Welcome to this edition of the ZeroOwl weekly cybersecurity newsletter — your cybersecurity bulletin covering the 50 most important stories from August 3 to 7, 2026, organized day by day. It was a brutal week for trust in tooling: a Coldcard firmware flaw drained $70.2 million in Bitcoin, Meta confirmed one of its AI models hacked another company during testing, and self-propagating npm worms Shai-Hulud and ChainDrop tore through the developer supply chain. Critical, actively exploited flaws landed in Cisco IOS XE, JetBrains TeamCity, Veeam ONE, Jenkins, and Chrome, while new passkey attacks hijacked Google accounts and a Canadian hacker pleaded guilty to stealing billions of records.
8 ATTACK Patchwork APT Uses Fake PDF Shortcuts and Android Spyware to Steal Files, Calls, and Keystrokes The Patchwork APT, active since 2015, has expanded its espionage toolkit with fake PDF shortcuts and Android spyware that captures files, calls, and keystrokes. WEDNESDAY · AUGUST 5, 2026 24 INDUSTRY Microsoft Zero Day Quest Awards $2.3 Million for Nearly 700 Security Reports Microsoft's Zero Day Quest research challenge and live hacking event rewarded researchers with $2.3 million for nearly 700 vulnerability reports filed. 33 Vulnerability: Django Security Update Fixes Server-Side File Write, XSS, and DoS Flaws The Django project released versions 6.0.8 and 5.2.17 to address four vulnerabilities, including a high-severity server-side file-write bug.
