Case-board summary

Tonight’s risk at a glance

Tonight’s risk board — accessible text equivalent

• Oracle CVE-2026-21962: CISA lists active exploitation and an August 27 federal remediation due date; apply Oracle’s supported fix or approved mitigation for the affected component. [067][068][069]
• miniOrange SAML: Patchstack reports exploitation; preserve logs, sessions, plugin bytes, timestamps, and configuration before updating the exact edition and reviewing privileged activity. [056][063][065]
• NemoClaw CVE-2026-65105: NVIDIA published a bulletin; update affected Linux installations, keep raw Ollama loopback-only, and do not infer field exploitation from the reviewed record. [007][008][020]
• marimo CVE-2026-75149: opening an untrusted notebook in edit mode can launch configured MCP commands before cells run; use 0.23.15 or later and treat notebooks as code. [031][032][037]

Evidence-preserving response sequence — accessible text equivalent

1. Preserve time-sensitive logs, session records, relevant files, timestamps, and configuration before cleanup or updates change them. [056][065]
2. Contain or isolate affected systems and accounts without unnecessary evidence destruction. [047][049]
3. Scope the affected products, editions, identities, systems, and downstream actions. [056][068]
4. Revoke affected sessions and access, and rotate exposed credentials from a known-clean system. [003][047]
5. Patch the exact affected product and edition, or rebuild from known-good sources when integrity cannot be established. [056][068]
6. Recover service and verify fixed versions, loaded binaries, listener boundaries, account state, and clean behavior. [008][069]
7. Monitor for recurrence and document the evidence, decisions, gaps, and validation results. [003][054]

Case one: sanctions, indictments, and the discipline of the word “alleged”

What happened

On August 24, OFAC added Saber Shahbazi Balujeh, Keyvan Fayyaz Ghareh Blagh, Mojtaba Ghal’eh-Kuhi, Mohammad Reza Kadkhoda’i, and Arman Kahzadian to the Specially Designated Nationals list. [002] [001]Four of those five—not Kadkhoda’i—also appear among the 17 defendants in an August 18 superseding indictment. [001] [003]

Treasury attributes a six-person cluster, including previously sanctioned Behzad Mesri, to network exploitation conducted for or benefiting Iran’s Ministry of Intelligence and Security. [001]The release does not publish the technical evidence behind that attribution. [001]

Timeline and evidence

DOJ says the superseding indictment contains 14 counts and alleges activity dating to at least 2013. [003]Its university allegations include more than 100,000 professor accounts targeted, about 8,000 compromised accounts, and about 31.5 terabytes exfiltrated through at least December 2017. [003]

Treasury alleges that three actors compromised and exfiltrated data from U.S. organizations in energy, defense-industrial, healthcare, IT, and finance since at least late 2023, and compromised government offices in summer 2024. [001] [005]CyberScoop corroborates the existence and framing of the government action, but its intrusion details still trace back to Treasury rather than separate forensics. [005] [001]

Exposure and in-the-wild status

The official account describes spearphishing, credential theft and reuse, password spraying, mailbox and system access, reconnaissance, and data exfiltration as alleged tradecraft. [003]The State Department offers up to $10 million for qualifying information leading to the location of five named people; it is a conditional ceiling, not a guaranteed payment per person. [003] [004]

Unknowns

No reviewed source establishes arrests, guilty pleas, convictions, named critical-infrastructure victims, or a measured operational reduction following the sanctions. [001] [003]TRM Labs reports about $16.8 million in aggregate inflows to 30 listed crypto addresses, but inflows are not automatically stolen funds, profit, or current holdings. [006] [002]

Local practical relevance and audience separation

Homes: use phishing-resistant MFA on primary email and distrust recovery prompts. Small businesses: watch password-spray patterns, new forwarding rules, OAuth grants, and bulk downloads. Critical-infrastructure and regulated teams: separate IT from operational technology and send possible sanctions matches to qualified counsel; a blockchain proximity match is not a legal conclusion.

Actions, detection, and recovery

Apply the evidence-preserving response order below; adapt it to business continuity and legal requirements rather than performing destructive cleanup first.

For the sanctions case, prioritize identity, email, VPN, cloud, endpoint, proxy, and transfer telemetry; act on verified credential abuse without treating government attribution allegations as convictions. [001][003]

Good news

The published tradecraft is behavior defenders already know how to reduce: strong identity controls, least privilege, segmented administration, and long-lived audit records.

Bad news

The official releases provide almost no technical indicators, so organizations cannot turn the government’s attribution into a clean signature.

Confidence

Confidence is high in the legal and sanctions events and moderate only in the sense appropriate to official allegations. Confidence is insufficient to turn any charge into a conviction or any government attribution into independent technical proof.

