In partnership with

~7 MIN READ
Fact SharkNinja sat on a robot vacuum vulnerability for four months. When a researcher finally went public, a 24-hour scan turned up 673,000 exposed devices in a single AWS region, leaking live camera feeds, home maps, and WiFi passwords stored in plaintext. (Independent researcher disclosure via Malwarebytes, July 2026)
The Signal
 
Government systems, home appliances, and AI chat tools all had a rough week for the same reason: too much trust, not enough verification. Here's who paid for it, and what's finally forcing accountability.

PS — Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe →
In this edition
  📌 Big Cyber News
  🚨 Can't Miss
  🤖 AI in Cyber
  🏛️ Privacy, Power & Policy
  🛠️ Tools & Tactics
  🧪 Strange Cyber
📌 Big Cyber News
 
VULNERABILITY
🔓 One Broken Patch Turned Into a Backdoor for Every Company an MSP Touches
Intro
N-able's fix for one authentication bypass in its N-central remote monitoring platform turned out to have its own authentication bypass, and attackers found it before most customers even finished patching.
What Happened
N-able disclosed an authentication bypass (CVE-2026-18576) affecting all versions of N-central prior to 2026.3, then attackers found a second bypass (CVE-2026-18577) in the very fix meant to close it. N-able confirmed active exploitation on August 1, shipped an emergency hotfix (2026.3.1.7) on August 2, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the next day. Once inside, attackers used N-central's own "Take Control" feature to reach managed endpoints and deployed a Cloudflare Tunnel for persistent remote access.
Why It Matters
N-central is remote monitoring and management software, meaning MSPs and corporate IT teams use it to control other companies' systems. A compromised N-central server doesn't just hurt N-able's direct customer, it can cascade into every downstream client that customer manages.
The Other Side
Hosted N-central deployments were patched automatically by N-able. The risk falls specifically on on-premise deployments that haven't manually applied the hotfix yet.
 
👉 Takeaway
If your IT or security vendor uses N-central, ask directly whether hotfix 2026.3.1.7 has been applied. This is a supply-chain risk, not just a vendor's internal problem.
TL;DR: A second authentication bypass in N-able's N-central RMM platform is under active exploitation, threatening every company an MSP manages through it.
Further reading: BleepingComputer
🚨 Can't Miss
 
 
DATA BREACH
A group calling itself ExfilSquad broke into PNLD, the legal reference tool used by all 43 Home Office police forces in England and Wales plus British Transport Police, and published names, employers, and work emails for officers, criminal justice staff, and government partners. PNLD says there's no evidence passwords or login credentials were touched, and the breach doesn't include confidential case files on victims or offenders.
→ It's the contact list for the people who investigate crimes, a phishing and impersonation goldmine aimed at people trained to catch phishing and impersonation.
 
ESPIONAGE
Microsoft is tracking a Russian espionage campaign, run by a Midnight Blizzard sub-cluster, that hijacks hotel and conference center WiFi to push fake Microsoft 365 login pages and phony software updates at business travelers. Two new malware families, a keylogging remote access tool and an in-memory credential stealer, have been active since at least May.
→ Skip the hotel WiFi login prompts. Use your phone's hotspot or a VPN instead.
 
DATA BREACH
Bank of Baroda, one of India's largest state-owned banks, confirmed a breach after a hacker going by "leak-king-F" started selling what's claimed to be customer records, loan files, and internal emails on the dark web. The bank says a single employee email account was the entry point and that core banking systems were never touched.
→ One phished inbox is still all it takes. MFA on email accounts isn't optional.

Tax Prep with Confidence

Tax season doesn't have to mean wondering if you have the right forms, second-guessing your deductions, or scrambling to pull everything together before the deadline.

With BELAY’s Tax Prep Checklist, you can start preparing for tax season with confidence.

