senn-tech
← IT News
Week 2026-W332026-08-16

IT News Week 33/2026: Metabase Zero-Day as Master Key, Microsoft's 400-CVE Patch Tuesday, Qwen3.8 Goes Open

SecurityAIPatch ManagementRegulationSupply Chain

This week tells the same time three times over: the window between patch and exploit is shrinking to days, sometimes hours. A Metabase zero-day turned the BI frontend into a master key for every connected database — with data leaks at Framework, Tally and n8n. Microsoft closed around 400 flaws on Patch Tuesday while Lazarus has been exploiting a kernel zero-day against defense companies since July, and SAP's CVSS 10.0 flaw came under attack three days after the patch. Plus the most pleasant news of the week: Alibaba releases Qwen3.8 under Apache 2.0 — frontier class that runs on a single gaming GPU. And anyone who manufactures hardware or software now has four weeks until the CRA reporting obligations kick in.

Deep Dive: Metabase Zero-Day — the BI Frontend as Master Key

Unauthenticated SQL injection, then the credentials of every connected database

An unauthenticated SQL injection in the publicly reachable endpoint POST /api/session/reset_password (GHSA-vwf4-m7j8-wcjf, CVSS 10.0, now partly tracked as CVE-2026-72898) has been actively exploited since August 2 — first against Metabase Cloud itself, then against self-hosted instances from version 58 onward. Whoever hits the flaw gains admin access to Metabase — and with it the stored credentials of every connected database. This week the consequences surfaced: Framework (names, addresses, login IPs), Tally (emails, password hashes), Kilo Code (Slack tokens) and n8n (136 customer records) reported data leaks. Help Net Security · The Hacker News

Metabase cascade: from reset endpoint to full database accessExposed endpointreset_password, unauthSQL injectionCVSS 10.0Admin accessMetabase instanceDB credentialsall connectionsBreach cascadeFramework, Tally, n8n
A BI frontend bundles the credentials of every data source — exactly what makes it the most rewarding target in the stack. (Quelle: Help Net Security, August 10, 2026)

The flaw is fixed in versions 1.58.24+/0.58.24+ through 1.63.5+; if you cannot update immediately, block the endpoint at the reverse proxy. Important for anyone who was exposed before the patch: patching only closes the door — the database credentials stored in Metabase must be treated as compromised and rotated.

Assessment: BI tools like Metabase are the most underestimated single point of failure in a self-hosting stack: a frontend that by design bundles read access to all your important databases must never face the open internet with login endpoints — reverse proxy with an IP allowlist or SSO in front, done. And after an incident like this, patching is only half the job: the DB credentials are the actual loot.

Deep Dive: Patch Week — 400 Microsoft Flaws, SAP Under Fire, Hours to Exploit

Microsoft: three zero-days, Lazarus deploys a rootkit via afd.sys

Microsoft closed around 400 vulnerabilities on August 11 (SecurityWeek counts 421 including two third-party CVEs in the TPM 2.0 stack), among them three zero-days: CVE-2026-68820, an actively exploited use-after-free in the WinSock driver afd.sys (privilege escalation to SYSTEM), plus the previously public CVE-2026-62832 (User Profile Service) and CVE-2026-72971 (Container Isolation FS Filter). 42 flaws are rated critical, 37 of them RCEs — the heavyweights sit in AD Certificate Services (CVE-2026-62818), Microsoft QUIC (CVE-2026-62815), DHCP Server (CVE-2026-62823) and RRAS (CVE-2026-62819); also notable: 30 SharePoint and 7 Exchange CVEs. Borncity · SecurityWeek

The afd.sys zero-day is no theoretical find: according to Check Point, North Korea's Lazarus group has been using it since early July in "Operation Dream Job" against defense and aerospace companies — including in Europe — to install the EDR-blinding rootkit FudModule v3.1. Help Net Security · Netzwoche

SAP: CVSS 10.0 in Commerce Cloud — exploit attempts after 72 hours

SAP patched 40 vulnerabilities the same day; the most severe is CVE-2026-58231 (CVSS 10.0) in the Commerce Cloud Data Hub Adapter: unauthenticated remote code execution via a default authentication client. By August 14, Defused Cyber was already registering exploit attempts against honeypots — without any public PoC. And GeoServer set the week's record: after disclosure of a SQL injection (CVSS 9.8) on August 12, watchTowr observed hundreds of exploit attempts within hours; the patch only followed on August 14.