Case two: the local AI service was not as local as it looked

What happened

Oasis/Cyera demonstrated a browser-originated DNS-rebinding chain that reached an unauthenticated Ollama API configured by NemoClaw and altered a model chat template so hidden instructions persisted into later inference. [007] [019]NVIDIA then published CVE-2026-65105, rated High at CVSS 8.1 and classified CWE-306. [008] [009] [010]

Timeline and evidence

NVIDIA’s official CVE scope covers NemoClaw on Linux from version 0 through 0.0.25. [008] [009] [010]The bulletin identifies commit f06796ff340f5d29da5aa2b3b2a86cad786066e5 as remediation, moving raw Ollama to 127.0.0.1:11434 and placing a token-authenticated proxy on port 11435. [008] [010] [014]

The bulletin’s version table is ambiguous at 0.0.25 because the affected endpoint and updated version string collide, so a current supported release and live listener verification are safer than version-string reasoning alone. [008] [010]The newest tagged release at cutoff was v0.0.114. [013]

Exposure and in-the-wild status

The dangerous condition is an unauthenticated raw Ollama listener reachable beyond the intended trust boundary; a browser on the same workstation can matter even when an external firewall blocks LAN traffic. [007] [011] [015]Current NVIDIA documentation treats Windows-host Ollama reached through WSL differently and documents an unauthenticated wildcard listener without the authenticated reverse proxy. [011] [012]No substantiated malicious in-the-wild exploitation was found by cutoff, and the CVE was absent from CISA KEV. [007] [020]

Unknowns

NVIDIA’s scored impact emphasizes information disclosure and denial of service, while the researcher report describes persistent template poisoning; public sources do not fully reconcile that difference. [007] [008] [009]A fresh conversation alone does not remove the demonstrated alteration because the changed template is a model property applied during inference. [007]

Local practical relevance and audience separation

Homes and hobbyists: a workstation AI service may hold private prompts and tool permissions. Small businesses: an agent tied to source control, cloud, messaging, or customer data makes a local listener an enterprise boundary. Administrators: inspect IPv4, IPv6, WSL, containers, stale processes, and actual bind addresses instead of trusting a diagram.

Actions, detection, and recovery

Apply the evidence-preserving response order below; adapt it to business continuity and legal requirements rather than performing destructive cleanup first.

For NemoClaw, preserve listener state, model inventory, templates, configuration, and logs before changing the installation; keep raw Ollama loopback-only and quarantine models whose integrity cannot be matched to a trusted copy. [007][008][012]

Good news

The safer architecture is concrete and testable: loopback raw inference, authenticated mediation, a current release, and a verified trusted model copy.

Bad news

Platform paths differ, documentation is not fully harmonized, and a poisoned model can carry the problem into a brand-new chat.

Confidence

Confidence is high in the CVE, Linux scope, research demonstration, and remediation architecture. Confidence is lower for platform-general claims and malicious field exploitation.

Case three: better locks arrive, but rollout is not the same as arrival

What happened

WhatsApp announced that one account can hold multiple passkeys, aimed especially at people using both Android and iOS devices. [021] [022] [028]The company also announced an upgrade from the optional six-digit two-step PIN to a password of at least eight characters with a letter and number, plus richer unknown-caller context on Android. [022] [025] [026] [028]

Timeline and evidence

WhatsApp says more than one billion people have set up a passkey for returning to the service. [021] [022] [029]The August 25 pages describe controls as launching or available in present tense, but no country list, completion date, or minimum build was published. [021] [022] [028] [029]

Exposure and in-the-wild status

Passkeys use public-key credentials and are designed to resist phishing, while biometric processing remains on the device. [027] [023]That does not stop abuse of an unlocked stolen device, a compromised recovery channel, malicious linked devices, malware, or a scam that persuades the user to send money. [027] [025]Android’s country and shared-group context is a decision aid, not caller authentication. [022] [028]

Unknowns

The maximum passkey count, complete revocation behavior, provider coverage, global rollout state, and exact all-devices-lost recovery sequence were not published. [021] [022] [023]Current help text is not fully consistent about when a passkey can replace a registration code, so readers should not be promised that every SMS or phone-number check disappears. [023] [024] [026]

Local practical relevance and audience separation

Individuals: secure the phone and credential-manager account before adding more passkeys. Families: do not place an account credential on a device controlled by someone who should not retain the account. Small businesses: record who owns the number, primary device, passkeys, recovery email, password-manager vault, and offboarding process.

Actions, detection, and recovery

Apply the evidence-preserving response order below; adapt it to business continuity and legal requirements rather than performing destructive cleanup first.

For WhatsApp account recovery, preserve suspicious messages and linked-device records, secure the phone number and recovery mailbox, remove unknown linked devices, and use only official support paths. [021][023][025]

Good news

Multiple passkeys can reduce the awkward choice between Android and iOS, and a real password can improve on a predictable six-digit second step.

Bad news

Better authentication cannot authenticate the story told by a scam caller, and phased rollout can leave two people with different controls on the same day.

Confidence

Confidence is high that WhatsApp and Meta announced the features. Confidence is moderate about immediate availability because no independent all-feature hands-on verification or complete rollout schedule was available.

