Cyber Roundup — Week of August 10th

Aquí están las noticias principales que te perdiste la semana pasada.

1. Metabase: A CVSS 10.0 zero-day in the password reset endpoint gave unauthenticated attackers admin access to every database the platform had ever connected to

The headline: Metabase disclosed CVE-2026-72898 on August 6, a maximum-severity SQL injection vulnerability in the publicly accessible /api/session/reset_password endpoint that allows any unauthenticated attacker to inject raw SQL into the Metabase application database and obtain full administrator access. No credentials are required. No user interaction is needed. The vulnerability affects every self-hosted Metabase release from version 1.58 onward across branches 0.58 through 0.63. CISA added CVE-2026-72898 to its Known Exploited Vulnerabilities catalog on August 11 with a federal remediation deadline of August 14. Metabase confirmed at least five companies lost data before disclosure, including Framework, which lost customer names, email addresses, phone numbers, physical addresses, and login IP addresses; n8n, which lost 136 customer records including five bcrypt-hashed account passwords; and Anaconda, Kilo Code, and Tally, all of which confirmed unauthorized data access through the same vulnerability. Metabase Cloud was patched automatically. Self-hosted deployments require manual action.

What we’re actually watching: Metabase is not a standard business application. It is a data access layer that sits on top of production databases, data warehouses, and credential stores. An attacker who gains administrator access to a Metabase instance does not just access Metabase. They access every data source the instance has ever been configured to query.

The attack surface is wider than the patch surface. Wiz observed that roughly 13% of cloud environments have self-hosted Metabase instances deployed, of which approximately 25% are fully internet accessible. That translates to roughly 2,500 Metabase instances reachable from the public internet right now, each one a single unauthenticated HTTP request away from full admin access. Organizations that patched Metabase itself but did not rotate the credentials Metabase held for connected databases, data warehouses, and API services remain exposed through those downstream paths even after applying the fix.

The technical root cause is worth naming specifically. An attacker adds an extra user-id key to the JSON body of the reset_password request and supplies it as a HoneySQL raw SQL object. Because the value reaches a database query without type validation, it is compiled into raw SQL rather than treated as data. Bishop Fox confirmed the exploit independently. The exploitation started before public disclosure, which means any self-hosted Metabase instance running a vulnerable version should be investigated for compromise, not just patched.

The CISO question: For every self-hosted Metabase instance in your environment, have you applied the patch, rotated every credential Metabase holds for connected databases and data warehouses, revoked active API keys and admin sessions, and reviewed Metabase activity logs for signs of unauthorized queries run before you knew the vulnerability existed?

2. LiteLLM: TeamPCP compromised a security scanner to infect an AI library and reach 434,000 CI/CD pipelines across 2,500 organizations in 40 minutes

The headline: CloudSEK published its full analysis this week of the March 2026 LiteLLM supply chain attack, linking more than 2,500 organizations and 434,000 CI/CD pipelines to the compromise. The attack began when TeamPCP compromised Aqua Security’s Trivy open-source vulnerability scanner on March 19 by exploiting an incompletely revoked automation token to force-push malicious commits to 76 of 77 trivy-action version tags and publish a malicious Trivy 0.69.4 release. Because LiteLLM’s CI pipeline installed Trivy without locking it to a verified version, the poisoned scanner ran with legitimate read access to LiteLLM’s build environment and exfiltrated its PyPI publishing credentials. TeamPCP then published malicious LiteLLM versions 1.82.7 and 1.82.8 to PyPI. The packages were live for 40 minutes. A Python startup hook ensured the credential-stealing payload executed the moment Python initialized, regardless of whether LiteLLM was explicitly imported. Confirmed victim organizations include Nvidia, AWS, Samsung, and Salesforce. The FBI issued FLASH advisory FLASH-20260702-01 on July 2, 2026, warning that affiliated actors are likely to weaponize the harvested credentials.

