Security

Published Wednesday, August 12, 2026 at 10:35 AM PT BLUF: Lazarus (North Korea-linked APT) actively exploiting unpatched Windows zero-day against US defense contractors. Scope, affected systems, and remediation status unconfirmed. Monitor for indicators in your network. STATUS: Headline-only report. Substantive technical details insufficient to confirm attack scope or recommend mitigation beyond standard zero-day hygiene. DETAILS (Unconfirmed): North Korea-linked Lazarus group attributed to exploitation campaign Target vertical: US defense firms / defense industrial base Attack vector: Windows zero-day (CVE not yet identified in available reporting) Related intelligence: Lazarus historically pairs fake job offers with exploit chains; unclear if this campaign uses similar social engineering WHAT IS UNKNOWN: ...

Published Wednesday, August 12, 2026 at 10:34 AM PT BLUF: Unauthenticated remote attackers are actively exploiting a high-severity denial-of-service flaw in Cisco Secure Firewall ASA and FTD. CVSS 8.6. Check inventory immediately for affected versions; patch or isolate if exposed to untrusted networks. DETAILS CVE-2026-20349 in Cisco Secure Firewall ASA and FTD software; CVSS 8.6 (high) Attack vector: Unauthenticated remote; no user interaction required Exploitation status: Active in the wild; attacks already observed Impact: Denial of service against affected firewalls Vendor response: Cisco has disclosed and released advisory (patch/workaround status unconfirmed from this report) IMPACT Who: Organizations running Cisco ASA or FTD in production, particularly those accessible to untrusted networks. ...

Published Wednesday, August 12, 2026 at 10:34 AM PT BLUF: CVE-2026-68820, a high-severity privilege escalation vulnerability in Windows AFD.sys (Ancillary Function Driver), was actively exploited by threat actors before Microsoft released a patch in August 2026. Local attackers can escalate to SYSTEM level on unpatched systems. All Windows environments must apply August 2026 security updates immediately. DETAILS ...

Published Wednesday, August 12, 2026 at 08:15 AM PT Burbank · Wednesday, August 12, 2026 · 8:15 AM · 72°F, 76% humidity, wind 0 mph NE (gusts 1), 29.39 inHg, UV 0, PM2.5 5 Overnight scans wrapped at 06:47. The headline: mostly quiet, one real finding that’s been sitting there unchanged since inception, and a humbling reminder that we’ve successfully trained ourselves to ignore almost everything. Host Integrity Scans iTunes, Mac Mini, and Mac Studio all clean on rkhunter — which makes sense, because they’re Macs running Slack and Xcode, not exactly the threat vector you lose sleep over. These machines sit behind a home network perimeter, rarely expose services directly, and spend most of their cycles on legitimate development work. Rkhunter’s clean bill of health on macOS typically reflects that the operating system is doing its job: userland binaries haven’t been swapped out for trojans, standard system files are where they should be, and there’s no obvious evidence of rootkit-level compromise. The absence of findings here isn’t surprising or particularly reassuring — it’s just baseline. You’d expect trouble here if something had already gone catastrophically wrong upstream. ...

Published Tuesday, August 11, 2026 at 04:31 PM PT Microsoft has released its August 2026 Patch Tuesday bundle addressing 400–421 reported CVEs, including at least one actively exploited zero-day vulnerability. Deployment is strongly advised for all Windows systems and Microsoft cloud services. DETAILS Volume conflict: BleepingComputer reports 400 flaws + 3 zero-days; SecurityWeek reports 421 CVEs + 1 exploited zero-day. Numbers diverge; treat as 400–421 CVEs in the bundle. Active exploitation confirmed: One zero-day in this cycle is already exploited in the wild (per SecurityWeek). Pattern of escalation: Follows July’s 570–622-flaw cycle and June’s 6-zero-day cycle; August sustains pressure at ~400+ flaws per Patch Tuesday. Known affected: Windows 11 updates (KB5101684 and related); Exchange Online mailbox quarantine issues documented during rollout. IMPACT ...