Download the Free Checklist

🤖 AI in Cyber
 
 
AI PRIVACY
Shared Claude conversations and Artifacts started turning up in Google search results in late July, missing the code that should have kept them out of search indexes. Reddit users found resumes, financial spreadsheets, and even clinical trial notes sitting in plain search results. Anthropic closed the indexing gap within days, but links already shared stayed accessible to anyone who already had them.
→ "Share with anyone with the link" means anyone, forever. Treat it like publishing, not messaging.
 
AI SUPPLY CHAIN
Three flaws nicknamed FaceHugger let a booby-trapped model repository run arbitrary code on Hugging Face's Diffusers library, even with the trust_remote_code safety switch turned off. The bug exploited a timing gap between when a file gets checked and when it actually loads. Diffusers pulled 8.1 million downloads in July alone.
→ A safety flag isn't a guarantee. Pin dependency versions and audit what your AI pipeline actually pulls in.
🏛️ Privacy, Power & Policy
 
 
REGULATION
California's Delete Request and Opt-Out Platform went from optional to mandatory on August 1. More than 600 registered data brokers must now check the DROP portal every 45 days and actually delete what Californians ask them to, or face $200 per day, per unprocessed request. Over 300,000 residents already have requests queued up.
→ If your company touches third-party personal data, "are we a data broker" isn't a rhetorical question anymore.
🛠️ Tools & Tactics
 
 
Practical play
CISA published new guidance telling federal agencies, and honestly everyone, to stop treating open source software as a free pass on due diligence. The advice: inventory every OSS component you run, patch it as fast as you'd patch anything else, and be ready to submit your own fix if a maintainer is slow to act. For AI models labeled "open source," CISA says don't assume transparency, if you can't see the training data or process, treat it like closed, proprietary software.
→ Audit your OSS bill of materials this week, and stop assuming "open" means "vetted."

Stop Paying for 10 Tools. One AI Does It All.

Most e-commerce sellers are running their store across 6 to 10 separate tools — and spending more time managing software than growing their business. StoreClaw replaces your entire stack with one autonomous AI engine that monitors competitors, optimizes listings, automates marketing, and tracks real profit across Shopify, Amazon, and beyond.

It doesn't wait for you to ask. It runs 24/7 in the background, so you wake up to a full dashboard instead of a list of things you forgot to check.

Connect your store, and StoreClaw gets to work — no prompts, no complex setup, no six-app stack.

Free to start. No credit card required.

Try it for FREE today

🧪 Strange Cyber
 
Strange but real
🧹 Your Robot Vacuum Was One Certificate Away from Spying on the Whole Neighborhood
Intro
SharkNinja's cloud-connected robot vacuums had a security hole that turned "clean the living room" into "broadcast the living room," and the company knew for months before doing anything about it.
What Happened
A researcher found that Shark robot vacuums shared AWS certificates so loosely that one compromised device could reach into other vacuums' systems in the same AWS region, exposing live camera feeds, home floor plans, and WiFi passwords stored in plaintext. SharkNinja was warned in March, went quiet for months, and only shipped a fix after the researcher published the details in mid-July. A 24-hour scan turned up 673,000 exposed devices in a single region.
Why It Matters
A vacuum cleaner isn't supposed to be a surveillance device or a network foothold, but any smart-home gadget with a camera and cloud credentials is both of those things by default.
The Other Side
SharkNinja did eventually patch it, and there's no confirmed evidence anyone exploited it maliciously before the fix shipped. Slow, but not silent forever.
 
👉 Takeaway
If it has a camera and connects to your WiFi, it's a security device whether the manufacturer treats it like one or not.
TL;DR: A Shark robot vacuum flaw exposed cameras, home maps, and WiFi passwords to anyone in the same AWS region.
Further reading: Malwarebytes

Turn podcast appearances into mentions, backlinks, citations, and AI-visible authority. PodPitch finds the right shows and handles outreach automatically. Only 20 demo spots are available this month. Appear on 3,853,234 Podcasts

Keep Reading

© 2026 Exzec Cyber's Newsletter..
beehiivPowered by beehiiv