Case four: the notebook could act before the first cell

What happened

CVE-2026-75149 is a high-severity CWE-94 code-injection issue in marimo, scored 8.7 under CVSS 4.0 and 8.8 under CVSS 3.1 by the VulnCheck CNA. [031] [032]A victim must open an attacker-crafted notebook in edit mode on a vulnerable release, but the notebook-supplied MCP command can start as a local subprocess before any cell executes. [031] [032] [034]

Timeline and evidence

The authoritative affected range is lower than 0.23.15, and 0.23.15 is the minimum fixed release. [031] [033] [037] [038]The patch was merged and 0.23.15 published on July 23, while the CVE and CNA advisory appeared on August 19. [031] [032] [035] [036] [037]The current PyPI release at cutoff was 0.24.0, and marimo’s security policy supports only the latest stable release. [039] [040]

Exposure and in-the-wild status

Successful execution inherits the privileges and environment of the local account running marimo. [031] [032]CISA’s August 25 enrichment marked exploitation none, and the CVE was absent from KEV version 2026.08.25. [031] [020]

Unknowns

No authoritative unique indicators or reliable log signature were published to distinguish exploitation from ordinary MCP subprocess activity. [031] [032]The project release notes did not explicitly label the patch as a security fix, and the global GitHub advisory remained unreviewed with no structured package range. [034] [037]

Local practical relevance and audience separation

Notebook users: treat an outside notebook like an executable document, not a passive worksheet. Development teams: inventory virtual environments, workstation installs, containers, and notebook services. Service operators: restrict edit mode and remember that disabling cell execution does not close this path.

Actions, detection, and recovery

Apply the evidence-preserving response order below; adapt it to business continuity and legal requirements rather than performing destructive cleanup first.

For marimo, preserve the notebook and process timeline as static evidence, avoid opening it in a vulnerable editor, update every runtime to at least 0.23.15, and investigate child processes or outbound access. [031][032][037]

Good news

The fixed boundary is clear, a current release exists, and the trigger requires a user to open hostile content in edit mode.

Bad news

The dangerous subprocess can start before the user runs a cell, defeating the comforting assumption that “I only opened it” is harmless.

Confidence

Confidence is high in the trigger, impact boundary, version range, and fix. The exploitation assessment is a dated no-confirmed-evidence snapshot, not a permanent negative.

Case five: package mirrors became rented scenery for a fake checkpoint

What happened

OX Security reported exactly 24 npm package names used to host fake Cloudflare-style verification pages through mirrors such as UNPKG. [041] [042] [043]The stronger interpretation is infrastructure abuse rather than a conventional install compromise: current metadata for 17 original-looking records pointed main to index.html and showed no lifecycle scripts or dependencies. [041] [042] [043]

Timeline and evidence

Registry metadata placed the 17 original-looking records between August 13 and August 24; seven other names had already been replaced by npm security-holding packages. [043]All 24 names still returned registry metadata at cutoff, but metadata presence does not prove that a malicious page remained fetchable from every mirror. [043]A separate 2025 Socket investigation documented 175 packages using a similar npm-plus-UNPKG redirect pattern, corroborating the technique but not this campaign’s actors or outcomes. [046]

Exposure and in-the-wild status

UNPKG documents that package files become available at predictable URLs and that version-pinned content is cached on Cloudflare’s CDN. [044]The relevant danger begins when a browser reaches hosted HTML and a user follows the fake verification flow, especially by running a copied command or entering credentials. [041] [042] [047]Merely finding a package name in metadata or downloading an inert file is not equivalent to endpoint compromise. [041] [042] [043]

Unknowns

No campaign-wide victim count, reliable compromise total, initial lure dataset, or actor identity was verified. [041] [042]The live page, resolver value, redirect destination, and payload were intentionally not visited, so current dynamic behavior remains unverified. [041] [042]

Local practical relevance and audience separation

Ordinary users: the trusted CDN name does not make a fake verification page legitimate. Developers: search lockfiles and SBOMs, but do not confuse package presence with execution. Defenders: preserve legitimate UNPKG use and alert on suspicious direct HTML navigation followed by a shell.

Actions, detection, and recovery

Apply the evidence-preserving response order below; adapt it to business continuity and legal requirements rather than performing destructive cleanup first.

For fake-verification package-CDN abuse, preserve browser and process history, isolate an endpoint if commands ran, scope direct HTML requests and follow-on execution, then revoke affected sessions from a clean device. [041][042][047]

Good news

The package names and browser-to-shell sequence give defenders specific, low-risk places to look without downloading a live payload.

Bad news

A legitimate package CDN can lend reputation and caching to malicious HTML even when the package is not trying to compromise developers during installation.

Confidence

Confidence is high in the enumerated names and current registry metadata. Confidence is moderate in dynamic behavior because the primary page was WAF-blocked and live payload paths were deliberately not replayed.

