The Lyceum: Cyber Intelligence Daily — Aug 04, 2026

The most consequential development is not a new trick but a familiar tool turning against its owners: CISA says attackers are exploiting N-able’s N-central management platform, potentially placing every endpoint behind a compromised server within reach. Elsewhere, researchers are finding durable account access inside passkey synchronization, malware hidden in browser-cached images, and another reported wave of COLDCARD thefts—three reminders that trusted plumbing is where attackers increasingly prefer to live.

• CVE-2025-32463 — sudo on Linux: patch available; CVSS 9.3; an updated public exploit can elevate a local user to root through vulnerable chroot handling.
• CVE-2025-33073 — Microsoft Windows SMB Client: patch available; CVSS 8.8; newly updated proof-of-concept code demonstrates NTLM reflection that can lead to privilege escalation.
• CVE-2025-24071 — Microsoft Windows archive handling: patch available; no CVSS score appears in the supplied backbone; refreshed public code can trigger an NTLM credential leak through a crafted RAR or ZIP archive.

Recency check: the supplied Fortinet, Langflow, and Microsoft Office CVE-2026-21509 items contained no verifiable new event inside this edition’s 24-hour window. The CL0P item was a June roundup, so none are recycled as fresh news.

CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog on Monday, confirming that attackers are abusing the N-able N-central authentication bypass. The federal remediation deadline remains active through Thursday, August 6; the structured CVE record does not yet carry an NVD score.

N-central lets managed service providers administer large fleets of customer devices. N-able says attackers gained administrative access and abused its Take Control feature, meaning a compromise can extend from one management server to the endpoints it controls. Hosted customers received the correction from N-able; self-hosted customers need the company’s hotfix. (thehackernews.com)

If remediation works, defenders should see exploitation collapse around upgraded servers and clean forensic reviews. If suspicious remote-control sessions, Cloudflared services, or persistence continue after upgrades, this stops being a patch story and becomes a downstream managed-service-provider incident—one that customers cannot safely outsource back to the party being investigated.

Palo Alto Networks’ Unit 42 published three post-compromise techniques—collectively called Pass-the-Passkey—that abuse Google Password Manager’s synchronized passkeys on Windows. According to Unit 42, malware already running as an ordinary user could sign into protected accounts without a visible fingerprint or PIN prompt, add an attacker-controlled passkey, or recover secrets used to protect synchronized credentials.

That prerequisite matters: passkeys have not suddenly become remotely phishable. The research instead shows that once Windows is compromised, browser synchronization can transform temporary device access into reusable account access from another machine. Google removed one exposed secret from Chrome logs after disclosure, while eBay fixed a validation issue used in a demonstration; Unit 42 says relevant material may still appear briefly in Chrome memory.

Successful hardening would bind sensitive passkey operations more tightly to fresh user verification and make new credential enrollment conspicuous. Failure will look like account takeovers continuing after an infected computer has been cleaned—the attacker has already carried the identity elsewhere.

Russian publication Xakep reports that blockchain observers identified a fourth wave of transactions on August 3 involving Bitcoin addresses generated by affected COLDCARD firmware. Xakep cites Galaxy Research’s Alex Thorn, who estimated that an attacker attempted to move roughly 1,816 bitcoin from more than 5,200 addresses, worth about $114 million. (Not Yet in English: Reported COLDCARD Theft May Have Reached $114 Million)

That remains a blockchain-analysis estimate, not a confirmed victim-by-victim loss total. The underlying failure is clearer: affected firmware could generate wallet seeds with predictable software randomness. Installing corrected firmware protects newly created wallets, but it cannot repair an old seed; exposed owners must create an entirely new seed and move their bitcoin. (Not Yet in English: Reported COLDCARD Theft May Have Reached $114 Million)

The recovery path succeeds if vulnerable wallets migrate before another coordinated sweep. Another large wave—or withdrawals from wallets that owners believed were safe after merely updating firmware—would show that compromised seeds are circulating as reusable criminal inventory rather than remaining with one operator. (Not Yet in English: Reported COLDCARD Theft May Have Reached $114 Million)

BleepingComputer reports that a Russian loader-as-a-service called DOUBLECUP is using ClickFix lures to conceal malicious code inside PNG images stored in browser caches. A booby-trapped page can retrieve and reconstruct that code later, delivering CountLoader to Windows and macOS or the DeviceManager remote-access trojan to Windows.

The clever part is not the picture; it is the absence of an obvious executable download. DOUBLECUP turns routine browser storage into a staging area, potentially slipping past controls built to scrutinize attachments and newly downloaded programs rather than data reconstructed from cached content.

Defenders win if endpoint products reliably connect the lure, cache access, reconstruction, and execution into one detection chain. Failure will be visible when other malware services copy the method and cached-image reconstruction becomes a standard evasive step rather than DOUBLECUP’s distinguishing trick.

Xakep reports that developers located in countries under sanctions will not have to complete Google’s developer-verification process. The report matters because verification rules shape who can distribute software and how strongly an identity can be tied to a publisher; exemptions may create uneven trust signals across the same ecosystem. Google’s precise implementation and abuse controls will determine whether this is a narrow accessibility measure or a meaningful verification gap. Source: Xakep — Russian. No English-language coverage confirmed at time of publication.

Xakep reports that Google corrected 1,442 vulnerabilities across Chrome’s three latest versions. The figure is an aggregate rather than evidence that 1,442 critical bugs suddenly appeared, but it illustrates the volume hidden behind routine browser updates. For defenders, the practical issue is whether managed Chrome fleets are updating continuously enough to absorb that repair rate without waiting for occasional emergency campaigns. Source: Xakep — Russian. No English-language coverage confirmed at time of publication.

An MSP console became a skeleton key, a passkey quietly packed its bags for another computer, and a PNG in the browser cache turned out to have a second job.

Chrome apparently fixed 1,442 bugs across three releases, which is either admirable maintenance or a browser whispering, “Please stop counting.”

Keep the logs; distrust the lobby Wi-Fi.

Forward this to the person who still thinks the browser cache is harmless clutter.