Threat Brief — 2026-08-06 — Rails RCE, ICS advisories, Spectre bypass deepens

A critical unauthenticated RCE in Ruby on Rails Active Storage demands immediate attention — attackers can upload a crafted image and read arbitrary files from the application process. Three fresh CISA ICS advisories cover ABB industrial software, Johnson Controls thermostats, and Medixant medical imaging. The Spectre v2 bypass story (first reported today by The Hacker News) gains further traction as BleepingComputer details the TONTOU variant's practical exploitation leaking Linux password hashes.

Top items

• Critical unauthenticated RCE in Ruby on Rails Active Storage — A flaw in Active Storage lets an unauthenticated attacker upload a specially crafted image to read arbitrary files accessible to the application process. This is a critical-severity issue affecting Rails deployments; patch immediately. (src: xakep)
• TONTOU CPU attack bypasses Spectre v2 mitigations, leaks Linux password hashes — Researchers demonstrated a practical exploit that times a hardware interrupt into the gap between branch-predictor sanitization and kernel use, re-poisoning the predictor after defenses run. First reported today by The Hacker News; BleepingComputer now confirms the TONTOU variant can leak Linux password hashes in practice. (src: BleepingComputer)
• ABB Ability Zenon — multiple ICS vulnerabilities — Successful exploitation could allow attackers to bypass security controls, crash systems, execute unauthorized actions, or compromise data. Review affected versions and apply vendor patches. (src: CISA)
• Johnson Controls TL280 — sensitive information disclosure — TL280 versions prior to 5.63 are vulnerable to information exposure on the device. (src: CISA)
• Medixant RadiAnt DICOM — denial of service via malicious DICOM file — Opening a maliciously crafted DICOM file causes the application to crash. Relevant to medical imaging environments. (src: CISA)
• CryptoJS 12-year-old entropy bug reduces key space from 2^128 to 2^39 — A long-standing bug in CryptoJS's random-number generation collapses effective entropy to a brute-forceable level, enabling seed-phrase recovery on a standard laptop. This reinforces the earlier CryptoJS weak-RNG wallet-drain reporting (first reported 2026-08-06 by The Hacker News). (src: SecurityLab)
• Positive Technologies launches AI-driven cyber range — A multi-agent AI system autonomously selects attack paths for SOC training exercises. Not an immediate threat but signals growing offensive-AI capability in commercial tooling. (src: SecurityLab)

Themes

• ICS/OT patch Tuesday — CISA released three advisories in a single batch spanning industrial automation (ABB), building controls (Johnson Controls), and medical imaging (Medixant), reminding teams that OT patch cadences lag IT.
• CPU side-channel arms race — Spectre v2 mitigations are once again proven insufficient; the TONTOU/interrupt-injection technique demonstrates that timing-based predictor re-poisoning remains a practical attack vector against current Linux kernels on Intel and AMD.
• Cryptographic entropy debt — The CryptoJS bug illustrates how dormant flaws in widely used libraries can silently undermine security for over a decade, particularly relevant for any team relying on JavaScript-based crypto for wallet or credential generation.