Cyber Roundup — Week of August 3rd

Here are the main stories you missed last week.

1. N-able: A “god mode” authentication bypass in N-central gave attackers administrative control of every endpoint an MSP manages

The headline: N-able disclosed active exploitation of CVE-2026-18577 on August 2, an authentication bypass vulnerability in N-central that allows any unauthenticated attacker to gain full administrative access to the RMM console. CVE-2026-18556, the original vulnerability, covered N-central releases through version 2026.1. N-able addressed it in version 2026.2, but that remediation left an alternate authentication path open. Attackers discovered and exploited the residual path, which became CVE-2026-18577, affecting all N-central builds prior to 2026.3.1.7. N-able began investigating anomalous activity on July 31 and released the first hotfix, version 2026.3.1.7, on August 2. CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog on August 3 and CVE-2026-18556 on August 5. A second hotfix, version 2026.3.1.10, shipped on August 6 with additional mitigations. Post-exploitation behavior includes attackers abusing N-central’s Take Control feature, deploying AnyDesk, TeamViewer, and RustDesk for persistent remote access, registering Cloudflare Tunnel as a Windows service to establish outbound-only encrypted persistence that survives reboots and bypasses firewall rules, and using a tool called PhantomKiller to disable Microsoft Defender and Sophos on managed endpoints.

What we’re actually watching: N-central is not a single organization’s problem. It is an MSP platform that manages endpoints across dozens or hundreds of customer environments from one console. When an attacker authenticates as an N-central administrator, they do not gain access to one company. They inherit the platform’s access to every organization that MSP serves.

The incomplete patch story is operationally significant. N-able fixed the original vulnerability in version 2026.2 and told customers the issue was resolved. Customers who applied that patch believed they were protected. They were not. The residual authentication path that became CVE-2026-18577 existed in versions that had already applied the first fix, including builds initially believed to be safe. Organizations that track patch status by CVE rather than by confirmed behavioral testing found themselves exposed despite having applied the remediation they were told to apply.

The CISO question: If your organization is managed by an MSP running N-central, do you know whether that MSP’s N-central instance was on-premises, whether it has been patched to version 2026.3.1.10, and whether the Cloudflared, PhantomKiller, and remote access tool indicators have been checked against your endpoint estate regardless of whether your MSP has told you everything is fine?

2. Brinks Home: ShinyHunters breached the company that sells home security through a vishing call, then published 41GB when the ransom wasn’t paid.

The headline: ShinyHunters breached Brinks Home on July 13 through a Microsoft Entra voice phishing attack against a single employee, convincing them to complete an authentication or registration process that handed the attacker account access. From there, the group exfiltrated more than 4.9 million Salesforce records, including 1.1 million rows of customer data from the Contacts object, 3.8 million customer support chat logs from the Brinks Care Cresta instance, and 4,000 rows of employee PII including names, email addresses, job titles, and phone numbers. Brinks Home detected the intrusion on July 20, seven days after it began. ShinyHunters set a ransom deadline of July 30. When Brinks Home did not pay, the group published 41GB of files on August 2. Brinks Home confirmed unauthorized access to part of its IT environment. Alarm monitoring and system functionality were not affected.

What we’re actually watching: A company that sells physical security to over one million households was breached not through a technical vulnerability but through a phone call. The attacker did not need to find a flaw in Brinks Home’s perimeter. They needed one employee to complete an authentication prompt they were not expecting.

The seven-day detection gap between breach and discovery meant that by the time Brinks Home’s security team identified the intrusion, the attackers had already exfiltrated everything they needed. The Salesforce environment held customer home addresses, contact information, support chat history, and employee data. For an extortion group, that combination represents direct leverage: customer home addresses make any follow-on physical threat credible, and support chat logs often contain details about security system configurations that customers shared with support agents.

The CISO question: For your organization’s Salesforce environment, do you have detection for bulk data export operations that occur outside normal business hours or from user accounts that have not previously performed exports at that volume, and would a seven-day dwell time in your Salesforce environment be detectable through your current monitoring?

3. npm: The Shai-Hulud worm compromised the keyv maintainer’s GitHub account and spread across 868 packages before the registry could respond

The headline: An attacker compromised the GitHub account of the maintainer behind keyv on August 4, a key-value storage library with approximately 127 million weekly npm downloads, and used that access to inject the Shai-Hulud credential-stealing worm across the entire package family. The same maintainer owns cacheable (29M downloads per month), flat-cache (565M downloads per month), file-entry-cache (557M downloads per month), and several other widely used caching utilities, all swept up in the same attack. The poisoned versions were published to npm with valid OIDC and SLSA provenance signed by GitHub Actions, meaning they passed standard supply chain integrity checks. Aikido Security counted at least 868 compromised packages across 1,381 versions representing over two billion monthly installs. The payload harvested GitHub, npm, cloud provider, Vault, Kubernetes, database, and private key credentials from developer and CI environments, installed hooks into Claude Code and VS Code, stole GitHub Actions runner memory, and carried npm publishing machinery allowing the worm to republish itself under stolen maintainer identities. The malware used an Ethereum smart contract to retrieve C2 domains dynamically rather than hardcoded infrastructure.

