Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, nation-state campaigns, supply-chain incidents, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. Lazarus Group Exploits Windows Zero-Day (CVE-2026-68820) to Deploy New Backdoor
Published: 2026-08-12
North Korea-linked Lazarus Group exploited a previously unknown privilege-escalation flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys) as a zero-day in its long-running Operation Dream Job campaign. The use-after-free race condition allowed SYSTEM-level access and deployment of a new backdoor (Troy/ForestTiger) plus an updated FudModule rootkit against defense and aerospace targets in France, Germany, Brazil, and India. Microsoft patched it in the August Patch Tuesday release; CISA added it to the KEV catalog.
2. Microsoft August 2026 Patch Tuesday Fixes 421 CVEs, Including Actively Exploited Zero-Day
Published: 2026-08-11 / 2026-08-12
Microsoft’s August security updates address approximately 421 vulnerabilities across Windows, Office, SharePoint, Azure, and other products. One high-severity zero-day (CVE-2026-68820 in AFD.sys) was confirmed exploited in the wild by Lazarus; two additional publicly disclosed zero-days were also fixed. The volume continues the recent trend of large Patch Tuesday releases driven in part by AI-assisted discovery.
3. Adobe Patches Multiple Critical (CVSS 10.0) Flaws in ColdFusion and Campaign Classic
Published: 2026-08-12
Adobe released Priority 1 updates for ColdFusion, Campaign Classic, and Commerce addressing critical vulnerabilities that could enable arbitrary code execution and privilege escalation. Key issues include an unauthenticated OS command injection in ColdFusion (CVE-2026-48362, CVSS 10.0) and incorrect-authorization flaws in Campaign Classic (also CVSS 10.0). Immediate patching is strongly recommended.
4. Critical VMware vCenter Flaw (CVE-2026-59310) Actively Exploited Across 47 Countries
Published: 2026-08-12
Threat actors are actively exploiting a critical directory-traversal vulnerability (CVSS 9.8) in VMware vCenter’s Syslog Server. Researchers observed compromise of at least 361 unique IPs spanning 47 countries (heavily impacting Germany, the US, Turkey, Iran, and France). Attackers achieve code execution and establish persistence via reverse SSH and cron jobs. Broadcom patches were released earlier; rapid deployment remains essential.
5. 737 Malicious Chrome VPN/Proxy Extensions Route Traffic Through Attacker Proxies
Published: 2026-08-12
Researchers identified 737 free VPN and proxy extensions (many impersonating Proton VPN, NordVPN, Surfshark, ExpressVPN, Cloudflare 1.1.1.1, and others) that route nearly all browser traffic through operator-controlled SOCKS5 proxies. The campaign accumulated tens of thousands of installs and primarily targeted users seeking to bypass restrictions. Users should audit and remove suspicious extensions immediately.
6. WindRelay NFC Malware + SpyNote RAT Enable Real-Time Card Fraud in Live Calls
Published: 2026-08-12
A new Android NFC-relay malware family (WindRelay) is being paired with SpyNote RAT in sophisticated live-call (vishing) scams. Fraudsters guide victims to install the RAT, then silently deploy WindRelay to capture and relay EMV card data in real time while the victim remains on the phone—enabling both fraudulent loans and card-present transactions within minutes. Campaigns have targeted users in Czechia, Slovakia, and Slovenia.
7. Gunra Ransomware Targets Critical Infrastructure via Fortinet Flaws
Published: 2026-08-12
US and South Korean agencies issued a joint warning about the Gunra RaaS group, which is exploiting known Fortinet vulnerabilities (including authentication-bypass flaws) to target government and critical-infrastructure organizations worldwide. Affiliates use advanced persistence, living-off-the-land techniques, and large-scale data exfiltration from Microsoft services before encryption. Patch internet-facing appliances and maintain offline immutable backups.
8. Ceva Logistics Cyberattack Disrupts European Warehouses and Exposes Customer Data
Published: 2026-08-12
A cyber intrusion at global logistics provider Ceva Logistics disrupted operations at eight European warehouses beginning around 29 July, causing shipment delays for multiple customers (including retailers Bol and De Bijenkorf, Ajax, Ace & Tate, and Valve/Steam hardware orders). Personal data (names, addresses, phone numbers, emails, order details) of some customers may have been accessed; investigations and recovery efforts continue.
Stay Vigilant
Cyber threats continue to evolve rapidly—combining zero-days, supply-chain compromises, sophisticated social engineering, and ransomware-as-a-service models. Prioritize timely patching (especially for Microsoft, Adobe, VMware, and Fortinet products), audit browser extensions, implement strong MFA and network segmentation, maintain offline immutable backups, and monitor for unusual activity. Subscribe for daily or weekly updates, and consider layered defenses including endpoint detection, email security, and continuous vulnerability management. Stay safe online!