Today’s stories span three very different layers of the stack — identity, AI agents, and edge infrastructure — but they share a theme: the flaw isn’t in a rare feature, it’s in a default that ships enabled. Here’s what’s new since yesterday’s digest.
Identity watch: A critical Keycloak flaw lets attackers take over any account without a password or a login attempt
Red Hat and the Keycloak project shipped patches for CVE-2026-18963 (CVSS 9.1), a bypass in Keycloak’s password-reset flow that lets an unauthenticated attacker force a credential reset for any account without ever clicking the email verification link the flow is supposed to require. Knowing a target’s username or email is enough — the attacker walks the reset sequence directly to the password-set step, sidestepping the verification gate entirely, and can do this against administrator accounts as easily as regular users. Keycloak 26.7.2 carries the fix, and Red Hat has backported it to the 26.6.6 and 26.4.15 branches via advisories RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524. No active exploitation or public proof-of-concept has been reported yet. The Hacker News · ThaiCERT
If Keycloak sits in front of anything you’d rather attackers not own, patch this before a public exploit shows up rather than after — an unauthenticated, no-click account-takeover bug rarely stays quiet for long once the diff between vulnerable and fixed code is public.
AI security watch: A single malicious webpage can poison the model behind an NVIDIA NemoClaw AI agent
Oasis Security disclosed CVE-2026-65105, a flaw in NVIDIA’s NemoClaw framework that lets an attacker-controlled webpage silently rewrite the local AI model backing a developer’s agent — no credential theft or phishing required, just one page visit. NemoClaw deploys AI agents inside sandboxed environments and talks to a local model server bound to 0.0.0.0:11434 with no authentication. Researchers used a DNS-rebinding trick to get a browser to reach that local endpoint and call its model-management API, permanently rewriting the chat template so the attacker’s instructions get silently appended to every system message the agent ever sees afterward — a persistent prompt injection baked into the model layer itself, surviving across sessions. NVIDIA shipped v0.0.35, which patches macOS and Linux; Windows and WSL remain unfixed as of this writing. The Hacker News · SiliconANGLE
Any local AI tooling that binds an unauthenticated inference API to all interfaces is reachable from the browser tab next to it via DNS rebinding — worth an inventory pass if your developers run local agent frameworks, regardless of vendor.
Vulnerability watch: CISA sets a three-day clock on a CVSS 10.0 Oracle WebLogic flaw already under exploitation since January
CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on August 24, giving federal civilian agencies until August 27 to remediate. The flaw, a maximum-severity issue in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, lets an unauthenticated attacker with network access over HTTP read or modify critical instance data. Oracle actually patched it back in January, but CloudSEK’s honeypots caught exploitation attempts starting January 22 — within days of a public proof-of-concept — and GreyNoise and SOCRadar have both since confirmed ongoing scanning and exploitation. The flaw is also reportedly among those used by a China-linked actor to deliver the SNOWLIGHT downloader against government and commercial targets in over 100 countries. The Hacker News · SecurityWeek
Seven months between patch availability and a KEV listing is a long time for a maximum-severity, unauthenticated, HTTP-reachable bug to sit unremediated — if you run Oracle HTTP Server or WebLogic Proxy Plug-in, confirm January’s patch actually landed rather than assuming it did.
Also noted: ToxicPanda 2.0 expands to 349 banking apps and blocks Google Play to stay on the device
Zimperium’s zLabs team detailed a major upgrade to the ToxicPanda Android banking trojan, now targeting 349 financial, banking, and crypto-wallet apps across 16 countries with 167 supported remote commands. The new version requests VPN permissions purely to intercept and block traffic to Google Play and Google Play Services, preventing the app from being remotely killed or updated once installed, and pairs invisible phishing overlays with a separate PIN-harvesting module and Android lock-screen spoofing to capture device unlock codes directly. Distribution runs through AWS-hosted buckets rather than official app stores. BleepingComputer · The Hacker News
For any team supporting BYOD or a mobile workforce, this is a reminder that “installed outside the Play Store” is still the highest-signal control against this entire malware family — VPN-permission abuse to block store updates is a newer trick worth adding to your mobile telemetry watchlist.
Final thought
Every story today traces back to something that shipped on by default and stayed that way: a verification step that could be skipped, a local model API with no auth in front of it, and a patch that existed for seven months before anyone enforced applying it. None of these required a novel technique to fix — they required someone to check the default. If you want help auditing where your own stack still trusts a default it shouldn’t, see our how-to guides or book a discovery call.