AI featured on both sides of today's incidents. Federal agencies warned that threat actors are using AI-generated Python scripts to scan for and exploit exposed Siemens S7 Series PLCs across water, energy, and manufacturing environments, while Cisco Talos assessed that the Chinese-speaking UAT-10147 likely used AI-assisted development to build its SPECTRE implant and Specter rootkit. AI systems were also targeted directly: Adversa AI's Cryptographic Context Injection technique embedded instructions in encrypted text that guardrails could not inspect, causing Grok to decrypt and follow attacker-controlled instructions and exfiltrate a user's chat history without a click. The same technique also bypassed Gemini's safety controls.

Software supply-chain attacks continued to use compromised packages and dependencies to deliver malware. A compromised maintainer account poisoned three widely used Rust crates — arrayref, internment, and append-only-vec, with a combined 264 million downloads — by adding a typosquatted dependency whose build script fetched malware during compilation. CloudSEK's BRIDGEHEAD campaign used a different delivery mechanism: 40 npm packages impersonating popular JavaScript libraries detected when installed inside Windows Subsystem for Linux and then used WSL as a bridge to drop a Windows cryptocurrency and credential stealer.

Attackers compromised a maintainer account to publish malicious versions of arrayref, internment and append-only-vec, three popular Rust crates with a combined 264 million downloads. The poisoned releases added a typosquatted dependency, proc-macro1, whose build script decoded a hidden server address and silently downloaded and executed malware during compilation, using a connection with no certificate validation. All malicious versions have been deleted from crates.io, affected accounts locked, and clean releases restored, though the roughly 90-minute exposure window may have infected build systems that resolved the packages.

CloudSEK uncovered a 40-package npm typosquatting campaign, dubbed BRIDGEHEAD, that impersonated popular libraries including chalk, axios and lodash. Install scripts detected Windows Subsystem for Linux environments and downloaded a Rust-based Windows executable, disguised with 22 megabytes of encoded hexadecimal text, that ran entirely in memory. The stealer targeted twenty-six cryptocurrency wallets, Chromium browser credentials, and Telegram sessions, uploading findings to the file-sharing service gofile.io.

Researchers at Adversa AI disclosed Cryptographic Context Injection, which hides instructions as encrypted text so guardrails cannot inspect them, then has the model decrypt and trust the payload internally. Against Grok, the technique achieved zero-click exfiltration of chat history and session data during a routine page-summarisation request. Against Gemini, it bypassed safety filters to produce restricted content; the Grok flaw remains unfixed since being reported to xAI in June 2026.

Cisco Talos identified UAT-10147, a Chinese-speaking threat actor, deploying SPECTRE, a cross-platform backdoor targeting IIS and Linux servers. The Windows variant uses BYOVD techniques with vulnerable drivers to disable EDR tools, while the Linux variant loads a kernel rootkit called Specter via ftrace hooking for stealth. Talos assesses portions of the malware likely involved AI-assisted code generation, alongside SEO fraud tools and multiple commodity backdoors.

CISA, NSA, FBI and other agencies warned of active reconnaissance against Internet-exposed Siemens S7 Series PLCs across US critical infrastructure sectors. Threat actors use AI-generated Python scripts built on the snap7 library to mimic legitimate monitoring tools, exploiting default credentials and unpatched devices. The activity spans Critical Manufacturing, Energy, Water and Wastewater, and other sectors, and is assessed as likely preparation for future disruptive operations.

Datadog Security Research analysed N4D Mesh Controller, a Linux malware campaign exploiting exposed Model Context Protocol servers to steal credentials and gain persistent access. A newer UPX-packed agent, dubbed "go-titan", enumerates MCP tools, invokes command-execution functions, and scans thousands of hosts for databases, containers and AI infrastructure. The malware installs multiple persistence mechanisms, including cron jobs and SSH keys, and communicates with rotating command-and-control infrastructure.

Google Threat Intelligence Group detailed three suspected Russian espionage clusters, UNC6293, UNC7005 and UNC5976, targeting academics, diplomats and defence personnel through abused authentication flows. The groups use app password phishing, OAuth token theft, and device code phishing, with UNC7005 also linked to hospitality captive portal redirects and malware such as VIDAR and ATOMIC infostealers. All three clusters are assessed with high confidence to have a Russian nexus, sharing tactics traced to earlier ICE RELIC operations.

CVE-2026-32475, a critical flaw in Elementor Pro's Forms module, lets unauthenticated attackers upload PHP files and execute code on WordPress sites. The bug arises from inconsistent file validation across two separate processing loops, letting attackers bypass extension checks. Elementor Pro versions up to 4.2.1 are affected, with a fix available in version 4.2.2, released 19 August 2026.

Citrix disclosed CVE-2026-19489, a memory overflow affecting NetScaler ADC and Gateway with SIP ALG enabled on large-scale NAT configurations, causing denial of service. CVE-2026-19490 is an authentication bypass affecting Gateway and AAA virtual servers, with applicability depending on firmware version and SAML Action configuration. Fixed builds are available, and Global Deny List signatures offer interim mitigation on supported firmware versions.