In partnership with
In the last ~48 hours, key cybersecurity developments require executive attention: CISA added actively exploited Langflow, Apache Tomcat, and N able N central vulnerabilities to the Known Exploited Vulnerabilities catalog, Switzerland disclosed a SharePoint breach that compromised roughly 200 government accounts, a cyberattack forced North Carolina Ports into manual processing across three locations, and Levi Strauss disclosed that a social engineering attack against three employees led to unauthorized access and corporate data theft.
The pattern this week is broader than another set of CVEs. Attackers are moving across AI application infrastructure, collaboration platforms, operational logistics systems, and human identity paths with one common objective: gain trusted access before defenders recognize the behavior as hostile. The SharePoint and port incidents also reinforce an uncomfortable operational truth. Even when an organization contains an attack, recovery may still mean rebuilding servers, blocking external access, resetting credentials, or processing critical business activity manually. Meanwhile, Levi Strauss shows that sophisticated exploitation is not always required when an attacker can simply convince the right employee to open the door.
These developments reinforce priority themes for the weekend: KEV remediation needs to move at exploitation speed, trusted collaboration platforms require compromise checks beyond patching, business continuity must account for cyber driven manual operations, and social engineering defenses need to protect identity workflows, not just inboxes.
The Next Breakout Might Be in Your Pocket
Everyone’s hunting for the next Unicorn.
The type of “category disruptor” that grows fast and turns early believers into big winners.
59,000+ investors think that Mode Mobile could be one of those rare finds.
Americans spend 4 ½ hours on their phones daily, and Mode Mobile is monetizing that screentime. With $1B+ earned by over 490M customers and 32,481% revenue growth, Mode’s EarnPhone is turning smartphones into income generating assets.
Their previous raises sold out, and the company is now offering pre-IPO shares at $0.52/share with up to 20% bonus, exclusive to early investors.
Being early is everything, and this window is still open.
*Please read the offering circular and related risks at invest.modemobile.com.
Mode Mobile recently received their ticker reservation with Nasdaq ($MODE), indicating an intent to IPO in the next 24 months. An intent to IPO is no guarantee that an actual IPO will occur.
The Deloitte rankings are based on submitted applications and public company database research, with winners selected based on their fiscal-year revenue growth percentage over a three-year period.
Category shifts this week:
Active Exploitation / KEV ↑: CISA added Langflow, Tomcat, and N central flaws after confirming exploitation in the wild.
Government Collaboration Platforms ↑: Switzerland’s federal IT office is rebuilding SharePoint servers after an intrusion compromised approximately 200 accounts.
Critical Infrastructure / Logistics ↑: North Carolina Ports shifted to contingency procedures and manual processing following a cyberattack affecting Wilmington, Morehead City, and Charlotte.
Social Engineering / Identity ↑: Levi Strauss said three employees were targeted through social engineering before an unauthorized party accessed and extracted corporate information.
CISA flags Langflow, Tomcat, and N central vulnerabilities as actively exploited - High
What changed: CISA added actively exploited Langflow, Apache Tomcat, and N central vulnerabilities to KEV on August 5. The list includes CVE 2026 9198, a Langflow code injection flaw enabling unauthenticated remote code execution; CVE 2026 34486 affecting Tomcat cluster encryption; and CVE 2026 18556, an N central authentication bypass.
Why this matters: This is a reminder that AI application frameworks, middleware, and remote monitoring platforms all represent privileged infrastructure. One exploited system can expose secrets, management access, or downstream services long before the business understands why an unfamiliar server suddenly matters.
What changed: Switzerland’s federal IT office disclosed that attackers exploited Microsoft SharePoint vulnerabilities to compromise approximately 200 accounts. Officials blocked external SharePoint access, patched suspected vulnerabilities, reset affected credentials, and began reinstalling compromised servers. Investigators have not publicly confirmed which SharePoint flaw was used.
Why this matters: SharePoint is a trust repository. It contains internal documentation, project information, collaboration history, and credentials adjacent to business workflows. The fact that the Swiss government is reinstalling servers after patching is the important lesson: remediation is not the same thing as proving the attacker is gone.
Cyberattack forces North Carolina Ports into manual operations - High
What changed: North Carolina Ports is restoring systems after an outside attacker compromised its IT environment, triggering contingency procedures across Wilmington, Morehead City, and Charlotte. The facilities continued operating, but processing remained manual and delays were expected.
Why this matters: Ports sit directly between cyber systems and physical commerce. A successful attack does not need to shut the gates completely to create business impact. Manual processing, delays, recovery costs, and uncertainty across shippers and partners are enough to turn an IT intrusion into an operational event.
Levi Strauss breach began with social engineering against three employees - Medium-High
What changed: Levi Strauss disclosed that an unauthorized party gained access to company systems after a social engineering attack targeted three employees. The company said certain corporate information was accessed and extracted, although operations were not disrupted and a material financial impact is not currently expected.
