1,196 wallet addresses drained in 41 minutes. 25,000 servers leaking password hashes. 30+ water utilities on manual operations. 9.8 CVSS scores with no workarounds. That was the week of July 27 to August 2.
If last week's message was "AI runs the attacks now," this week's is simpler and scarier: attackers are going for the keys. Not your front door. The tools that open every other door. The remote management platforms, the virtualization layer, the build servers, and the out-of-band chips silently bolted to server motherboards.
Here is the deal. When a remote monitoring tool gets hijacked, the attacker isn't just inside your network. They're inside every network that tool touches. And this week, that exact scenario played out in the open.
The RMM compromise that should scare every MSP customer
N-able confirmed attackers exploited CVE-2026-18577, an authentication bypass in the N-central remote monitoring and management platform, to take over MSP servers. The kicker: it was an incomplete fix for an earlier flaw, CVE-2026-18556. Attackers abused N-central's built-in Take Control remote access to reach managed endpoints, then installed Cloudflare tunnel services that survive reboots and keep access alive even after the N-central route is cut.
The hotfix, 2026.3.1.7, shipped August 2. Active exploitation happened before disclosure.
Whoever owns the RMM server owns every machine the MSP touches. There is no bigger key in the MSP world.
Who should care: Anyone whose IT provider uses N-central. If that's you, ask today whether the hotfix is applied and whether anyone has scanned for rogue tunnels. This is a "call your MSP right now" situation, not a "wait for the monthly review" situation.
VMware vCenter: two CVSS 9.8s and a VM escape, no workarounds
Broadcom patched a nasty trio on July 29. CVE-2026-59309 (CVSS 9.8) is an unauthenticated auth bypass in vCenter's Directory Service. CVE-2026-59310 (CVSS 9.8) is a directory traversal RCE in the vCenter Syslog server. And CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the ESXi VMXNET3 adapter that enables a full VM escape to the host.
No confirmed exploitation yet. But there are no workarounds, and prior vCenter flaws in 2021 and 2023 were weaponized within days.
Who should care: Anyone running vSphere Essentials or Standard, which is most small-business virtualization. An unauthenticated bypass of the management plane plus a guest-to-host escape means the "one server, many VMs" model can fall in a single chain. Treat these as emergency patches, not routine maintenance.
25,000 servers leaking password hashes through a 22-year-old flaw
Lava Security found roughly 25,000 internet-exposed BMCs (the out-of-band management chips in servers) leaking HMAC password hashes through CVE-2013-4786, a flaw in the IPMI 2.0 RAKP handshake. More than half were Supermicro, whose factory passwords can be brute-forced within hours on modern GPUs. The researchers also documented a ransomware incident at a major automotive parts maker that started through exposed BMCs.
Here's the part people forget: this works before login, and it works when the server is off.
Who should care: Anyone with a server in a datacenter or colo. Block UDP port 623 at the edge, rotate factory credentials, and keep management interfaces off the internet. This is a five-minute check with a big payoff.
30+ Minnesota water utilities forced to manual operations
More than 30 water and wastewater utilities in Minnesota were pushed to manual operations, with at least one plant offline, after attackers hit PLCs via CVE-2021-22681, a Rockwell Studio 5000 Logix Designer flaw documented since 2021. No water quality was compromised. Tenable assessed the activity as consistent with Iran-linked CyberAv3ngers, four days after CISA warned about exactly this on July 22.
The vulnerability was known for five years. The warning came four days before the attack. The patch cycle for safety-critical gear could not keep up.
Who should care: Anyone running connected physical equipment. The lesson is segmentation and a tested manual-operations plan, because the next incident might not target a utility. It could target the plant that builds your product.
Healthcare supply chain: two breaches, 1.6 million people
The week served a grim double-tap in healthcare. CareCloud notified 350,000+ individuals after attackers accessed an AWS-hosted EHR environment from March 10 to 16, exposing names, SSNs, driver's licenses, financial account numbers, and for some people full card data including CVV. The breach took four months to reach notification.
Then MCBS, a Georgia medical billing firm, reported 1,261,464 affected individuals to HHS. The PEAR ransomware group accessed the network in September 2025, claimed 3.3 TB of stolen data, and has now fully leaked it online.
The data included SSNs, dates of birth, health plan IDs, medical history, and diagnoses across seven named healthcare customers.
