Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, significant data breaches, ransomware campaigns, supply-chain compromises, and novel attack vectors targeting critical infrastructure. The volume and sophistication of activity remain high, with Patch Tuesday delivering a large set of fixes, zero-day issues in widely used collaboration tools, ransomware groups innovating with blockchain for resilience, and state-linked actors abusing trusted IT tools. Prioritize patching, monitor for supply-chain risks in plugins and remote tools, and review OT/ICS exposure—especially cellular and private network paths.
1. Microsoft August 2026 Patch Tuesday Fixes ~400 Flaws, Including 3 Zero-Days (One Actively Exploited)
Published: 2026-08-11
Microsoft released its August 2026 security updates addressing approximately 400 vulnerabilities (reports range 394–421 Microsoft CVEs across sources), including three zero-days. One actively exploited elevation-of-privilege flaw (CVE-2026-68820) affects the Windows Ancillary Function Driver for WinSock (afd.sys); it is a use-after-free that allows a locally authenticated attacker to gain SYSTEM privileges and has been tied to North Korean Lazarus Group activity deploying a new FudModule rootkit variant. Two publicly disclosed zero-days (including a Windows User Profile Service issue) were also fixed. The release covers dozens of critical remote code execution and privilege-escalation bugs across Windows, Office, SharePoint, Azure, and other products. Organizations should prioritize the actively exploited driver fix and review systems for related privilege-escalation indicators.
2. Zoom Patches Zero-Click Code Execution Flaws in Annotation Feature (“Zoomsday”)
Published: 2026-08-11
Zoom released patches for multiple vulnerabilities in its annotation/protocol functionality (including CVE-2026-53413 and related issues), enabling a meeting participant to achieve zero-click remote code execution on another attendee’s device across Windows, macOS, Linux, iOS, and Android clients. The flaws required no user interaction beyond being in a call involving screen sharing/annotation and left no obvious visual indicators. Researchers at A Security reported discovering and developing a working exploit chain in under a day using fewer than 20 prompts on publicly available AI models. Fixed versions include Zoom Workplace 7.1.5 / 7.0.6 (and corresponding Rooms/SDK/VDI releases). Update clients and servers promptly; the combination of zero-click nature and AI-assisted discovery underscores rising risks in collaboration tools.
3. CISA, FBI and Partners Issue Advisory on Gunra Ransomware Targeting Critical Infrastructure
Published: 2026-08-10 / 2026-08-11
U.S. agencies (CISA, FBI, NSA, Secret Service, DoD Cyber Crime Center) together with South Korea’s National Police Agency released a joint #StopRansomware advisory on Gunra, a Conti-derived RaaS operation that emerged in 2025 and expanded affiliate operations in 2026. Actors use double extortion (encryption + data leak site threats, typically with 5–7 day deadlines) and have targeted healthcare, financial services, government, professional services, and other critical infrastructure globally. Initial access frequently leverages known Fortinet FortiOS/FortiProxy authentication-bypass flaws (CVE-2024-55591 and CVE-2025-24472). Defenders are urged to patch internet-facing VPN/firewall appliances, maintain offline immutable backups, and segment networks.
4. DeadLock Ransomware Uses Polygon Blockchain Smart Contracts for Resilient C2 and Leak Infrastructure
Published: 2026-08-11 (updated analyses)
The DeadLock ransomware operation (active since mid-2025, with dozens of victims primarily in Europe and beyond across IT, manufacturing, and logistics) has adopted Polygon blockchain smart contracts to store and rotate proxy/C2 addresses and leak-blog content. This “EtherHiding”-style approach makes traditional domain or server takedowns far more difficult; the recovery/chat page issues read-only calls to public Polygon RPC endpoints and routes communication via the decentralized Session messenger. Microsoft and other researchers have detailed the Rust-based encryptor, aggressive anti-forensics, and blockchain-anchored infrastructure. The design highlights a growing trend of ransomware groups leveraging public blockchains for operational resilience.
