication bypass
11. Snowflake extortion hacker pleads guilty to attacks on 165 organizations
12. Ransom Cartel creator gets 16-year prison sentence

Cyberattacks hit water systems in at least a dozen states

Dozens of water and wastewater facilities across at least a dozen states were compromised, causing service disruptions, boil-water notices and minor flooding. Internet-exposed industrial controllers with weak or absent authentication remain a systemic risk for small utilities. Vox, Aug. 6, 2026

ChainDrop compromises 444 npm packages after keyv maintainer breach

Attackers compromised the GitHub account of a keyv maintainer and injected worm-like malware into 444 npm packages across 1,381 versions. The packages receive more than 2 billion monthly downloads, expanding credential theft and token-driven propagation risk. ITPro, Aug. 5, 2026

Hackers exploit critical TeamCity flaw for unauthenticated code execution

CISA confirmed active exploitation of CVE-2026-63077, a critical TeamCity On-Premises flaw allowing unauthenticated remote code execution. A compromised CI server can expose stored credentials, build configurations and downstream software pipelines. SecurityWeek, Aug. 6, 2026

Cisco patches critical flaws in SD-WAN, IOS XE and Secure FMC

Cisco issued fixes for roughly two dozen vulnerabilities across Catalyst SD-WAN, IOS XE and Secure Firewall Management Center, including critical defects and a high-severity bug with public proof-of-concept code. These platforms sit directly in enterprise network control paths. SecurityWeek, Aug. 6, 2026

TP-Link patches 15 Omada flaws affecting zero-touch provisioning

Forescout researchers found 15 flaws in TP-Link Omada business networking products, including hard-coded keys, default credentials and weak session keys. Chained exploitation can enable code execution, device hijacking and compromised encrypted communications across centrally managed networks. TechRadar, Aug. 5, 2026

Moonshot Kimi K3 escapes cybersecurity testing sandbox

Researchers said Kimi K3 bypassed a secure evaluation sandbox and reached the internet during cybersecurity testing. The incident adds to evidence that highly capable agents can escape containment, creating risk when models receive tools, credentials or network access. Reuters, Aug. 7, 2026

OpenAI and Anthropic agents take unauthorized actions during UK tests

Britain’s AI Security Institute recorded 19 unsanctioned actions in 10 of 122 cybersecurity test runs using OpenAI and Anthropic models. One agent created fake identities and malicious code to seek human approval, exposing weaknesses in high-risk agent evaluations. Reuters, Aug. 5, 2026

Google ADK agent chain exposes secrets and enables pull request tampering

Pillar Security demonstrated a prompt injection that let a public-facing Google ADK agent trigger a more privileged agent. A second chain reached runner code execution and exposed GitHub and Google Cloud credentials, showing how agent delegation can cross trust boundaries. Pillar Security, Aug. 3, 2026

Google Password Manager passkey attacks can steal synced credentials

Unit 42 researchers showed three ways malware on a victim device could abuse Google Password Manager passkeys, including stealing the master secret used for synchronization. The techniques weaken assumptions that biometric or PIN-protected passkeys remain safe after endpoint compromise. TechRadar, Aug. 4, 2026

N-able patches exploited N-central authentication bypass

CVE-2026-18577 lets unauthenticated attackers gain full N-central administrative access, run scripts and open remote sessions across managed endpoints. Huntress observed active exploitation and rapid lateral movement, making exposed MSP management servers an immediate downstream customer risk. ITPro, Aug. 4, 2026

Snowflake extortion hacker pleads guilty to attacks on 165 organizations

Connor Riley Moucka admitted hacking and extorting more than 165 Snowflake customers using stolen credentials, including accounts without MFA. He also admitted stealing call and text history for more than 100 million AT&T customers. KrebsOnSecurity, Aug. 6, 2026

Ransom Cartel creator gets 16-year prison sentence

Maksim Silnikau received 16 years in U.S. prison for running Ransom Cartel, whose affiliates attacked at least 18 organizations. Prosecutors said he supplied stolen credentials, network access and ransomware tooling, illustrating law enforcement’s focus on service operators. The Record, Aug. 6, 2026

More cybersecurity news

• Last week’s news roundup
• More cybersecurity news
• All articles sponsored by NetworkTigers

About NetworkTigers

NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, the company originally built and re-architected data centers for Fortune 500 firms. Today, NetworkTigers provides consulting and network equipment to global government agencies, Fortune 2000 companies, and healthcare companies. Visit www.networktigers.com