August 10, 2026 is shaping up to be one of the more demanding days of the year for defenders. Across a single news cycle, security teams are contending with two actively exploited critical vulnerabilities in enterprise software, a massive malicious package campaign targeting developer pipelines, and a sophisticated social engineering attack chain draining cryptocurrency wallets from macOS users. The common thread is urgency: each of these threats is already being weaponized, not theorized.

The most alarming story of the day centers on Metabase, the widely deployed open-source business intelligence and data visualization platform. A maximum-severity vulnerability carrying a CVSS score of 10.0 has been confirmed exploited in the wild as a zero-day, meaning patches were not available when attackers began leveraging it. The flaw allows completely unauthenticated access to administrative functions, and a related SQL injection vector has already been used in confirmed data-theft attacks against customer instances, with Framework and Tally named as known victims. Because Metabase instances frequently sit behind internal networks but are also commonly exposed to the internet for dashboard sharing, the blast radius is significant. Any organization running Metabase should treat this as an emergency. If a patched version is not yet available, the immediate response is to take the instance offline or restrict access to trusted IP ranges only, audit all recent access logs for anomalous unauthenticated requests, and rotate any database credentials the Metabase service account can reach.

Running in parallel is the active exploitation of CVE-2026-8037, a critical command injection vulnerability in Progress Kemp LoadMaster. CISA added this flaw to its Known Exploited Vulnerabilities catalog after reporting approximately 792 documented exploit attempts, a volume that signals organized, opportunistic scanning rather than targeted intrusion. LoadMaster is a load balancing and application delivery product used heavily in enterprise and government environments, making it an attractive pivot point for attackers seeking network access or lateral movement opportunities. Command injection flaws at this severity level typically allow arbitrary operating system commands to be executed with the privileges of the service process. Organizations running LoadMaster should apply the vendor patch immediately, verify that management interfaces are not exposed to the public internet, and review firewall rules restricting administrative access to the appliance. Because this is now on the KEV catalog, federal agencies face a mandatory remediation deadline, but all organizations should treat KEV additions as high-priority signals regardless of regulatory obligation.

On the supply chain front, researchers have identified nearly 800 malicious npm packages using typosquatted names to distribute a cross-platform remote access trojan and infostealer targeting Windows, macOS, and Linux simultaneously. The scale of this campaign is notable. Typosquatting attacks exploit the human tendency to mistype package names during rapid development cycles, and a single compromised dependency can propagate through an entire build pipeline and into production artifacts. The malware delivered is described as a cross-platform RAT, meaning attackers who achieve initial access through a developer workstation can maintain persistent control and exfiltrate credentials, tokens, and source code. Development and DevOps teams should audit their package.json and lock files immediately, cross-reference installed packages against the published malicious list, enable npm audit in CI pipelines, and consider enforcing a private registry or allowlist policy that prevents installation of packages not explicitly approved.

Finally, macOS users are being targeted through ClickFix-style social engineering attacks that deliver architecture-aware Go-based malware capable of stealing cryptocurrency wallet data, passwords, iCloud Keychain contents, and cached browser credentials. ClickFix attacks typically trick users into manually executing a malicious command by presenting a fake error or CAPTCHA prompt that instructs them to paste something into their terminal. The fact that this malware is architecture-aware, meaning it adapts its payload for Intel versus Apple Silicon Macs, indicates a well-resourced threat actor. Security awareness training should specifically address this technique. On the detection side, endpoint security tools should alert on unexpected shell processes spawned from browser or productivity application contexts, and organizations should consider restricting terminal access for non-technical user populations.

Defensive priorities for August 10:

- Immediately isolate or restrict access to all internet-facing Metabase instances and begin patch monitoring for an official fix
- Apply the Progress Kemp LoadMaster patch for CVE-2026-8037 and verify management interfaces are firewalled from public access
- Audit all npm dependencies in development environments and CI pipelines for typosquatted or suspicious packages
- Brief development teams on supply chain hygiene and enforce registry controls where possible
- Deploy or tune endpoint detection rules for unexpected shell execution on macOS endpoints, particularly processes spawned from browsers
- Remind all staff, especially those handling cryptocurrency or sensitive credentials, about ClickFix-style social engineering and the danger of pasting terminal commands from web prompts
- Monitor CISA KEV additions as a standing operational feed and ensure your vulnerability management program treats KEV entries as immediate escalations

This briefing is informational and intended to support situational awareness; always consult official vendor advisories and CISA guidance for authoritative remediation instructions specific to your environment.