5. BdThemes WordPress Plugins Hit by Supply-Chain Attack via Poisoned JSON Feed (No Plugin Files Modified)
Published: 2026-08-10 / 2026-08-11
A supply-chain compromise affected multiple BdThemes plugins (Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, Smart Admin Assistant, and others—collectively hundreds of thousands of active installs). Attackers gained write access to a DigitalOcean Spaces bucket serving promotional JSON for the “Biggopti” admin banner component and injected payloads that exploited an unescaped display_id field (XSS, CVSS 5.4). No official WordPress.org plugin files were altered. On every wp-admin page load for logged-in admins, the XSS triggered creation of rogue administrator accounts, installation of a webshell plugin, and persistent Must-Use plugin backdoors (including a magic-login token and stealth modules that hide rogue users). WordPress temporarily disabled the plugins; site owners should audit for unexpected admins, MU-plugins, and webshells and rotate credentials.
6. Novel Private APN Attack Vector Used Against Polish Combined Heat-and-Power Plant (OT Sabotage)
Published: 2026-08-10 / 2026-08-11
CERT Polska published a detailed follow-up on a December 2025 destructive cyberattack against a smaller Polish CHP plant serving ~50,000 residents (part of a broader campaign that also hit renewable installations). Attackers compromised a wind-farm Fortinet device, pivoted via a Teltonika cellular router into the distribution operator’s private Access Point Name (APN) network (which lacked proper isolation), reached the plant’s OT environment, and placed Siemens S7 PLCs into STOP mode while locking them. This shut down a steam turbine and process-water treatment system; operators restored service quickly with no lasting impact on heat/electricity to customers. CERT Polska assessed this as the first observed real-world use of a private APN as an OT entry vector and warned that similar misconfigurations are common. The case underscores risks in shared cellular/OT isolation assumptions.
7. Sandworm (Russian GRU-Linked) Targets IT Professionals with Trojanized WireGuard VPN Client
Published: 2026-08-11
Threat actors associated with the Sandworm group have been targeting system administrators and IT professionals since at least May using fake job offers. Candidates are instructed to install a trojanized WireGuard VPN client that executes PowerShell for persistence and enables further access/lateral movement through the compromised VPN channel. This abuse of a widely trusted, modern VPN tool allows attackers to blend into legitimate remote-access workflows and bypass traditional perimeter controls. Organizations should verify VPN client sources, restrict installation privileges, and monitor for anomalous WireGuard or related process activity, especially in hiring/recruiting contexts.
8. Additional Notable Items: Docker “CopyEscape,” Cisco ClamAV Flaws, and SharePoint Ransomware Exploitation
Published: 2026-08-10 / 2026-08-11
- A Docker vulnerability (CVE-2026-17106, “CopyEscape”) allows malicious containers to overwrite host files and potentially gain root privileges under certain conditions.
- Cisco warned of high-severity ClamAV flaws (affecting Secure Endpoint Connector) with public exploits that can crash the scanning process (DoS).
- CISA confirmed that a high-severity Microsoft SharePoint remote code execution vulnerability (flagged as exploited since early July) is now being abused in ransomware campaigns.
These reinforce the need for rapid container runtime hardening, antivirus component updates, and SharePoint patching/monitoring.
Stay Vigilant
Cyber threats continue to evolve rapidly—combining classic ransomware playbooks with novel vectors (private cellular/APN pivots into OT, blockchain-anchored C2, AI-assisted vulnerability discovery, and supply-chain attacks that leave no file changes on disk). Apply the August Microsoft and Zoom updates immediately, audit WordPress admin accounts and third-party plugin feeds, restrict and verify VPN client installations, segment OT networks carefully (including cellular isolation), and maintain tested offline backups. Subscribe for ongoing daily or weekly digests, and consider continuous monitoring tools for your critical assets. Stay safe online!