What we’re actually watching: TeamPCP did not attack LiteLLM. They attacked LiteLLM’s security scanner. The scanner had legitimate read access to the build environment. When the scanner was compromised, everything the scanner could read was compromised. This is the supply chain attack model that the industry has not yet built adequate defenses against: not a malicious package, not a compromised maintainer, but a compromised trusted tool that runs with elevated access inside the target’s own pipeline.

The FBI’s July FLASH advisory warning that affiliated actors are likely to weaponize the harvested credentials means this is not a closed incident. The 153GB of exfiltrated data, containing environment dumps from 2,488 corporate domains, is still in attacker hands. Organizations in that dataset that have not rotated every credential present in their CI/CD environments at the time of the March compromise remain exposed to a second attack using the first attack’s output. Rotating only the LiteLLM or model-provider key is insufficient. Every credential readable by the affected process should be treated as potentially exposed.

The CISO question: For your organization’s CI/CD pipelines, do you pin every third-party tool including security scanners to verified, immutable version hashes rather than floating version tags, and if your pipelines ran LiteLLM between March 19 and March 24, 2026, have you rotated every credential that was present in those build environments?

3. Snowflake: Connor Moucka pleaded guilty to breaching 165 organizations and exposing 100 million people’s data using passwords nobody had changed

The headline: Connor Riley Moucka, 26, of Kitchener, Ontario, pleaded guilty on August 5 in U.S. District Court for the Western District of Washington to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy for his role in the 2024 Snowflake campaign. The intrusions reached 165 organizations and exposed records belonging to at least 100 million individuals. Victim companies suffered over $9.5 million in documented losses, excluding downstream customer harm. Moucka personally received at least $495,000 from ransoms and data sales. He faces a mandatory minimum of two years on the identity theft count and up to 30 additional years on the remaining charges. Sentencing is scheduled for October 27. Co-defendant John Erin Binns remains outside U.S. custody. DOJ characterized the guilty plea as part of Operation Riptide, the FBI’s sustained enforcement campaign targeting criminal actors, infrastructure, and financial networks behind cybercrime.

What we’re actually watching: The Snowflake plea closes the legal chapter on a campaign that had no technical sophistication whatsoever. Moucka and his co-conspirators used credentials obtained from infostealer malware logs, commercial malware sold as a subscription service on criminal forums, to log directly into cloud storage instances belonging to Snowflake customers. Snowflake did not require multi-factor authentication. A valid username and password was all that stood between the attackers and terabytes of enterprise data.

Researchers found that at least 79.7% of the accounts used in the campaign had prior credential exposure, some tracing back to infostealer infections from as early as 2020, with a few passwords left unrotated for as long as four years. The organizations breached were not negligent by any exotic standard. They had adopted a widely used, trusted cloud platform. They had not enforced MFA on that platform. They had not identified that their employees’ credentials were already circulating in criminal markets. CybelAngel’s dark web monitoring finds those credentials in infostealer logs before attackers use them, giving organizations the window between initial credential exposure and operational deployment that the Snowflake campaign demonstrated is exactly where the breach can still be prevented.

The CISO question: For every SaaS platform your organization uses, have you confirmed that MFA is enforced rather than optional for all account types including service accounts and trial accounts, and do you have a process for identifying when your employees’ credentials appear in infostealer logs before an attacker attempts to use them?

4. Microsoft: August Patch Tuesday fixed 421 CVEs and Check Point confirmed Lazarus Group is exploiting a WinSock driver zero-day for privilege escalation

The headline: Microsoft shipped its August 2026 Patch Tuesday on August 12, fixing 421 CVEs including one confirmed exploited zero-day and three publicly disclosed vulnerabilities. The exploited flaw, CVE-2026-68820, is a use-after-free vulnerability in Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver that forms the backbone of the Windows Sockets API. Microsoft confirmed active exploitation but did not attribute it publicly. Check Point Research attributed the exploitation to the Lazarus Group, reporting that attackers used the flaw to deploy the FudModule rootkit and ForestTiger backdoor as part of Operation Dream Job targeting defense-sector companies. The vulnerability carries a CVSS score of 7.0 and is rated Important by Microsoft, a score that understates operational risk given that privilege escalation to SYSTEM is the second half of nearly every serious intrusion. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11.

