In August 2026, Microsoft released patches addressing over 400 vulnerabilities, including a serious zero-day exploit identified as CVE-2026-68820. This particular flaw is a use-after-free vulnerability affecting the Windows Ancillary Function Driver for WinSock (AFD.sys), which could allow a low-privileged local attacker to gain elevated privileges to the SYSTEM level. This means that attackers with local access could potentially execute malicious applications to take control of affected systems. The urgency of this update is underscored by the fact that the vulnerability is already being exploited in the wild. Users and organizations relying on Windows systems should prioritize applying these updates to mitigate potential risks.
A security researcher known as Chaotic Eclipse has released a proof of concept (PoC) for a new zero-day vulnerability named ShieldBreak, affecting Microsoft Defender. This vulnerability successfully bypasses the previously issued patch for CVE-2026-50656, known as RoguePlanet, which was intended to address a race condition. If exploited, ShieldBreak could allow attackers to execute code with SYSTEM-level privileges on affected systems. This presents a serious risk to users of Microsoft Defender, as the flaw can potentially compromise the security of their devices. Companies using Microsoft Defender should take immediate action to assess their systems and apply necessary security measures to mitigate this risk.
A security researcher known as Chaotic Eclipse has released a proof-of-concept (PoC) for a serious zero-day vulnerability dubbed ShieldBreak, affecting Microsoft Defender for Windows. This vulnerability allows attackers to bypass the existing patch for CVE-2026-50656, also known as RoguePlanet, which has a CVSS score of 7.8, indicating a significant security risk. The flaw could enable unauthorized access with SYSTEM privileges, putting users' systems at risk. This discovery is crucial as it highlights the weaknesses in Microsoft Defender's security measures, potentially exposing millions of users to exploitation. Companies using Microsoft Defender should remain vigilant and apply any available patches while monitoring for any signs of exploitation.
Microsoft's August Patch Tuesday updates address several vulnerabilities, with CVE-2026-62878 standing out due to its severity. This remote code execution vulnerability in Windows DNS Server has a high CVSS score of 9.8 and can be exploited without user interaction. This means attackers could potentially take control of affected systems easily, posing a significant risk to organizations relying on Windows DNS servers for their operations. It’s crucial for system administrators to prioritize applying this patch to protect their networks from potential exploitation. The updates are part of Microsoft's ongoing efforts to enhance security across its products, but this particular flaw underscores the importance of timely patch management.
Microsoft has released its monthly security updates, addressing a total of 398 vulnerabilities, including a serious zero-day flaw that is currently being exploited in attacks. This particular vulnerability, tracked as CVE-2026-68820, affects a core Windows kernel driver responsible for network socket operations. Attackers who already have code running on a targeted machine can exploit this flaw to gain elevated privileges, potentially allowing them to execute commands with SYSTEM-level access. Given the active exploitation, users and organizations should prioritize applying the patch to mitigate the risk of unauthorized access. The patch is crucial for maintaining system security and preventing further attacks.
The Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating they are actively exploited in the wild. The vulnerabilities include a heap inspection flaw in Cisco Secure Firewall Adaptive Security Appliance (CVE-2026-20349), a use-after-free vulnerability in Microsoft Windows Ancillary Function Driver for WinSock (CVE-2026-68820), and a SQL injection vulnerability in Metabase (CVE-2026-72898). These vulnerabilities pose significant risks, especially to federal agencies, prompting CISA to emphasize the need for rapid remediation of high-risk vulnerabilities. While the Binding Operational Directive 26-04 applies specifically to federal agencies, CISA encourages all organizations to adopt similar risk-based approaches to vulnerability management. Organizations aware of other exploited vulnerabilities can submit them for potential inclusion in the KEV Catalog.
Recent research has shown vulnerabilities in passkey systems designed to enhance online security by replacing traditional passwords and resisting phishing attacks. Three separate studies demonstrated methods for bypassing these protections without breaking the underlying cryptography. For instance, attackers were able to exploit signed authentication data exposed by Windows, leverage a cloud-synced passkey system compromised by existing malware on a victim's device, and other techniques. This is concerning for users and organizations relying on passkeys for secure authentication, as it suggests that even advanced security measures can be undermined. As these attacks become more sophisticated, it raises questions about the reliability of passkeys and the need for ongoing vigilance in security practices.
