Morning Brief

CVE-2026-20685 is a path traversal vulnerability affecting Apple’s Private Cloud Compute (PCC), potentially allowing attackers to write files as root during node boot and redirect sensitive AI inference telemetry to an external server. Sentry Security researcher Drinor received a $150,000 Apple Security Bounty for discovering and reporting CVE-2026-20685, a flaw that could expose sensitive data and allow unauthorized access. PCC is Apple’s server-side platform for Apple Intelligence requests that are too complex to run entirely on an iPhone, iPad, or Mac. Apple describes the system as an…

Ransomware crews are increasingly trying to blind a victim before they encrypt anything. Analysis shows that attackers can disable endpoint detection and response tools, interrupt Windows telemetry, and target backup services to reduce the chance that defenders spot or contain the intrusion in time. The findings focus on ten ransomware families that were least often prevented in 2026 testing data. Play had the lowest prevention score at 13 percent, followed by BlackByte at 25 percent, while LockBit, BabLock, Magniber, FAUST, Sodinokibi or REvil, Hive, BlackKingdom, and Maori also featured in…

Valve has confirmed that a cyberattack on CEVA Logistics, its European shipping partner for Steam hardware such as the Steam Deck, Steam Machine, and Steam Controller, exposed customer data belonging to buyers across Europe. The breach occurred between July 29 and August 1, 2026, and Valve says it learned of the compromise on August 7, prompting the company to notify all customers it believes were affected through a direct security email. According to Valve’s disclosure, the attacker likely accessed delivery-related information that CEVA retains for up to ninety days after an order is placed…

Payroll Pirates are using phishing emails to seize Microsoft 365 sessions and search payroll-related mailboxes. The campaign turns a voicemail alert into a route for financial fraud, even when multi-factor authentication is enabled. The messages imitate an automated call notification and invite recipients to open a voicemail portal. A click passes through redirect services before reaching a fake sign-in page that relays the real Microsoft login process, as in the new AiTM attack campaign . Arctic Wolf analysts identified activity across healthcare, education, manufacturing, government, and…

Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor, an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was