What we’re actually watching: Lazarus Group using a Windows zero-day for privilege escalation is consistent with their operational pattern across 2025 and 2026: initial access through credential theft or social engineering, followed by local privilege escalation to SYSTEM using a kernel-mode driver vulnerability, then lateral movement and data exfiltration. The WinSock driver is an unusual target. It handles all Windows network socket operations and runs in kernel mode with high privilege. A use-after-free in that code path provides a reliable escalation route that operates below most endpoint security monitoring thresholds.

The scale of this Patch Tuesday reflects a structural shift in vulnerability discovery. Microsoft attributed part of the volume increase to MDASH, its multi-model agentic scanning harness. When AI-powered vulnerability research accelerates discovery on Microsoft’s own codebase, it accelerates discovery everywhere. The 421-CVE volume is not a backlog clearance. It is the new baseline for what AI-assisted security research produces in a monthly cycle, and organizations with monthly patch cycles are structurally misaligned with the threat timeline that produces it.

The CISO question: Given that 421 CVEs in a single Patch Tuesday cycle makes risk prioritization genuinely difficult, do you have a process for immediately separating confirmed-exploited zero-days from the broader patch queue and treating them as emergency remediations regardless of their CVSS score or the vendor’s stated exploitation likelihood?

5. GeoServer: An unauthenticated SQL injection to RCE was disclosed publicly on August 12 and exploitation began within hours

The headline: Security researcher @q1uf3ng publicly disclosed a SQL injection vulnerability in GeoServer’s jsonArrayContains function on August 12, noting that on systems using PostGIS 12 or greater with elevated database permissions, the injection can achieve remote code execution. GeoServer is an open-source spatial data server widely deployed in government, utilities, environmental monitoring, and critical infrastructure for serving and editing geospatial data. WatchTowr observed exploitation attempts beginning within hours of the disclosure, recording hundreds of probes from a small pool of IP addresses. GeoServer released patches in versions 3.0.1, 2.28.5, and 2.27.6 during the week, and the vulnerability was assigned identifier GHSA-mqjf-5f49-2fjh with a CVSS score of 9.8. Mitigation for organizations that cannot immediately patch requires restricting public internet access to GeoServer instances and deploying WAF rules targeting the jsonArrayContains filter function.

What we’re actually watching: GeoServer is not a consumer product. It is critical infrastructure middleware. It manages geospatial data for utilities planning power grid maintenance, environmental agencies monitoring water systems, and government organizations managing land records and transportation networks. An unauthenticated RCE in GeoServer is not a data exposure. It is a direct path into the operational technology-adjacent systems that manage physical infrastructure.

GeoServer shipped patches during the week, but the window between disclosure on August 12 and patch availability created an unmitigated exposure period during which hundreds of probe attempts were recorded. Organizations that cannot confirm they are running patched versions should treat their GeoServer instances as potentially compromised during that window and review logs accordingly. GeoServer has a history of exploitation: a critical flaw in 2024 was weaponized into DDoS botnets and residential proxy networks within days of disclosure.

The CISO question: For every GeoServer deployment in your organization, have you confirmed you are running patched versions 3.0.1, 2.28.5, or 2.27.6, and if your GeoServer instance was internet-accessible between August 12 and when the patch was applied, have you reviewed activity logs for signs of exploitation during that unmitigated window?

El patrón en las cinco historias

Every incident this week exploited something organizations had already trusted and stopped watching.

Metabase held credentials to production databases and nobody had reviewed what a breach of the analytics layer would expose. LiteLLM’s security scanner was trusted with read access to the build environment and nobody had pinned it to a verified version. Snowflake’s customers used the same passwords for years without checking whether those credentials had already been sold. Microsoft’s WinSock driver had a use-after-free flaw that Lazarus Group found before the patch arrived. GeoServer served government infrastructure and was being probed within hours of a researcher posting the exploit on X.

The pattern is not complexity. It is trusted components, left unmonitored, connected to everything. CybelAngel finds what is exposed across your digital ecosystem before someone else finds it first.