What we’re actually watching: The Shai-Hulud campaign is not new. The same marker, public GitHub repositories described as “Shai-Hulud: Here We Go Again,” appeared during the May 2026 TanStack compromise. What is new is the scale: a single GitHub account takeover reached two billion monthly installs in minutes because the compromised maintainer controlled the entire keyv and cacheable dependency family.

The valid provenance is the detail that breaks the standard defensive response. The poisoned packages carried legitimate OIDC and SLSA provenance because the attacker used the maintainer’s own GitHub Actions workflow to build and sign them. Provenance identifies the build process. It does not inspect what the build process produced. Security tooling that flags unsigned or unverified packages as suspicious will not flag these. They are signed. They are verified. They are malicious.

The CISO question: For your organization’s JavaScript build pipelines, do you have monitoring that detects when an installed package version is added to a known-malicious list after it has already executed in your environment, and do you have a process for rotating every secret that may have been harvested from an affected CI environment before you knew the package was malicious?

4. UK Department for Education: ExfilSquad stole 607,000 records from a government helpdesk portal that nobody was watching closely enough

The headline: The UK Department for Education confirmed on July 29 that a cyberattack on two of its external-facing systems, the online customer helpdesk portal and the Turing Scheme portal, resulted in the theft of approximately 607,000 records. The data includes names, telephone numbers, email addresses, and job titles connected to parents, government officials, senior school leaders, and university staff. ExfilSquad, a previously unknown extortion group that emerged this week claiming multiple major victims including the UK Police National Legal Database, claimed responsibility. Sophos assessed the published data samples and said they appeared legitimate. The DfE stated that bank details were not obtained and described the breach as affecting customer service contact data. The DfE, PNLD, and the ICO have all been notified. The NCA and NCSC are investigating. ExfilSquad also claims Microsoft as a victim, alleging a 13GB haul, but that claim has not been confirmed.

What we’re actually watching: ExfilSquad claimed fifteen major organizations this week. The DfE and Police National Legal Database breaches are confirmed. Not all of the group’s other claims are holding up under scrutiny, and the sudden emergence with a large claimed victim list is consistent with a new extortion actor establishing credibility through volume rather than precision.

The CISO question: For every external-facing portal your organization operates, including helpdesks, support ticketing systems, and grant application portals, do you apply the same monitoring and access logging standards as your internal systems, or do you treat external-facing portals as lower-risk because they are designed to accept external contact?

5. Hungary: ByteToBreach encrypted machines inside the State Treasury’s Agriculture Division, tracing to Russian servers

The headline: The threat actor known as ByteToBreach, the same individual who previously wiped Romania’s entire land registry database, breached Hungary’s State Treasury (Magyar Államkincstár) this week and encrypted files on employee computers inside the Agriculture and Rural Development Division, the National Paying Agency responsible for managing agricultural and EU rural development funds. Hungary confirmed the cyberattack on its IT infrastructure and stated there was no evidence of data loss. Preliminary findings traced the attack to Russian servers. Portions of data claimed to be stolen have since appeared for sale on an underground hacking forum. The attack is classified as ransomware. The broader State Treasury, which administers state payments, pensions, family benefits, and EU funding, was not fully disrupted.

What we’re actually watching: ByteToBreach now has two confirmed attacks against European government financial infrastructure in rapid succession: Romania’s land registry in July and Hungary’s Agriculture Division this week. The pattern of targeting national data registries and financial management systems, then either wiping or encrypting and selling the data, suggests a threat actor with specific interest in disrupting European government operations rather than maximizing ransom revenue.

The CISO question: For your organization’s most operationally critical systems, do you have tested backup restoration procedures that account for ransomware encryption of specific divisions rather than full-network compromise, and does your business continuity plan define recovery time objectives for partial rather than complete system restoration?

The pattern across all five stories

Every incident this week exploited a gap between what organizations assumed was protected and what attackers found reachable.

N-able’s customers assumed an incomplete patch was complete. Brinks Home assumed perimeter security covered a phone call. The npm ecosystem assumed that valid SLSA provenance meant safe code. The DfE assumed a customer helpdesk portal carried lower risk than internal systems. Hungary’s Agriculture Division assumed its network was not in scope for a threat actor who had just wiped Romania’s land registry.

CybelAngel finds what is exposed, what is reachable, and what is already in circulation before assumptions become incidents.