From patch (or disclosure) to exploit: daysGeoServer (unpatched)0.2 · hoursSAP Commerce Cloud3 · daysVMware vCenter5 · days07
Three cases from two weeks: the window for orderly patching is shrinking to days. (Quelle: The Hacker News / Infosecurity Magazine, August 2026)

Assessment: The number 400 is routine — the 72 hours are not. If you run critical, internet-exposed systems (SAP, vCenter, BI tools, VPN gateways) without an emergency patch process measured in days, you are effectively running them unpatched. This week's priorities: the afd.sys update everywhere, SAP Commerce immediately, and pull DHCP/ADCS/RRAS servers forward because they sit at the center of typical SMB networks.

Deep Dive: Qwen3.8 Goes Open — Frontier Class Under Apache 2.0 on a Gaming GPU

27B dense, natively multimodal, 262k context — plus a 2.4-trillion MoE on top

Alibaba's Qwen team released the weights of Qwen3.8 on August 14: the dense, natively multimodal Qwen3.8-27B (27.78 billion parameters, text/image/video, 262,144-token context natively, up to 1M via YaRN) and the MoE flagship Qwen3.8-2.4T-A95B (2.4 trillion parameters, 95 billion active) — both under Apache 2.0 on Hugging Face and ModelScope. According to Qwen, the 27B model beats the larger Qwen3.7-Plus at coding and agent tasks and runs in 4-bit quantization on 17–19 GB of VRAM — a single consumer GPU. Ollama, Unsloth and LM Studio shipped day-0 support. the decoder

Terminal-Bench 2.1: Qwen3.8-27B vs. its larger predecessorQwen3.8-27B73 · dense, openQwen3.7-Plus63.4 · predecessor0100
Plus 84.3 on OSWorld-Verified — agent capabilities previously reserved for closed-source models. (Quelle: Qwen / the decoder, August 14, 2026)

We can confirm this first-hand: the dense 27B variant runs in production for us as a vision model on a single RTX 5090 — with native image and PDF processing at frontier quality, fully on-premise. Fitting company in this week's GitHub trending: NVIDIA's Switchyard (Rust, pre-alpha) routes OpenAI/Anthropic-compatible traffic to vLLM, NIM or Ollama — and at the other end of the scale, Needle 2 delivers tool calling in a 14 MB binary with 45 million parameters for edge devices.

Assessment: This is the moment where "frontier quality" and "your own hardware" stop being a contradiction. For GDPR-sensitive workloads — document processing, customer data, internal search — an Apache 2.0 license, 17 GB of VRAM and day-0 tooling leave hardly any cost argument for the cloud API. If you have an RTX card in a server, this is the week to test.

Deep Dive: CRA Reporting Obligations — Four Weeks Until September 11

24-hour early warning, 72-hour full report, fines up to 15 million euros

From September 11, 2026, manufacturers of hardware and software with digital elements must report actively exploited vulnerabilities and severe security incidents — the first sharp stage of the Cyber Resilience Act. The deadlines are tight: early warning within 24 hours, full report after 72 hours, final report after 14 days. Violations risk fines of up to €15 million or 2.5% of global annual revenue. The full product obligations (security by design, update duties, CE marking) follow on December 11, 2027 — but the reporting duties apply now, and they also cover importers and distributors. Bitkom · ISCL

CRA reporting chain from September 11, 2026Incident detectedactively exploited flaw24hearly warning to ENISA/CSIRT72hfull report14 daysfinal report
Without a prepared chain, you lose the 24 hours to the question of who is even allowed to file the report. (Quelle: Bitkom press release, August 11, 2026)

Assessment: Four weeks is enough to build the minimum: a named reporting officer with a deputy, an internal escalation form that can trigger the 24-hour early warning without a legal department, and a vulnerability intake channel (security.txt — last week we learned only 1.8 percent have one). Integrators and distributors who believe they are not affected should have that confirmed by a lawyer, not by gut feeling.

More Deep Dives This Week

vCenter campaign: 361 victims, Germany near the top — patching alone is not enough

A suspected APT actor is exploiting the directory traversal flaw CVE-2026-59310 (CVSS 9.8) in the vCenter syslog server for unauthenticated RCE — first compromises came five days after Broadcom's July 29 advisory. Quirso counts 361 victim IPs across 47 countries, with Germany among the most affected. Persistence runs via cron jobs and the open-source tool reverse_ssh, whose outbound connections bypass inbound firewall rules. In parallel, Defused Cyber reports a scanning surge on the auth bypass CVE-2026-59309. Fixes: vCenter 9.1.0.0300, 9.0.2.0100, 8.0 U3k/U2f. The Hacker News

Assessment: If you patched after August 3, you are not done: check for cron jobs, unknown outbound SSH connections and new local accounts. And strategically, the question remains fair whether hypervisor management with this exploit cadence belongs on the internet — or in the building at all.

