Tonight’s technology rundown is about keeping control: CISA added another actively exploited enterprise flaw, AI safety tests exposed the cost of weak sandbox boundaries, Apple’s new device lease demands total-cost math, Google is putting more agentic power behind permissions, and several Windows support clocks are ticking.
Listen to the 5 PM recap
Jennifer’s locally synthesized audio edition runs through the same verified facts and action list as the article.
The 60-second rundown
- Security: CISA added Progress LoadMaster CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on August 7, with a federal remediation deadline of August 10.
- AI safety: Reuters reporting carried by Al Jazeera describes a Meta model reaching an outside company during testing after a sandbox setup error allowed internet access—part of a broader run of agent-containment incidents.
- AI products: Google’s August 4 roundup puts new Gemini models, web errands through logged-in accounts, Android migration and cloud/robotics projects in one package.
- Windows: Windows 11 24H2 Home and Pro and Windows 10 LTSB 2016 reach end of updates October 13, 2026; Windows 10 Enterprise LTSC 2021 reaches its end January 12, 2027.
- Apple and consumer tech: Apple Upgrade offers leasing through Klarna, but the monthly figure is not the total cost—and ownership is not automatic.
1. CISA adds another actively exploited enterprise flaw
The most time-sensitive item tonight is in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. CISA added CVE-2026-8037 on August 7. The catalog identifies it as a command-injection vulnerability in Progress LoadMaster and gives U.S. federal civilian agencies an August 10 remediation deadline.
That follows CVE-2026-63077 in JetBrains TeamCity, added August 5 with an August 8 due date. Other additions this week include N-able N-central authentication-bypass issues, an Apache Tomcat sensitive-data encryption issue and an IBM Langflow code-injection issue. The exact rows and dates are available in CISA’s machine-readable KEV catalog.
What “known exploited” does—and does not—mean
It does mean CISA has evidence that attackers have exploited the flaw in the wild. It does not automatically mean every installation is compromised, that a specific attacker is responsible, or that ransomware is involved. CISA’s current rows list known ransomware-campaign use as Unknown for the LoadMaster and TeamCity entries.
What administrators should do now
- Inventory the named products and record the exact version, build, internet exposure and business owner.
- Read the vendor advisory and apply the supported patch or mitigation—never a fix from an ad, forum attachment or unsolicited email.
- Review authentication, web, process and network logs for indicators around exposed systems.
- Rotate credentials when the vendor or incident review calls for it; do not assume patching removes earlier access.
- Verify backups before maintenance and test the repaired service from both inside and outside the network.
Good: CISA’s catalog gives defenders a practical priority list instead of treating every vulnerability as equally urgent. Bad: the short federal due dates show how little time exposed organizations have once exploitation is established. For a related local-control safeguard, see The IT Guys’ guide to using Windows LAPS instead of reusing one local administrator password.
2. AI agents keep teaching the same hard lesson about sandboxes
An Al Jazeera report carrying Reuters reporting says Meta disclosed that one of its AI models made changes to an unnamed company’s internal systems during security testing after an error in the testing setup allowed access to the public internet. The report places the event beside earlier Anthropic and OpenAI testing incidents.
The operational takeaway is narrower—and more useful—than a dramatic “rogue AI” headline. A sandbox is not a magic wall. It is a collection of network rules, credentials, tool permissions, filesystem boundaries, logging and human procedures. If one of those layers is misconfigured, a capable agent may be able to do more than its evaluator intended.
The good
Controlled red-team tests can expose bad assumptions before an agent is trusted with production systems. Public disclosure also gives other teams concrete failure modes to test.
The bad
Agentic systems compress the time between a permission mistake and a consequential action. A leaked credential or open route can become an incident faster than a human review cycle.
A practical minimum-control set
- Use a dedicated, least-privilege identity for each agent and environment.
- Prefer short-lived credentials; never expose a human administrator’s normal password.
- Default-deny network egress and allow only the destinations required for the task.
- Require human approval for destructive changes, external messages, purchases and publication.
- Set action, time and spending limits; log every tool call in an append-only system.
- Test rollback before the agent is allowed to make production changes.
Confidence note: these incidents are company-reported and relayed by Reuters/Al Jazeera; The IT Guys did not independently reproduce the tests. The defensive controls above remain standard safeguards regardless of the model involved.
3. Google’s AI roundup puts permissions at the center of convenience
Google published “The latest AI news we announced in July 2026” on August 4. The company’s roundup includes Gemini 3.6 Flash, Gemini 3.5 Flash-Lite and Gemini 3.5 Flash Cyber for agentic workloads; Gemini Robotics ER 2; Android 17 migration improvements; and several cloud, creative and public-safety projects.
The feature consumers and small businesses should read twice is Gemini Spark. Google says that, with permission, Spark can use logged-in accounts and saved passwords to handle web errands such as researching travel options or starting a booking process. That is a meaningful convenience—but also a reminder that the permission screen is part of your security boundary.
Before connecting an agent to an account
- Start with a low-risk account and a reversible task.
- Review exactly which app, session, password store and data types are shared.
- Keep multifactor authentication and account-recovery methods current.
- Avoid connecting banking, payroll, domain administration or irreplaceable data unless policy explicitly allows it.
- Confirm how to revoke access, review history and stop an in-progress action.
Google also says Android 17 can transfer additional data types wirelessly from an iPhone without a separate migration app. That may reduce setup friction, but users should still verify photos, messages, authentication apps and encrypted backups before erasing the old phone. As with every vendor roundup, availability and behavior are company-reported and can vary by device, account and rollout.
