August 10th Threat Intelligence Roundup: Ports Breach, Scooter Data Leak, Crypto Wallet Theft, AI Code Flaws, and Vendor Patches

Top Attacks and Breaches

North Carolina Ports was hit by a cyber intrusion that knocked key systems offline, forcing the authority to revert to manual processes. While containment was claimed, the disruption led to delays as services were restored.

Electric‑scooter operator Ryde disclosed a breach that exposed phone numbers, email addresses, birth dates, partial card data and payment histories for 4.5 million users across Norway, Sweden, Finland and Germany. Full card numbers and ride logs remained safe.

Coldcard hardware wallet maker Coinkite confirmed a theft campaign that leveraged a firmware flaw to siphon at least 1,367 BTC (≈$88.6 million) from thousands of wallets. The company halted shipments of vulnerable units, destroyed affected inventory, and released a patched firmware version.

UK charity CRM provider Beacon reported a breach after attackers gained an access key. Around 1,500 non‑profit customers were notified that database records, donation details and attachments could have been downloaded, though payment information was untouched.

AI‑Driven Threats

Check Point Research demonstrated that Cloudflare’s Code Mode—an AI tool that writes TypeScript for web workers—carried five inherited vulnerabilities from the workerd runtime. These could allow sandbox escape and cross‑tenant data leaks. Cloudflare addressed two critical issues in its managed Workers environment.

Researchers also exposed flaws in Google Gemini CLI (CVE‑2026‑12537, CVSS 10.0) and Anthropic Claude Code (CVE‑2026‑54316) that enable code execution and API key theft in automation pipelines. Both vendors have issued patches.

New AI‑enabled identity fraud kits, such as ProKYC, automate the creation of synthetic documents, selfies, spoofed location data, and video, effectively bypassing KYC checks across banks, fintechs and crypto exchanges.

Vulnerabilities and Patches

• Cisco released critical fixes for SD‑WAN and IOS XE software (CVSS up to 9.9), addressing privilege escalation, code execution and system compromise risks.
• WordPress rolled out version 7.0.3 to patch CVE‑2026‑64638, a pre‑auth XSS that could lead to remote code execution under certain conditions. Backports were applied to all supported branches.
• TP‑Link fixed 15 Omada provisioning vulnerabilities, including device impersonation, credential exposure and remote code execution. Eleven flaws received CVE identifiers.
• A vendor‑installed backdoor was found on at least 20 Zbtlink router models sold under Wiflyer and ZBT brands. The remote‑management module contacted hardcoded servers and accepted unauthenticated root commands. Researchers replicated the behavior by impersonating the vendor server.