Case six: the FTP greeting carried instructions, not hospitality

What happened

SOCRadar described two separate clusters, E4del and PINHOLE, that use FTP server greeting banners as dead-drop resolvers supplying commands to a stager or loader. [049] [051] [053]A July 16 MalwareHunterTeam post independently documented a ZIP/LNK lure whose next stage interpreted an FTP greeting as a command, but that post did not name or prove a link to either RAT family. [050] [051]

Timeline and evidence

SOCRadar dates weaponization to early July and reports new infrastructure into August; the independently dated public observation establishes activity by mid-July. [049] [050] [051]SOCRadar calls the technique novel and the RATs previously undocumented, but those historical claims have not been independently exhausted. [049] [053]

Exposure and in-the-wild status

The observed initial artifact was a ZIP containing a disguised shortcut, and execution of that shortcut was required to begin the documented chain. [049] [050] [052]SOCRadar reports E4del as a Node.js RAT inside a modified Electron application and PINHOLE as a multi-stage native chain ending in an injected RAT. [049] [051] [052] [049]

Unknowns

Target lists, delivery emails, success rate, victim geography, actor identity, and whether the two clusters share operators remain unknown. [049] [051]ClickFix was described only as a possible adaptation, not an observed delivery method for E4del or PINHOLE. [049] [051]

Local practical relevance and audience separation

Home users: leave unexpected receipt or voucher archives unopened. Small businesses: block LNK files in mail where practical and verify payment documents through a known channel. Network defenders: outbound FTP from workstations is often unusual enough to make the full chain visible.

Actions, detection, and recovery

Apply the evidence-preserving response order below; adapt it to business continuity and legal requirements rather than performing destructive cleanup first.

For the FTP-banner chains, preserve the archive and endpoint/network timeline without reopening it, isolate suspected execution, scope the shortcut-to-banner-to-loader sequence, and rebuild high-assurance systems when remote-control integrity is uncertain. [049][051][054]

Good news

The chain crosses several observable boundaries: archive, shortcut, legacy protocol, script execution, and later control traffic.

Bad news

Legitimate signed host executables and reputable web services can appear inside the chain without making the substituted application or surrounding behavior trustworthy.

Confidence

Confidence is moderate to high in the shared technique and analyzed capabilities, but most detailed reverse engineering, naming, novelty, and campaign chronology originate with one vendor.

Case seven: one WordPress slug hid seven version lines

What happened

CVE-2026-61979 is an unauthenticated signature-validation weakness scored 8.1 High, while CVE-2026-15981 is an unauthenticated authentication bypass scored 9.8 Critical. [057] [058] [059] [060]For the free edition, 5.4.5 is the first release that closes both named flaws, and WordPress.org offered 5.4.7 at cutoff. [057] [058] [063]

Timeline and evidence

Patchstack’s vendor-supplied matrix covers seven independently versioned editions; for Standard single-site, 17.0.6 or later is required to close both flaws. [056] [065]Paid fixes vary across 13.0.4, 17.0.6, 20.2.8, 26.0.3, 32.0.8, and 35.0.7 depending on edition and topology. [056]

Exposure and in-the-wild status

Patchstack reports opportunistic scanning and a DigitalOcean incident on August 16 in which the bypass produced an administrator session cookie, while trusted-network controls blocked later administrative operations. [056] [065]DigitalOcean reportedly reproduced both paths against Standard edition 16.1.9. [056] [065]Neither CVE appeared in CISA KEV version 2026.08.25, even though Patchstack labels them known exploited in its own database. [057] [058] [066]

Unknowns

No public denominator, request volume, success rate, completed-takeover count, or named actor was published. [056] [065] [066]The paid-edition matrix was not mirrored in the official CVE records or a complete public miniOrange security advisory. [056] [059] [060] [064]

Local practical relevance and audience separation

Site owners: ask the host or developer for the exact edition and installed package version. WordPress administrators: do not trust the dashboard to offer every paid cross-line update. Managed-service providers: inventory multisite and single-site customers separately and preserve privileged-session evidence before forcing logouts.

Actions, detection, and recovery

Apply the evidence-preserving response order below; adapt it to business continuity and legal requirements rather than performing destructive cleanup first.

For miniOrange, preserve web, WAF, load-balancer, WordPress, SAML/IdP, PHP, database, host, plugin bytes, file timestamps, configuration, and session evidence before any update; then contain, scope, revoke affected access, apply the exact edition’s fix, recover and verify, and monitor privileged changes. [056][063][065]

Good news

One published incident shows defense in depth mattered: network restrictions reportedly stopped post-login administration even after a cookie was issued.

Bad news

Shared naming across seven edition lines can make a numerically high paid version look safe to a scanner that only understands the free range.

Confidence

Confidence is high in the free-edition CVEs and credible in the qualified exploitation account. Paid-line scope and telemetry ultimately depend on Patchstack and DigitalOcean provenance.