Why this matters: Attackers do not need a zero day if they can obtain trusted access through employees. Social engineering increasingly targets the identity workflow itself: help desk processes, phone calls, access recovery, MFA enrollment, and internal trust. Once the attacker looks like a valid user, traditional perimeter controls become spectators.
Stage | Vector | What We’re Seeing |
|---|---|---|
Initial Access | Application and management platform exploitation | Actively exploited Langflow, Tomcat, and N central weaknesses targeting exposed or privileged systems |
Privilege / Persistence | Collaboration platform compromise | SharePoint intrusion resulting in credential exposure and full server rebuilds after containment |
Operational Impact | Critical logistics disruption | Port systems moved to contingency procedures and manual processing after compromise |
Identity Abuse | Social engineering | Employees manipulated into enabling access that led to corporate information theft |
Own Search With Podcasts
Search engines and AI platforms reward brands that are mentioned, cited, and trusted across the web. PodPitch books your experts on relevant shows, creating branded mentions, backlinks, transcripts, citations, and reusable content. Only 20 demo spots are available this month. Once claimed, the offer disappears.
🔄 Patch & Hardening
Reconcile your environment against the latest KEV additions, specifically Langflow, Apache Tomcat, and N central.
Patch affected systems immediately and validate version status rather than relying on deployment success messages.
Treat exposed SharePoint systems as compromise candidates, not simply patch candidates, where vulnerable versions were internet accessible.
Restrict management interfaces for AI platforms, RMM systems, middleware, and collaboration infrastructure to hardened administrative networks.
Review identity recovery controls so employee manipulation cannot easily become MFA reset, token issuance, or privileged access.
📊 People & Monitoring
Monitor Langflow and N central for new users, unexpected configuration changes, suspicious outbound connections, and abnormal process execution.
Hunt SharePoint infrastructure for new or modified web files, abnormal IIS activity, unusual credential access, and suspicious service account behavior.
Monitor logistics and operational systems for unexplained application outages, authentication failures, remote access activity, and shifts into manual processing.
Watch high risk employee accounts for MFA resets, new devices, unusual session tokens, and help desk initiated access changes.
Escalate social engineering reports quickly, especially where callers impersonate internal support or request authentication changes.
💼 Process & Validation
Enforce change freeze on critical collaboration, RMM, AI application, and logistics infrastructure unless CISO approved.
Conduct a 30 minute tabletop:
“Social engineering compromise → privileged application access → collaboration platform foothold → critical operations move to manual processing.”
🤝 Partners & Assurance
Require application owners to attest KEV remediation and internet exposure status.
Require collaboration teams to confirm SharePoint compromise hunting in addition to patching.
Require critical operational partners to validate manual fallback processes and communication paths.
Require identity and help desk teams to review high risk authentication recovery workflows and approval controls.
Langflow / N central / Tomcat: Detect unusual application process execution, authentication bypass patterns, new administrative objects, first seen outbound destinations, and unexpected configuration changes.
SharePoint: Hunt suspicious IIS requests, new web accessible files, abnormal service account use, machine key access, credential exposure indicators, and authentication continuing after password resets.
Critical logistics: Alert on large clusters of application failures, privileged remote sessions, unexplained configuration changes, and transitions from automated to manual workflows.
Social engineering: Correlate help desk resets, MFA changes, new device registration, password resets, and privileged logins occurring within a short period for the same user.
Overall Risk Level: High
This weekend’s highest risk pattern is trusted access compromise:
Actively exploited application infrastructure
Collaboration and government systems
Critical logistics operations
Employee identity and recovery workflows
The most important point is that these attack paths do not operate independently. An exploited application can expose credentials, stolen credentials can unlock trusted platforms, and trusted platform access can eventually affect physical business operations. The attack chain only needs one control to blink first.
KEV items require operational urgency, not ordinary patch cadence.
SharePoint remediation should include compromise hunting when vulnerable systems were exposed.
Manual business operations are a cyber resilience control and should be tested before they are needed.
Social engineering defenses must protect identity recovery and help desk workflows, not just email.
🔄 Verify: Langflow, Tomcat, N central, and SharePoint exposure and remediation status.
📊 Validate: Monitoring for collaboration platform compromise, RMM abuse, and identity recovery anomalies.
💼 Confirm: Critical operational teams can move to tested manual processes without improvising during an incident.
🔹 Rehearse: “Social engineering → trusted account compromise → platform access → operational disruption.”
Final Insight: Attackers are targeting the systems that automate workflows, hold internal knowledge, move physical goods, and decide who gets access.
This weekend, verify trust itself, because that is increasingly the control attackers are trying to compromise first.
The GTM Playbook Behind Warmly's Acquisition
Warmly ran pipeline, outreach, and lead scoring on autopilot for hundreds of startups — before a single sales hire.
HubSpot acquired them for it. Now the cofounders are walking you through the exact system, live, before they disappear into product. Join the Builder Session on August 12.
Leave with an agentic GTM stack you can replicate this week. Plus HubSpot Credits when you join HubSpot for Startups.
