[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fp9iNjaHTV6zEYBq8rmml4e2G9ufCaWapR8Q96IfaSy0":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"973e01d2-772a-47e7-9699-93978df65afe","Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable","cosmos-evm-flaw-exploited-after-cosmos-labs-knew-every-blockchain-running-it-was-65777c","Cosmos Labs has warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2, is rated Critical by Cosmos Labs and was published without a CVE identifier, a weakness classification, or a CVSS score. Affected versions are =","A critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. Cosmos Labs knew about the vulnerability since April but initially misjudged its impact, only confirming its widespread risk by August 13. The fix was deployed via a silent patch process, which the company's own policy suggests should not have been used for a flaw of this severity.","Cosmos EVM flaw exploited after Cosmos Labs knew all blockchains running it were vulnerable.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fcosmos-evm-flaw-exploited-after-cosmos.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgRHWwlkIrD4ix8P1j7FGJW7pl0e6W600w61mPcVBRsL7BqK_8SNTLSSk-4498ZuyThNbHG8FmtGoMlR9B9ujcXUlHnRb9NTpBhImouOWrQK2WaxVVd5rjjL62kXl1fW9U5YyDN1Uc-M6OriHc7nQNzCbJAC3kRIsRgAnY5q2SSTL2TjLzix05DAoSa7jQ\u002Fs1600\u002Fcosmos-evm-hack.jpg","2026-08-28T20:38:47+00:00","2026-08-28T22:00:31.779069+00:00",8,[17,20,23],{"name":18,"type":19},"Cosmos Labs","vendor",{"name":21,"type":22},"Cosmos EVM","technology",{"name":24,"type":22},"Cosmos SDK","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":46,"vendors":133},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":77,"name":78,"problem":79,"products":80},"patch-management","Automated patch management","Known holes get closed in days, not months.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":42,"name":106,"problem":107,"products":108},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":149},"silent-patch-and-delayed-disclosure-enabled-multi-chain-cosmos-evm-exploit","Silent Patch and Delayed Disclosure Enabled Multi-Chain Cosmos EVM Exploit","Cosmos Labs identified a critical balance-handling vulnerability in the shared EVM module as early as April 2026 but initially underestimated its blast radius, failing to treat it with the urgency a cross-chain flaw demands. By the time the true scope was confirmed on August 13, attackers had a narrow but exploitable window before the patch reached all affected chains. Compounding the failure, the fix was distributed via a silent patch process that bypassed the company's own severity-based disclosure policy, leaving chain operators unaware of the criticality and unable to prioritize remediation. This incident illustrates how shared infrastructure vulnerabilities carry amplified risk — a single flaw in a common module can simultaneously compromise every ecosystem that inherits it. Transparent, severity-appropriate disclosure and coordinated patch deployment are non-negotiable when critical financial infrastructure is at stake.",[139,140,141,142,143,144,145,146,147,148],"NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management Planning","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","NIST CSF 2.0 – RS.CO-2 (Incidents are reported consistent with established criteria)","CIS Control 7 – Continuous Vulnerability Management","CIS Control 17 – Incident Response Management","CIS Control 2 – Inventory and Control of Software Assets (SBOM)","ISO\u002FIEC 29147:2018 – Vulnerability Disclosure","ISO\u002FIEC 30111:2019 – Vulnerability Handling Processes","NIST SP 800-216 – Recommendations for Federal Vulnerability Disclosure Guidelines","NIST CSF 2.0 – ID.RA-1 (Asset vulnerabilities are identified and documented)",{}]