Daily · 2026-08-10
🔴 Metabase zero-day patched after active exploitation, 🎯 Payroll Pirates pivot to Microsoft Graph recon, ⚠️ Apple PCC root-write flaw, 🛡️ Claude Opus 5 resists prompt injection, 📋 AI agent hacks gym booking API, ⚡ Kimsuky integrates AI into espionage
Patches now ship for the Metabase SQLi zero-day and actively exploited Progress LoadMaster flaw with CISA's federal deadline landing today, while Payroll Pirates and BdThemes supply-chain campaigns escalate; Kimsuky adds Whisper transcription and local LLMs to its espionage toolkit, and new flaws hit Apple's Private Cloud Compute, Atlassian Rovo, and Belgium's national eID extension.
The Metabase SQL injection zero-day is the day's defining story. Exploited against Metabase Cloud since August 3, it let unauthenticated attackers reset passwords, seize admin access, and steal credentials for every connected database, with Framework and Tally confirmed as victims. The fixes shipped, but no CVE was assigned, so NVD-based scanners will not flag affected instances.
That leaves self-hosted deployments exposed until an administrator upgrades by hand, and the credential haul argues for rotating every connected database regardless. The Progress Kemp LoadMaster command injection in CISA's KEV catalog hit its federal remediation deadline today. CVE-2026-8037 has been exploited since July, with hundreds of attempts logged against roughly 300 internet-exposed appliances, and LoadMaster fronts critical infrastructure at scale.
Elsewhere, the Payroll Pirates campaign shows what follows a stolen session: operators refresh Microsoft 365 tokens every eight hours from rotating proxies and enumerate finance and payroll users via Microsoft Graph without touching MFA or passwords. Interlock reached the domain controller within 26 hours of an endpoint compromise by weaponizing WinPmem and Volatility3, legitimate forensic tools, to dump NTLM hashes.
Watchlist: self-hosted Metabase upgrade status, internet-exposed LoadMaster audits, and Graph reconnaissance against finance-facing tenants.