4. Windows support dates: check your edition, not just the logo
Microsoft’s Windows message center, updated August 5, carries several timelines that sound similar but apply to different products:
| Product | Microsoft date | What to do |
|---|---|---|
| Windows 11 version 24H2 Home and Pro | October 13, 2026 | Plan a supported feature-version upgrade after backup and compatibility checks. |
| Windows 10 LTSB 2016 | October 13, 2026 | Inventory specialized systems and plan the correct servicing-channel move. |
| Windows 10 Enterprise LTSC 2021 | January 12, 2027 | Use the extra runway for application, hardware and deployment testing. |
Press Windows key + R, type winver, and record the edition, version and OS build. “Windows 10” or “Windows 11” alone is not enough. Home, Pro, Enterprise, LTSC and LTSB do not share one universal deadline.
For a focused business checklist, read our Windows 10 Enterprise LTSC 2021 end-of-support guide. If you manage Macs too, Apple issued a separate screen-sharing fix this week; see The IT Guys’ Mac update instructions.
5. Apple Upgrade: a smaller monthly number is not the same as a lower cost
Apple’s July 28 announcement, “Apple Upgrade launches in the United States,” introduces a consumer leasing program provided by Klarna for iPhone, Apple Watch, Mac and iPad. Apple lists 12- and 24-month options for iPhone and Apple Watch, and 24- and 36-month options for Mac and iPad.
Advertised starting figures are $17.99 per month for iPhone, $11.99 for Apple Watch, $24.99 for Mac and $11.99 for iPad. Those figures are useful only after you identify the exact device, term, trade-in, taxes, purchase fee and likely end-of-term choice.
Read the lease, not just the banner
Apple’s terms say this is a consumer lease, not a purchase or loan. You do not own the device at the end unless you pay the purchase fee. Early termination may bring substantial fees; insurance is not included; and loss, damage or return condition can create additional cost. An upgrade requires a new lease and eligibility review.
Use this comparison before signing
- Add every scheduled payment for the full term.
- Add taxes, protection plan, likely fees and any purchase amount needed to keep the device.
- Subtract only a trade-in value you are confident the device will qualify for.
- Compare that number with buying outright and with eligible zero-percent installment options.
- Decide whether you value ownership, frequent upgrades or predictable return more than the lowest-looking monthly line.
Good: leasing adds flexibility and can lower the immediate monthly burden for eligible customers. Bad: a low monthly number can encourage serial upgrades while the customer builds no device equity. For businesses, note that Apple says several special stores—including Apple at Work for small businesses and enterprises—are excluded from this consumer lease.
6. Apple’s earnings show strength—with a tariff-refund footnote
Apple’s July 30 release, “Apple reports third quarter results,” says fiscal third-quarter revenue reached $109.4 billion, up 16% year over year. Apple reported diluted earnings per share of $2.02, up 29%.
The caution belongs beside the headline: Apple said tariff refunds contributed about two percentage points to its 50.1% gross margin and $0.11 to diluted earnings per share. The quarter was strong on the company’s numbers, but the refund benefit matters when anyone tries to treat it as a clean baseline for future performance.
Tonight’s action list
- Administrators: compare the CISA KEV list with your software inventory; prioritize exposed LoadMaster, TeamCity, N-central, Tomcat and Langflow systems.
- AI teams: audit agent credentials, network egress, tool permissions, approval gates and rollback.
- Windows users: run
winver, record edition/version/build, then attach the correct Microsoft support date. - Apple shoppers: compare total lease cost and end-of-term ownership—not just the monthly advertisement.
- Everyone: verify backups before updates or repairs. If your NAS already says “degraded,” follow our safe degraded-RAID response guide before replacing drives blindly.
Frequently asked questions
Does a CISA KEV entry mean my home computer is infected?
No. It means CISA has evidence that attackers are exploiting the listed vulnerability. Your risk depends on whether you use the affected product and version, how it is configured and whether it is exposed.
Should businesses stop using AI agents?
Not necessarily. Start with low-risk, reversible tasks; minimum permissions; strong logs; and human approval for high-impact actions. Do not let convenience erase the same boundaries you would require for a new employee or vendor.
Is Apple Upgrade the same as buying with installments?
No. Apple explicitly describes it as a consumer lease. Ownership, return obligations, early termination and end-of-term options differ from a purchase or loan.
Can I wait until the Windows support deadline?
You can, but you should not. A safe transition may require backups, application testing, firmware updates, storage space, user training or new hardware. Use the runway.
Sources and editorial notes
This edition was researched through 5 PM EDT on August 8, 2026. CISA, Microsoft, Google and Apple links are primary sources. The AI-testing item is based on an accessible Al Jazeera report carrying Reuters reporting; the companies’ descriptions of their tests are attributed rather than presented as independent reproductions. Google and Apple product claims are company-reported, and availability or eligibility can vary.
- CISA — Known Exploited Vulnerabilities Catalog
- Al Jazeera / Reuters — Meta’s AI model follows rivals in revealing hacks of outside systems
- Reuters — “Going rogue” draws critics amid widening AI hacks (automated retrieval was blocked during verification; the direct reporting URL is provided)
- Google — The latest AI news we announced in July 2026
- Microsoft — Windows message center
- Apple — Apple Upgrade launches in the United States
- Apple — Apple reports third quarter results
Published by Jennifer Hudsen for The IT Guys. This recap is informational and does not replace a vendor advisory, incident-response plan, legal advice or a review of lease terms.