--- title: 10th August – Threat Intelligence Report | daily.dev description: Weekly threat intelligence roundup covering major cyberattacks, AI-related security threats, vulnerabilities, and threat campaigns. Key incidents include a... canonical: https://daily.dev/posts/10th-august-threat-intelligence-report-vrcvigoz7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 10th August – Threat Intelligence Report | daily.dev og:description: Weekly threat intelligence roundup covering major cyberattacks, AI-related security threats, vulnerabilities, and threat campaigns. Key incidents include a... og:url: https://daily.dev/posts/10th-august-threat-intelligence-report-vrcvigoz7 og:image: https://api.daily.dev/og/posts/vrcVIGOz7.png og:image:alt: 10th August – Threat Intelligence Report og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 10th August – Threat Intelligence Report **[Check Point Research](https://daily.dev/sources/cpresearch)** · 4 min read · 0 upvotes · 0 comments ## Summary Weekly threat intelligence roundup covering major cyberattacks, AI-related security threats, vulnerabilities, and threat campaigns. Key incidents include a cyberattack on North Carolina Ports, a 4.5 million-account data breach at Ryde, and $88.6 million in bitcoin stolen via a Coldcard firmware vulnerability. AI threats include critical CVEs in Google Gemini CLI (CVSS 10.0) and Anthropic Claude Code, plus AI-powered KYC bypass fraud kits. Patch highlights cover Cisco Catalyst SD-WAN (CVSS 9.9), a WordPress XSS2Shell RCE flaw, 15 TP-Link Omada vulnerabilities, and a vendor backdoor in 20+ Zbtlink router models. Threat intelligence reports detail the Shai-Hulud CHAINDROP npm supply-chain attack backdooring 400+ packages, a vishing campaign targeting US financial firms with ransom demands up to $3 million, a macOS ClickFix malware campaign, and nearly 800 malicious npm packages delivering RAT and infostealer malware. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the CVE and severity of the Google Gemini CLI vulnerability that allows code execution and API key theft? CVE-2026-12537, rated CVSS 10.0, affected Google Gemini CLI workflows and could expose automation environments to code execution and API key theft. A separate flaw, CVE-2026-54316, affected Anthropic Claude Code. Both vendors released patched versions after researchers disclosed the vulnerabilities. _Developers relying on AI CLI tools for automation track CVEs like these on daily.dev before they hit production pipelines._ ### What happened in the Shai-Hulud CHAINDROP npm supply chain attack and how many packages were affected? The Shai-Hulud CHAINDROP campaign backdoored more than 400 npm packages after attackers compromised the maintainer of the widely used keyv library. Malware executed through a preinstall hook, stole developer tokens, and republished modified packages across an ecosystem with roughly 1.3 billion monthly downloads. _npm ecosystem threats like CHAINDROP are the kind of supply chain risk JavaScript developers watch for on daily.dev._ ### What is the WordPress XSS2Shell vulnerability CVE-2026-64638 and which versions are affected? CVE-2026-64638, known as XSS2Shell, is a high-severity WordPress Core flaw fixed in version 7.0.3. It can turn a failed login into pre-authentication cross-site scripting and, under specific conditions, remote code execution. Fixes were backported to all supported WordPress branches dating back to version 4.7. _WordPress site owners and plugin developers keeping up with patch releases like this one rely on daily.dev for timely security coverage._ ## Similar posts on daily.dev - [3rd August – Threat Intelligence Report](https://daily.dev/posts/3rd-august-threat-intelligence-report-y3hw57hhz) · Check Point Research · 0 upvotes · 0 comments - [5th October – Threat Intelligence Report](https://daily.dev/posts/5th-october-threat-intelligence-report-ptoq8lctm) · Check Point Research · 0 upvotes · 0 comments - [30th March – Threat Intelligence Report](https://daily.dev/posts/30th-march-threat-intelligence-report-fuc0w1paq) · Check Point Research · 0 upvotes · 0 comments - [29th June – Threat Intelligence Report](https://daily.dev/posts/29th-june-threat-intelligence-report-4guaks8pl) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#vulnerability](https://daily.dev/tags/vulnerability), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/10th-august-threat-intelligence-report-vrcvigoz7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"10th August – Threat Intelligence Report","url":"https://daily.dev/posts/10th-august-threat-intelligence-report-vrcvigoz7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/10th-august-threat-intelligence-report-vrcvigoz7"},"datePublished":"2026-08-10T14:00:21.845Z","dateModified":"2026-08-10T14:02:05.740Z","description":"Weekly threat intelligence roundup covering major cyberattacks, AI-related security threats, vulnerabilities, and threat campaigns. Key incidents include a...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"Check Point Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Check Point Research","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7e3b130555214df2bf737ee6c764fa42","url":"https://daily.dev/sources/cpresearch"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/10th-august-threat-intelligence-report-vrcvigoz7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,vulnerability,data-breach","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Check Point Research","item":"https://daily.dev/sources/cpresearch"},{"@type":"ListItem","position":3,"name":"10th August – Threat Intelligence Report"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/10th-august-threat-intelligence-report-vrcvigoz7#faq","mainEntity":[{"@type":"Question","name":"What is the CVE and severity of the Google Gemini CLI vulnerability that allows code execution and API key theft?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-12537, rated CVSS 10.0, affected Google Gemini CLI workflows and could expose automation environments to code execution and API key theft. A separate flaw, CVE-2026-54316, affected Anthropic Claude Code. Both vendors released patched versions after researchers disclosed the vulnerabilities. Developers relying on AI CLI tools for automation track CVEs like these on daily.dev before they hit production pipelines."}},{"@type":"Question","name":"What happened in the Shai-Hulud CHAINDROP npm supply chain attack and how many packages were affected?","acceptedAnswer":{"@type":"Answer","text":"The Shai-Hulud CHAINDROP campaign backdoored more than 400 npm packages after attackers compromised the maintainer of the widely used keyv library. Malware executed through a preinstall hook, stole developer tokens, and republished modified packages across an ecosystem with roughly 1.3 billion monthly downloads. npm ecosystem threats like CHAINDROP are the kind of supply chain risk JavaScript developers watch for on daily.dev."}},{"@type":"Question","name":"What is the WordPress XSS2Shell vulnerability CVE-2026-64638 and which versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-64638, known as XSS2Shell, is a high-severity WordPress Core flaw fixed in version 7.0.3. It can turn a failed login into pre-authentication cross-site scripting and, under specific conditions, remote code execution. Fixes were backported to all supported WordPress branches dating back to version 4.7. WordPress site owners and plugin developers keeping up with patch releases like this one rely on daily.dev for timely security coverage."}}]} ```