Case eight: CISA moved an old patch into tonight’s emergency queue

What happened

CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24 and set August 27 as the remediation due date for in-scope federal civilian agencies. [020] [067]CISA’s listing establishes that the agency has evidence meeting its active-exploitation threshold, but it does not disclose victims, actor, payload, success rate, or ransomware use. [020] [067]

Timeline and evidence

Oracle fixed the issue in its January 20 Critical Patch Update and revised the advisory on February 2. [068] [069]CloudSEK reported honeypot requests it classified as attempts from three unique IP addresses between January 22 and February 3, with the first on January 22. [071]Public proof-of-concept code existed by January 21 or 22, but static availability does not prove reliable exploitation against every product and platform. [071] [072] [073]

Exposure and in-the-wild status

Oracle’s affected scope is Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in components for Apache HTTP Server and Microsoft IIS, not every standalone WebLogic Server sharing a release number. [068] [069] [070]Supported affected releases include 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, while the IIS plug-in is affected only at 12.2.1.4.0. [068] [069] [070]Oracle scores the issue CVSS 10.0 with network access, low complexity, no privileges or user interaction, changed scope, high confidentiality and integrity impact, and no direct availability impact. [068] [069] [070]

Unknowns

CISA has not published the incidents behind KEV inclusion, and public evidence does not establish a named actor, victim count, malware family, data-theft event, or successful full-system takeover attributable specifically to this CVE. [020] [067] [068] [071]Exact platform patch identifiers are support-gated in Oracle’s My Oracle Support document KA1396. [068]

Local practical relevance and audience separation

Home users: this is unlikely to be a personally administered component, but a service provider may run it. Small businesses: ask vendors whether the affected HTTP or proxy component exists and which patch inventory is loaded. Enterprise and government administrators: inventory every web tier, standby, container, and disaster-recovery copy immediately.

Actions, detection, and recovery

Apply the evidence-preserving response order below; adapt it to business continuity and legal requirements rather than performing destructive cleanup first.

For Oracle, preserve proxy, web-tier, backend, identity, WAF, and operating-system telemetry before patching; isolate affected paths, scope reachable backends, revoke exposed access, apply the supported branch fix, recover, and verify the patched binary is loaded. [067][068][069]

Good news

The vendor patch has existed since January, and the official scope gives administrators a precise inventory question.

Bad news

KEV inclusion means the wait-and-see period is over, while public incident detail remains too thin to offer a single decisive compromise signature.

Confidence

Confidence is high in KEV status, due date, official product scope, severity, and patch chronology. Claims of console RCE, ransomware, named victims, or full host takeover are not established by the authoritative wording.

Treasure Coast relevance without invented local victims

No reviewed packet establishes that any of these eight developments produced a victim in Port Saint Lucie, Jensen Beach, Fort Pierce, or Vero Beach. Those place names describe The IT Guys’ service context, not threat telemetry.

A Port Saint Lucie family may use WhatsApp and a local AI workstation. A Jensen Beach office may depend on a WordPress SAML plugin. A Fort Pierce nonprofit may receive ZIP archives or fake verification pages. A Vero Beach business may buy a hosted application whose supplier operates Oracle or marimo behind the scenes. Local relevance comes from shared technology and habits, not from manufacturing a local incident.

For ongoing practical coverage, see the verified The IT Guys Cybersecurity archive and Jennifer Hudsen’s author archive.

Do this tonight, then this week

Small-business two-clock plan — accessible text equivalent

1. Preserve time-sensitive evidence first. For miniOrange this includes logs, session records, plugin bytes, file timestamps, and configuration before an update changes them. [056][063][065]
2. Contain or isolate exposed Oracle proxy paths, affected WordPress administration, unexpected AI listeners, and endpoints where a command may have run—without unnecessary destruction. [047][056][068]
3. Scope exact Oracle components, miniOrange editions, NemoClaw/Ollama listeners and models, marimo runtimes, affected identities, and follow-on activity. [008][031][056][068]
4. Revoke affected privileged sessions and access; rotate exposed credentials from a known-clean system. [003][047][056]
5. Patch the exact supported line: the applicable Oracle branch, the correct miniOrange edition, NemoClaw’s supported release, or marimo 0.23.15 or later; rebuild when integrity cannot be established. [008][031][056][068]
6. Recover service and verify running versions, loaded binaries, listener boundaries, privileged account state, and clean behavior. [008][056][069]
7. Monitor and document recurrence, evidence gaps, changes, and validation results; do not run commands from fake verification pages or open untrusted notebook files in edit mode. [031][047]
8. Preserve and test retention for identity, endpoint, browser, proxy, application, and network telemetry. [003][054]
9. Contain unnecessary management exposure, package-CDN direct navigation, and workstation FTP while avoiding blanket blocks that erase useful context. [042][049][054]
10. Scope inventories by running component, edition, version, listener, loaded binary, device owner, and recovery path. [008][056][069]
11. Practice clean-device session revocation and credential rotation for privileged and messaging accounts. [025][047]
12. Patch supported products and rehearse known-good rebuilds; remember that patching is not eviction. [056][068]
13. Recover and verify from the user’s perspective as well as the package manager’s, including account state and actual loaded code. [025][069]
14. Monitor, document, and recheck vendor bulletins, CISA KEV, plugin advisories, and staged feature rollouts before publication or production change. [020][021][056]