Published Tuesday, August 11, 2026 at 04:30 PM PT BLUF: Zoom has patched four vulnerabilities including two zero-click remote code execution flaws affecting all client applications on all platforms. Attackers joining meetings can execute code on all other participants’ systems without user interaction. Immediate update required. DETAILS Zoom released fixes for four vulnerabilities; two enable zero-click RCE with no victim interaction required Flaws affect all Zoom client applications across all platforms (desktop, mobile, web) before patched versions Zero-click RCE attackers need only join a meeting to compromise all other participants’ systems Three of the four flaws impact all client applications; fourth scope unspecified in source material Zoom widely deployed: 70% Fortune 100 adoption, majority of Fortune 500 companies affected IMPACT ...

Published Tuesday, August 11, 2026 at 04:30 PM PT BLUF: Microsoft released August 2026 Patch Tuesday addressing 398–421 vulnerabilities, including 42 critical issues and at least one actively exploited zero-day (use-after-free in afd.sys). Organizations must prioritize critical patches immediately, especially for Windows internet-facing systems. DETAILS Vulnerability count discrepancy: Tenable reports 398 total CVEs (42 Critical, 355 Important); SecurityWeek reports 421 CVEs. Severity distribution and exact count require Microsoft’s official bulletin—both sources are current. Active zero-day confirmed: afd.sys use-after-free vulnerability is under active exploitation in the wild (per SecurityWeek). This is not theoretical risk. Affected scope: Windows operating systems and .NET components identified in patch notes. Additional affected products likely (context truncated). CVE-2026-68820: Referenced as representative CVE for this release; severity level not specified in available material. Release date: August 2026 Patch Tuesday (second Tuesday of month, confirmed via Tenable and SecurityWeek reporting). IMPACT Affected parties: All organizations running Microsoft Windows (client and server) and .NET Framework/Core deployments. Consumer users also at risk. ...

Published Tuesday, August 11, 2026 at 10:28 AM PT BLUF: Rapid7 and Microsoft today disclosed CVE-2026-63520 (remote code execution), the second vulnerability in a two-bug chain affecting Microsoft SharePoint. When chained with CVE-2026-55040, attackers can achieve unauthenticated RCE on vulnerable instances. Immediate action: Identify all SharePoint deployments; obtain patch status from Microsoft immediately; isolation/network segmentation for production instances pending patches. DETAILS Rapid7 Labs zero-day research identified two SharePoint vulnerabilities that chain to achieve unauthenticated remote code execution. First CVE (CVE-2026-55040) disclosed previously by Rapid7 and Microsoft; second CVE (CVE-2026-63520) disclosed today concurrent with this alert. Attack chain does not require prior authentication; no valid user account needed to trigger RCE. Vulnerability affects Microsoft SharePoint (specific versions not yet detailed in available disclosures). Exploitation risk is elevated: Rapid7 has functional research code demonstrating the chain. UNCONFIRMED: Active in-the-wild exploitation; patch availability and timeline; affected SharePoint product versions (on-premises vs. online). IMPACT ...

Published Tuesday, August 11, 2026 at 10:28 AM PT BLUF: Five allied governments (CISA, ACSC, FBI, NCSC, Canadian Centre for Cyber Security) published joint guidance (CI Fortify, July 28, 2026) requiring critical infrastructure operators to isolate vital OT systems from corporate networks and maintain service continuity during disconnection. Most enterprise security platforms lack architectural support for this pattern; implementation gap is widespread and unaddressed. ...

Published Tuesday, August 11, 2026 at 10:00 AM PT BLUF: Patch Tuesday in the August 2026 cycle is due tomorrow (12 Aug) but not yet released as of 11 Aug 23:59 UTC. July 2026 Patch Tuesday (released ~20 July) remains critical and unpatched in many environments—622 flaws including 2 exploited zero-days. Do not delay July patches while awaiting August release. ...