ABB Ability Zenon is facing significant vulnerabilities that could allow attackers to bypass security measures, crash systems, and compromise data. The issues primarily affect the IIoT services bundled with MongoDB version 4.2 across all versions of ABB Ability Zenon. Notably, vulnerabilities such as improper handling of length parameters and exploitation of uninitialized memory could lead to unauthorized actions. ABB has recommended urgent remediation steps, including replacing the bundled MongoDB with a supported version and uninstalling IIoT services if they are not needed. Given that these vulnerabilities impact critical infrastructure sectors like energy and healthcare, organizations using ABB Ability Zenon must act quickly to secure their systems.
Cybersecurity researchers have identified a supply chain attack targeting QuickFox, a VPN tool favored by overseas Chinese users. The attack has reportedly been active since at least August 2025, involving a compromised version of the application that delivers the FDMTP backdoor. This backdoor allows attackers to gain unauthorized access to affected systems, posing significant risks to user privacy and data security. This incident raises concerns about the security of software supply chains, particularly for tools that are essential for users in sensitive environments. Users of QuickFox should be vigilant and consider alternative solutions while the situation is investigated further.
The latest Malware newsletter from Security Affairs covers several significant developments in malware tactics. Notably, the DPRK's BlueNoroff group has upgraded its MaaS (Malware as a Service) ecosystem, introducing modular tools that enhance its capabilities. Additionally, a new threat called SourTrade has emerged, leveraging malvertising to deliver browser-assembled malware. Another concerning development is MedusaHVNC, which functions as a hidden desktop tool designed to capture live Windows sessions, potentially exposing sensitive information. The newsletter also includes an analysis of a malware strain named 'Cruciferra', though details on its specific impact are not provided. These findings underscore the evolving nature of cyber threats and the need for users and companies to stay informed and vigilant against such attacks.
A vulnerability has been identified in the Mitsubishi Electric CC-Link IE TSN Communication Protocol that could allow attackers on the same network segment to manipulate communication data. This vulnerability, tracked as CVE-2026-13584, can lead to denial-of-service (DoS) conditions by disrupting the control functions of affected products. A wide range of Mitsubishi Electric MELSEC MX controllers, motion modules, and various remote and safety modules are affected, including models MX-R300, MX-R500, and several others. Users of these devices should be aware of the potential risks, as the exploitation of this flaw could significantly impair operational capabilities. Addressing this vulnerability is crucial for maintaining the integrity and reliability of systems relying on this communication protocol.
Kaspersky researchers have identified a new strain of ransomware called GenieLocker, which targets Windows, Linux, and ESXi systems. This ransomware is associated with a group known as Toy Ghouls, which is primarily focused on financial extortion. The emergence of GenieLocker is concerning because it indicates a growing trend of customized ransomware that can impact multiple operating systems, making it a versatile threat for various organizations. Companies using affected systems should be vigilant and implement strong security measures to protect their data. With ransomware incidents on the rise, understanding the capabilities of threats like GenieLocker is crucial for effective defense strategies.
Researchers have identified a significant vulnerability in Active Directory Certificate Services (AD CS), designated as CVE-2026-54121, also known as 'Certighost.' This flaw allows attackers to elevate privileges, potentially leading to a complete domain takeover. AD CS is a critical component of Microsoft Windows Server that organizations use to manage their Public Key Infrastructure (PKI). The release of a proof-of-concept exploit means that attackers may quickly learn how to exploit this vulnerability. Organizations using AD CS should be particularly vigilant as the risk of exploitation increases with the availability of this exploit.
A cybercrime group linked to China has been using a sophisticated crypter service named Cruciferra to hide malware in attacks targeting Indian taxpayers, tax professionals, and corporate finance teams. Recent analysis from Proofpoint reveals that this service allows various cybercriminals to deliver different forms of remote access malware while evading detection. Cruciferra employs techniques such as Bring Your Own Vulnerable Driver (BYOVD) and process ghosting, which help the malware operate stealthily on victim systems. The implications of these tactics are significant, as they enable attackers to compromise sensitive financial data and potentially cause substantial financial harm to individuals and organizations. This development is a reminder for users and companies to remain vigilant against evolving cyber threats and to implement strong security measures.
A recent security flaw in Bing's image processing system allowed crafted SVG files to execute commands with elevated privileges, specifically as NT AUTHORITY\SYSTEM on Windows servers and as root on Linux machines. This vulnerability was identified through testing by security researchers at XBOW, who found that the issue was not isolated to a single machine but was present across multiple hosts and network ranges within Bing’s infrastructure. Microsoft responded by issuing two critical CVEs, CVE-2026-32194 and another unnamed one, to address the vulnerabilities. This incident raises significant concerns about the security of cloud-based services and the potential for attackers to exploit similar flaws to gain unauthorized access to sensitive systems. Companies relying on these services should prioritize patching and review their security protocols to mitigate risks from this kind of vulnerability.