Tonight

1. Preserve time-sensitive evidence first. For miniOrange this includes logs, session records, plugin bytes, file timestamps, and configuration before an update changes them. [056][063][065]
2. Contain or isolate exposed Oracle proxy paths, affected WordPress administration, unexpected AI listeners, and endpoints where a command may have run—without unnecessary destruction. [047][056][068]
3. Scope exact Oracle components, miniOrange editions, NemoClaw/Ollama listeners and models, marimo runtimes, affected identities, and follow-on activity. [008][031][056][068]
4. Revoke affected privileged sessions and access; rotate exposed credentials from a known-clean system. [003][047][056]
5. Patch the exact supported line: the applicable Oracle branch, the correct miniOrange edition, NemoClaw’s supported release, or marimo 0.23.15 or later; rebuild when integrity cannot be established. [008][031][056][068]
6. Recover service and verify running versions, loaded binaries, listener boundaries, privileged account state, and clean behavior. [008][056][069]
7. Monitor and document recurrence, evidence gaps, changes, and validation results; do not run commands from fake verification pages or open untrusted notebook files in edit mode. [031][047]

This week

1. Preserve and test retention for identity, endpoint, browser, proxy, application, and network telemetry. [003][054]
2. Contain unnecessary management exposure, package-CDN direct navigation, and workstation FTP while avoiding blanket blocks that erase useful context. [042][049][054]
3. Scope inventories by running component, edition, version, listener, loaded binary, device owner, and recovery path. [008][056][069]
4. Practice clean-device session revocation and credential rotation for privileged and messaging accounts. [025][047]
5. Patch supported products and rehearse known-good rebuilds; remember that patching is not eviction. [056][068]
6. Recover and verify from the user’s perspective as well as the package manager’s, including account state and actual loaded code. [025][069]
7. Monitor, document, and recheck vendor bulletins, CISA KEV, plugin advisories, and staged feature rollouts before publication or production change. [020][021][056]

FAQ

Were all five newly sanctioned Iranian individuals charged in the August 18 case?

No. Four appear in DOJ’s 17-person defendant list; Mohammad Reza Kadkhoda’i does not, and the charges remain allegations. [001] [003]

Does NemoClaw still have no CVE?

No. NVIDIA published CVE-2026-65105 on August 25, making early no-CVE wording stale. [008] [009]

Does a new NemoClaw chat remove the demonstrated poisoning?

No. In the researcher demonstration, the changed template was attached to the model and applied when later chats were rendered. [007]

Are WhatsApp’s new controls available to everyone tonight?

That was not established. WhatsApp announced the features but published no full rollout schedule, country list, or minimum build. [021] [022] [028]

Can marimo be exploited without running a notebook cell?

In the affected edit-mode path, the CNA says the notebook-supplied MCP subprocess can start before cell execution; a user still must open the crafted notebook in edit mode. [031] [032]

Were developers compromised by installing the 24 npm packages?

The reported purpose was hosting and redirects, not a conventional install-script attack; package presence alone is not proof, and the dangerous path is browser interaction plus follow-on execution or credential entry. [041] [042] [043]

Are the miniOrange flaws in CISA KEV?

Not in catalog version 2026.08.25. Patchstack uses its own known-exploited label and reported credible exploitation evidence; that terminology must not be confused with CISA’s catalog. [057] [058] [066]

Does Oracle CVE-2026-21962 affect every WebLogic server?

No. Oracle’s published scope centers on Oracle HTTP Server and WebLogic Server Proxy Plug-in components in listed releases and reachable via HTTP. [068] [069] [070]

When is rebuilding preferable?

After preserving evidence, prefer a trusted rebuild when remote control, privileged administration, model or binary integrity loss, unknown follow-on payloads, or missing telemetry prevents a defensible clean bill of health.

Methodology and reporting cutoff

This frozen candidate uses the eight same-day qualifying editorial subjects in the local candidate ledger. The Hacker News served only as discovery provenance; central claims were reconstructed from the eight independent research packets, official advisories, CNA records, government actions, vendor research, registry metadata, and identified corroborators. The ANY.RUN promotional Mirage2FA card and SANS course-promoting contribution were excluded by the frozen candidate gate.

The reporting cutoff is 7:43:09 p.m. EDT on August 25, 2026 (23:43:09 UTC). I treated every point-in-time release, live registry status, rollout state, and KEV statement as needing a future publication recheck. I did not retrieve malware, visit live malicious redirects, execute public exploit code, or infer victims. Counts retain their units: packages are not installations, panel events are not victims, crypto inflows are not stolen profit, and federal due dates are not universal private-sector mandates.

Consequential sentences carry numbered links immediately beside them. The private claim ledger maps those sentences to the same source IDs, while the source ledger preserves exact titles, canonical URLs, displayed or metadata dates, source type, accessed time, and use. Internal links are limited to canonical URLs present in the frozen WordPress context.

