63 New Flaws (Including 0
60
Microsoft Patches 398 Flaws Including a Windows Driver Zero
Microsoft's August Patch Tuesday fixes 398 CVEs, including actively exploited Windows zero-day CVE-2026-68820 used by Lazarus for SYSTEM privilege escalation.
Microsoft's August 2026 Patch Tuesday release addresses 398 new vulnerabilities, 62 rated Critical by the Zero Day Initiative, with CVE-2026-68820 (CVSS 7.0), a use-after-free in the afd.sys Windows kernel driver, the only flaw flagged as actively exploited. Check Point Research attributed exploitation of the privilege escalation bug to Lazarus' Operation Dream Job campaign. Four unauthenticated remote code execution flaws rated 9.8 affect Windows DNS Server (CVE-2026-62878, called wormable by ZDI), Windows Deployment Services (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815) and HPC Pack (CVE-2026-59124). The release also completes a two-part SharePoint fix with RCE component CVE-2026-63520, following July's authentication bypass fix CVE-2026-55040.
82
Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.
78
November 2018 Patch Tuesday: Microsoft fixes 63 flaws, one actively exploited zero-day
60
Microsoft Releases Record
60
60
Microsoft fixes actively exploited Windows CLFS zero-day (CVE-2025-29824)
60
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.
Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.
80
60
Microsoft patches zero-day exploited by attackers (CVE-2023-28252)
60
CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert
CISA added two actively exploited MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog with a September 13 mitigation deadline.
CISA added CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS to the Known Exploited Vulnerabilities catalog on September 10, giving federal agencies until September 13 to apply vendor mitigations. CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service that can expose kernel memory and cause denial of service; CVE-2026-86060 (CWE-88) lets attackers manipulate the trusted RouterOS policy mask for privilege escalation. CISA designated CVE-2026-86060 as requiring forensic triage under Binding Operational Directive 26-04, meaning organizations should hunt for compromise indicators, not just patch. Compromised routers could have altered routing rules, persistence, traffic interception, or use as pivots into internal networks.
78
Microsoft patches Windows LSA spoofing zero-day under active attack (CVE-2022-26925)
60
Microsoft patches actively exploited MSHTML zero-day RCE (CVE-2021-40444)
60
Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)
Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.
Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.
82
60
60
Microsoft fixes 6 zero-days under active attack
60
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
60
CVE-2026-33824: CISA Flags Windows IKE RCE as Exploited
CISA added four actively exploited vulnerabilities to its KEV catalog, headlined by CVE-2026-33824, a Windows IKE Service Extensions remote code execution flaw.
CISA's KEV addition, dated August 18, covers CVE-2026-33824 in Windows IKE Service Extensions, CVE-2026-55040 in on-premises Microsoft SharePoint Server, CVE-2026-59310 in Broadcom VMware vCenter, and CVE-2026-65400 in Apple macOS Screen Sharing. KEV listing confirms observed exploitation in the wild. Three of the four products are frequently deployed as high-value enterprise infrastructure, including remote-access endpoints and collaboration platforms.
78
January 2021 Patch Tuesday: Microsoft plugs Defender zero-day RCE
60
CISA Warns of Critical GitLab Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 to its KEV catalog, warning unauthenticated attackers can read arbitrary files including secrets.
CISA added CVE-2026-85706, an unauthenticated path traversal vulnerability (CWE-35) in the repository commits API of GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog on September 11, 2026, with a remediation deadline of September 14, 2026. The flaw allows arbitrary file reads via improper path confinement, potentially exposing configuration files, access tokens, private keys, and CI/CD variables that enable further intrusion and supply chain compromise. CISA requires forensic triage under Binding Operational Directive 26-04 and urges defenders to review logs for traversal requests and rotate potentially exposed credentials after patching.
80
Attackers plant remote access tools on compromised PaperCut servers
Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.
An ongoing campaign exploits chained zero-days CVE-2026-81578 (improper access control) and CVE-2026-82078 (unsafe dynamic class loading) in internet-facing PaperCut NG and MF Application Servers, enabling authentication bypass and arbitrary Java bytecode execution. Post-compromise activity includes user and domain enumeration, payload download from sendit.sh, and silent installation of SimpleHelp and AnyDesk for redundant remote access; Defused observed CVE-2026-81578/CVE-2026-82078 exploit activity in honeypots since August 29, including data theft via Derby database dumps. Emergency patches were released August 28 and August 30, but 47% of roughly 2,500 PaperCut installs tracked by Huntress run v23 or older, for which no patch is available.
78
Microsoft Releases Fix for Zero-Day Flaw in July 2022 Security Patch Rollout
60
Microsoft fixes actively exploited zero-day reported by the NSA (CVE-2022-24521)
60
⚡ Weekly Recap: Instagram Account Hacks, Android Zero
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
60
60
60
Week in review: Exploited zero-day in Cisco email security appliances, Kali Linux 2025.4 released
60
60
PoC exploit for SysAid pre-auth RCE released, upgrade quickly!
60
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
55
UK Council Attack Linked to Mass Exploitation of SonicWall Flaw
Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.
Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.
90
60
Microsoft fixes two actively exploited zero-days (CVE-2025-21418, CVE-2025-21391)
60
60
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
78
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
GreyNoise tracked a likely Russian-speaking actor that used AI agents (OpenAI Codex, a DeepSeek model) to exploit an authentication bypass (CVE-2026-81578) and unsafe-reflection RCE (CVE-2026-82078) in PaperCut NG/MF starting August 31, 2026. At least 440 servers across 395 organizations in 48 countries were compromised, with one US high school going from initial access to Domain Admin in seven minutes. Escalation relied on LSASS and registry credential harvesting, pass-the-hash, the noPac technique (CVE-2021-42278/CVE-2021-42287), new Domain Admin accounts, and DCSync to steal NTDS.DIT data. Operators staged registry hives, used Ligolo tunneling and certutil Base64 encoding for exfiltration, and one attempt was blocked by Cloudflare WAF.
82
60