The Axe Report.
Official company announcements, tactical service deployments, strategic partnerships, and community action updates from the Grab The Axe team.
400 Microsoft Flaws, Malicious SIMs & a Polish Plant Shutdown (08/11/2026)
Microsoft patched 400 flaws including an exploited zero-day, researchers turned SIM cards into modem backdoors, and attackers stopped a Polish plant's turbine.
Ceva Breach Cascades Downstream & New Passkey Attacks Land (08/10/2026)
A breach at shipping giant Ceva Logistics reached its customers' customers, three research teams defeated passkey protections, and ransomware crews took SonicWall.
Ransomware Crews Are Targeting Managers Who Approve Payments (08/09/2026)
Zscaler mapped 351 victims across 334 organizations and found attackers picking managers with budget authority, average age 46, mostly outside IT.
A Metabase 10.0 Zero-Day, N-central Hotfix 2 & Kemp on KEV (08/08/2026)
Metabase disclosed a maximum-severity zero-day already under exploitation, N-able shipped a third round of fixes, and CISA added Kemp LoadMaster after 792 attempts.
800 Malicious npm Packages & a GitHub Issue That Reached CI (08/07/2026)
Nearly 800 npm packages shipped a cross-platform trojan, N-able confirmed attackers reached customer networks, and a GitHub issue executed code on coding-agent runners.
ICE Is Buying Credit Card Records, Meta Owes New Mexico $567M (08/07/2026)
ICE is buying credit card application data through brokers, a New Mexico judge ordered Meta to pay $567 million over child safety, and an NHS trust is probing record access.
A Phished Inbox Becomes an SEC Filing at a Defense Supplier (08/07/2026)
IEH Corporation disclosed a cyber incident to the SEC after a phished Microsoft 365 account exposed engineering files, and five providers settled pixel class actions.
ICE Took a Million DNA Samples, 20 States Sue Over Benefits Data (08/06/2026)
ICE collected close to a million DNA profiles last year including children's, the NYPD took a woman's DNA off a water cup, and 20 states sued over benefits records.
Snowflake Plea, 4,407 Exposed PLCs & Three Cisco 9.8s (08/06/2026)
Connor Moucka pleaded guilty over breaches touching 100 million people, Forescout counted 4,407 internet-facing Rockwell controllers, and Cisco shipped three 9.8s.
A Vendor Breach Hits 3.8M Patients, Texas Halts Data Center Hookups (08/06/2026)
An Ohio revenue cycle vendor exposed 3.8 million patients, Texas froze data center grid connections pending an audit, and the EU rewrote AI product liability.
Private Relay Leaks Real IPs, Met Police Reprimanded by the ICO (08/05/2026)
Apple's Private Relay is exposing the IP addresses it exists to hide, and the ICO found the Met handed a stalking victim's new address to the man she was hiding from.
Open VSX Evil Twins, CISA Flags Langflow & Water Hits 12 States (08/05/2026)
Open VSX pulled 77 extensions impersonating real developer tools, CISA gave agencies three days on Langflow and Tomcat, and water attacks reached 12 states.