Sources

1. [001] Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day — August 24, 2026 (date only; no publication time displayed); Primary source — U.S. Department of the Treasury press release.
2. [002] Removal of Syria’s designation as a State Sponsor of Terrorism and Associated Sanctions List Updates; Iran-related Designations; Updates to Iran-related General Licenses — August 24, 2026 (date only; no publication time displayed); Primary source — OFAC Recent Action and SDN List updates.
3. [003] 17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities — August 18, 2026, 1:47:35 p.m. EDT; modified 1:50:36 p.m. EDT; Primary source — U.S. Department of Justice press release describing a superseding indictment.
4. [004] Foreign Malicious Cyber Activity Against U.S. Critical Infrastructure — Undated live reward page; the Mabna-related offer was announced by DOJ on August 18, 2026; Primary source — U.S. Department of State Rewards for Justice.
5. [005] Treasury sanctions alleged Iranian hackers as part of ‘economic D-Day’ — August 24, 2026, 19:06:12 UTC; modified August 25, 2026, 13:48:53 UTC; Independent corroborator — CyberScoop.
6. [006] Operation Economic Outcast: Treasury Sanctions Nearly 60 Iran-linked Targets and Names Digital Assets a Sanctionable Sector — August 24, 2026 (date only; no publication time displayed); Independent specialist analysis — TRM Labs blockchain intelligence.
7. [007] Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning — 2026-08-25; primary threat-research report by Oasis Security/Cyera.
8. [008] Security Bulletin: NVIDIA NemoClaw and OpenShell – August 2026 — 2026-08-25; official NVIDIA security bulletin.
9. [009] CVE-2026-65105 record — 2026-08-25T20:15:33.598Z; official CVE Program record assigned by NVIDIA.
10. [010] NVIDIA product-security bulletin 5872 source — 2026-08-25; official NVIDIA machine-readable/security-bulletin repository.
11. [011] Set Up Ollama — retrieved 2026-08-25; page has no displayed publication date; official current NVIDIA NemoClaw documentation.
12. [012] NemoClaw SECURITY.md — Ollama Auth Proxy Loopback Bind Probe — repository state reviewed 2026-08-25; official pinned NemoClaw repository security documentation.
13. [013] NemoClaw v0.0.114 tag — 2026-08-24; official current tagged NemoClaw release.
14. [014] NemoClaw fix commit: bind Ollama to localhost with authenticated proxy — 2026-03-23; official NVIDIA remediation commit referenced by the security bulletin.
15. [015] Ollama current allowed-host middleware — 2026-08-25; official pinned Ollama source.
16. [016] NemoClaw — retrieved 2026-08-25; page has no displayed publication date; official Ollama integration documentation.
17. [017] Technical Advisory – Ollama DNS Rebinding Attack (CVE-2024-28224) — 2024-04-08; primary historical security advisory.
18. [018] CVE-2024-28224 — 2024-04-08; NVD vulnerability record.
19. [019] A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw — 2026-08-25; independent specialist report.
20. [020] CISA Known Exploited Vulnerabilities Catalog — checked 2026-08-25; official exploitation-status catalog.
21. [021] One billion people are now protected with passkeys on WhatsApp, plus more account security features — 2026-08-25; first-party WhatsApp announcement.
22. [022] New Account Security Features for WhatsApp — 2026-08-25; first-party Meta newsroom announcement.
23. [023] About passkeys — undated; accessed 2026-08-25; first-party WhatsApp Help Center.
24. [024] Create a passkey — undated; accessed 2026-08-25; first-party WhatsApp Help Center.
25. [025] How to manage two-step verification settings — undated; accessed 2026-08-25; first-party WhatsApp Help Center.
26. [026] About passwords — undated; accessed 2026-08-25; first-party WhatsApp Help Center.
27. [027] About registration and two-step verification — undated; accessed 2026-08-25; first-party WhatsApp Help Center.
28. [028] FIDO Passkeys: Passwordless Authentication — undated; accessed 2026-08-25; standards-body context.
29. [029] WhatsApp tightens account security with stronger two-step verification and more — 2026-08-25 06:00 PDT; independent technology reporting.
30. [030] WhatsApp adds stronger two-step verification, multiple passkeys — 2026-08-25 09:00; independent cybersecurity reporting.
31. [031] CVE Program record for CVE-2026-75149, assigned by VulnCheck — Published 2026-08-19; updated 2026-08-21; Authoritative CVE/CNA record.
32. [032] VulnCheck advisory: marimo < 0.23.15 Code Injection via MCP Server Configuration — 2026-08-19; CNA advisory.
33. [033] OSV record for CVE-2026-75149 — Published 2026-08-19; modified 2026-08-23; OSV CVE import.
34. [034] GitHub global advisory GHSA-gfgh-xp6v-q37q — Published 2026-08-19; updated 2026-08-19; GitHub Advisory Database, unreviewed.
35. [035] marimo pull request #10281: additional PEP 723 sanitization — Opened 2026-07-22; merged 2026-07-23; Upstream pull request.
36. [036] marimo patch commit 1a21bd71e258438d2511136b5edacc94c08855f4 — 2026-07-23; Upstream patch commit.
37. [037] marimo 0.23.15 release — 2026-07-23; Upstream release.
38. [038] PyPI metadata for marimo 0.23.15 — Uploaded 2026-07-23; Package registry metadata.