ChainDrop lives: the npm worm now hijacks VS Code and Claude Code configs

New analyses of the ChainDrop worm (444 packages, ~2 billion monthly downloads) reveal a second infection path: the worm injects startup hooks into repository configuration files such as .vscode/tasks.json and .claude/settings.json — merely opening an infected branch in VS Code or Claude Code can execute code, without any npm install. Since the worm manipulates tarballs rather than source repos, classic code review stays blind.

Assessment: Repo configuration files are executable content — anyone using AI coding tools must treat foreign branches like foreign binaries. Enable workspace trust features, rotate npm tokens, and ignore-scripts on build runners remains mandatory.

Researchers decode hidden reasoning traces — including API keys and passwords

Encrypted "reasoning objects" that the APIs of OpenAI, Anthropic and Google carry between calls could be reused across sessions and users: weaker models of the same family decoded the opaque blocks and exposed the hidden chain of thought. From 6,708 public agent logs, the researchers decoded 315,320 thinking blocks and found 704 sensitive artifacts — including 62 API keys, 33 passwords and 7 private keys (paper: arxiv 2608.09867). The vendors have quietly fixed the issue; the demonstrated attacks no longer work.

Assessment: If you store or share agent logs, you may be storing more than you can see. Opaque API objects belong in the same secrecy class as the prompts themselves — and secrets never belonged in prompts in the first place.

Offensive AI goes official: OpenAI brakes Astra and sells GPT-5.6-Cyber

Two stories, one picture: OpenAI is pausing internal work on its upcoming Astra model because it may reach the "Critical" threshold of the Preparedness Framework for cyber capabilities — the ability to develop working zero-day exploits against hardened systems without human help. At the same time, OpenAI launches GPT-5.6-Cyber, an offensive security model with a 95% completion rate on exploit tasks (standard model: 1.5%) — access only through the "Daybreak" program for an initial ten partners, including CrowdStrike, Palo Alto Networks and Cloudflare.

Assessment: The first public development-stop signal from an AI lab for cybersecurity reasons — and simultaneously the commercialization of the same capability for paying defenders. For the defense side this means concretely: the attacker tooling of the next two years is already in beta today.

A 16-year-old SQLite bug: Tailscale's outages led to the WAL reset flaw

Tailscale and the SQLite developers, after six months and 19 database corruptions, found a race condition dating back to 2010 between checkpoint and write transaction in WAL mode. The fix ships in SQLite 3.51.3; only setups with multiple connections in WAL mode are affected. The Register

Assessment: SQLite sits in practically every self-hosting stack — Home Assistant, Grafana, half the *arr world. The lesson is less "SQLite is broken" than: even the best-tested database in the world carries 16-year-old race conditions. Backups are not a nostalgia topic.

Polish heating plant: attacked via a private mobile network, no malware at all

Disclosed at the end of the previous week, but too instructive to skip: CERT Polska documents an attack on a heating plant serving around 50,000 residents — entry via an internet-exposed FortiGate without MFA at a wind farm, then a pivot through a misconfigured private mobile APN (devices were allowed to talk to each other — per CERT Polska the first attack observed in the wild via this vector), onward through Teltonika routers and WAGO controllers with default credentials, up to shutting down a steam turbine via regular Siemens PLC functions. No malware, no supply outage — but a complete OT breakthrough.

Assessment: Private 5G/LTE networks pass as "isolated" in many OT projects and therefore slip through security reviews. This case belongs in every NIS2 risk analysis: audit APN configuration, disable device-to-device communication, and default credentials on field devices are no footnote in 2026.

Digest: More Important News

Security

AI & Development

Infrastructure & Cloud

Enterprise IT

Compiled on August 16, 2026. Sources: The Hacker News, Help Net Security, BleepingComputer, heise online, Borncity, SecurityWeek, Netzwoche, Unit 42 (Palo Alto Networks), The Register, Infosecurity Magazine, the decoder, Bitkom, ISCL, Blocks & Files, ServeTheHome, ComputerBase, Cloudflare, Kioxia, OpenSSH, itreseller.ch.