Who should care: Any practice that outsources billing or IT. One intrusion at a vendor can expose a million-plus patient records across dozens of practices you've never heard of. Ask your vendors what they store, where it lives, and what their breach response looks like. The liability lands on the practice, not the vendor.
TeamCity and NGINX: the infrastructure nobody remembers to patch
JetBrains patched a critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077, CVSS 9.8) in the agent polling protocol. No credentials, no interaction needed. Fixed in 2025.11.7 and 2026.1.3, with a patch plugin covering versions back to 2017.1. The 2024 predecessor, CVE-2024-27198, was weaponized within days.
Meanwhile, Orca Security published a pre-authentication RCE chain for CVE-2026-42533, a heap overflow in NGINX's regex map handling that's been sitting there since 2011. The public PoC succeeds 10 out of 10 times on Ubuntu 24.04. Fixed in 1.30.4 and 1.31.3.
Who should care: TeamCity holds credentials for repos, registries, clouds, and signing keys, which makes unauthenticated code execution there a supply-chain event. NGINX fronts a huge share of small-business websites and APIs. Check your versions this week, not next.
Cisco FMC: a hardcoded account you cannot remove, under active attack
CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog on July 29. It's a static, low-privileged account in Cisco Secure Firewall Management Center that admins cannot disable or remove. The CVSS is a modest 5.3, but Cisco rates real-world impact high because it chains with other FMC flaws for privilege escalation. The federal remediation deadline was August 1.
Note the lesson here: a "Medium" CVSS score on an actively exploited flaw is still an emergency.
Who should care: Anyone running FMC. It's your firewall's management console leaking policy config and topology to whoever can reach it. Patch, rotate credentials, and never expose FMC to the internet.
Cl0p is at it again, this time on Windchill
Ransom-ISAC confirmed Cl0p affiliates are exploiting CVE-2026-12569 (CVSS 9.3, unauthenticated deserialization RCE) plus a FlexPLM info-disclosure flaw to plant JSP webshells, exfiltrate CAD and engineering IP, and send mass extortion emails titled "Windchill PDMLink module serious data leak" to hundreds of employees per organization. The patch was available June 17; Cl0p is moving on unpatched instances now.
Who should care: Manufacturers, automotive, aerospace, and retail using any PTC product. This is the MOVEit playbook again: exploit a niche internet-facing system, skip the encryption, extort on data alone. Patching alone won't remove webshells already planted, so check for those too.
The $70 million heist that took 41 minutes
On July 30, an attacker drained 1,196 addresses totaling 1,082.65 BTC, roughly $70.2 million, in 41 minutes. Galaxy Research linked the sweep to a firmware RNG flaw in Coldcard hardware wallets: a March 2021 integration error routed seed generation to the wrong source, making keys predictable.
Yes, it's a niche story. But it's the clearest example this week of a fundamental rule: the security of a system lives in its least visible component. Here, it was a random number generator in firmware.
Who should care: Any business holding crypto on hardware wallets. Migrate funds to freshly generated wallets if your hardware predates the fix. And generally, audit the components you never think about.
Quick hits
Certighost (CVE-2026-54121): a standard domain user can abuse AD CS to get a certificate impersonating a Domain Controller, then DCSync the krbtgt hash. Patched July 14; public PoC landed July 24. If you run on-prem AD with an Enterprise CA, this is the push to deploy that patch.
Apple's mega-drop: 187 vulnerabilities on July 27, including 87 in iOS 26.6 and 155 in macOS Tahoe 26.6. The AI-accelerated disclosure trend continues. Update your Apple fleet.
npm supply chain: Amazon linked the "Debug" and "Chalk" package attacks to North Korean hackers. If you run Node.js builds, check your lockfiles.
AI agents keep testing your perimeter: DeepSeek AI plus Hermes Agent autonomously attacked exposed servers on July 31, and a Copilot-for-Word prompt-injection worm was disclosed on July 29. The defense remains boring and effective: patching, segmentation, and monitoring.
The bottom line for SMBs: one forgotten interface is all it takes
Strip this week down and one pattern runs through every story: attackers don't need a novel exploit to hurt you. They need one forgotten interface. A BMC left exposed, an RMM server with an incomplete patch, a build server nobody updated, an unpatched niche product that holds your IP.
None of these are exotic. They are the unglamorous infrastructure that keeps the business running, and they are exactly what the attackers looked at this week.
Not sure where your version of that forgotten interface is hiding? Let's find it before someone else does.
Book a 15-minute security check
No pitch, no obligation. Just a straight answer about where you stand.