39. [039] Current marimo package metadata on PyPI — Version 0.24.0 uploaded 2026-08-17; checked 2026-08-25; Package registry metadata.
40. [040] marimo security policy — Checked 2026-08-25; Upstream security policy.
41. [041] ClickFix Phishing Pages Discovered in 24 npm Packages — 2026-08-25; primary threat research (OX Security; direct page was WAF-blocked during verification, so claims were cross-checked through its canonical link, indexed metadata, package metadata, and contemporaneous coverage).
42. [042] 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages — 2026-08-25; secondary security report directly linking and quoting OX Security.
43. [043] npm public registry package metadata — accessed 2026-08-25; authoritative live registry metadata; all 24 named package endpoints were queried without downloading tarballs.
44. [044] UNPKG — accessed 2026-08-25; page undated; first-party CDN documentation.
45. [045] npm Unpublish Policy — accessed 2026-08-25; living policy; official npm policy.
46. [046] 175 Malicious npm Packages Host Phishing Infrastructure Targeting 135+ Organizations — 2025-10-09; independent prior threat research corroborating the npm-plus-unpkg hosting technique, not the same 24-package campaign.
47. [047] Think before you Click(Fix): Analyzing the ClickFix social engineering technique — 2025-08-21; first-party defensive threat research on ClickFix.
48. [048] Hackers abuse npm mirrors to host phishing redirect pages — 2026-08 (exact day not directly revalidated because the page was WAF-blocked); contemporaneous secondary coverage; technical findings attributed to OX Security rather than an independent re-analysis.
49. [049] FTP Banners: The New Dead Drop Resolver Delivering Novel RATs — 2026-08-21; Primary vendor malware-analysis report by the SOCRadar Threat Research Unit.
50. [050] MalwareHunterTeam post documenting an LNK that interprets an FTP greeting banner as a command — 2026-07-16; Original public observation predating the SOCRadar report.
51. [051] Hackers abuse FTP server banners to deliver new Windows malware — 2026-08-21; Independent news report based on SOCRadar research and the earlier MalwareHunterTeam observation.
52. [052] E4del and PINHOLE RATs Hide Commands in FTP Banners — 2026-08-22; Independent defensive analysis derived principally from SOCRadar’s findings.
53. [053] E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands — 2026-08-25; Secondary cybersecurity news report.
54. [054] Web Service: Dead Drop Resolver, Sub-technique T1102.001 — 2026-05-12; Authoritative ATT&CK technique definition and defensive guidance; date is last modification.
55. [055] Detection Strategy for Web Service: Dead Drop Resolver, DET0058 — 2026-05-12; Authoritative MITRE ATT&CK detection guidance; date is last modification.
56. [056] One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin — 2026-08-21; primary threat-research report by Patchstack based on DigitalOcean incident evidence and analysis.
57. [057] Privilege Escalation in WordPress SAML SP Single Sign On Plugin — 2026-08-13; Patchstack vulnerability advisory.
58. [058] Broken Authentication in WordPress SAML SP Single Sign On Plugin — 2026-07-30; Patchstack vulnerability advisory.
59. [059] CVE-2026-61979 CVE Program record — 2026-08-13; official CVE Program CNA record assigned by Patchstack.
60. [060] CVE-2026-15981 CVE Program record — 2026-07-23; official CVE Program CNA record assigned by Wordfence.
61. [061] NVD – CVE-2026-61979 — 2026-08-13; NVD record; NVD enrichment not scheduled as of review.
62. [062] NVD – CVE-2026-15981 — 2026-07-23; NVD record; awaiting NVD enrichment as of review.
63. [063] SAML Single Sign On – SSO Login — 2026-08-21; official WordPress.org plugin distribution page and free-edition changelog.
64. [064] Single Sign On for WordPress Release Notes — accessed 2026-08-25; miniOrange vendor release-notes page.
65. [065] Hackers target WordPress sites in miniOrange auth bypass attacks — 2026-08-24; specialist secondary report attributing exploitation evidence to Patchstack and DigitalOcean.
66. [066] WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities — 2026-08-25; specialist secondary report attributing exploitation evidence to Patchstack and DigitalOcean.
67. [067] CISA Adds One Known Exploited Vulnerability to Catalog — 2026-08-24; U.S. government alert.
68. [068] Oracle Critical Patch Update Advisory – January 2026 — 2026-02-02 (revision 3; initially released 2026-01-20); vendor advisory.
69. [069] Oracle Critical Patch Update Advisory – January 2026 – CSAF — 2026-01-20; vendor machine-readable advisory.
70. [070] CVE-2026-21962 CVE Record — 2026-08-25 (updated; published 2026-01-20); CVE Program CNA record supplied by Oracle.
71. [071] Honey for Hackers: A Study of Attacks Targeting the Recent CVE-2026-21962 and Other Critical WebLogic Vulnerabilities on a High Interactive Oracle Honeypot — 2026-03-25; third-party honeypot research.
72. [072] Public CVE-2026-21962 proof-of-concept commit — 2026-01-21T20:06:38Z; public source-code artifact.
73. [073] CVE-2026-21962 Detection Toolkit — 2026-01-22 (repository creation date); public source-code repository.