CVE-2022-41127, CVE-2026-27302, CVE-2026-45659, CVE-2026-48273, CVE-2026-48362, CVE-2026-48381, CVE-2026-50522, CVE-2026-50656, CVE-2026-55040, CVE-2026-56164, CVE-2026-58644, CVE-2026-63520, CVE-2026-68820, CVE-2026-71362, CVE-2026-71384, CVE-2026-71398
Get tomorrow's brief in your inbox
Today: Microsoft SharePoint is under active attack just days after a PoC dropped. North Korea's Lazarus Group burned a Windows zero-day (CVE-2026-68820) to deploy backdoors in defense contractors. A new Windows Defender zero-day (CVE-2026-50656) gives any user SYSTEM privileges on fully patched Windows 11.
SharePoint CVE-2026-55040 Exploited in the Wild
Microsoft SharePoint is being actively exploited following the August 11 release of a Rapid7 proof-of-concept for CVE-2026-55040, a critical authentication bypass flaw patched in July 2026. The vulnerability allows unauthenticated attackers to bypass authentication over the network, impersonate SharePoint site users or administrators, and perform arbitrary operations. The flaw chains four separate weaknesses in JWT token validation, including acceptance of "alg: none" tokens and failure to verify actor token signatures. CISA added CVE-2026-56164, CVE-2026-58644, CVE-2026-50522 (EPSS 77th percentile, 100%ile, CISA KEV due July 25), and CVE-2026-45659 (ransomware-linked, CISA KEV due July 4) to the KEV catalog earlier this summer as part of a broader SharePoint exploitation wave. Defused reported honeypot hits starting August 12, leveraging the Rapid7 script. Rapid7 also disclosed CVE-2026-63520 (patched August 2026), which chains with CVE-2026-55040 for unauthenticated RCE, though no exploitation of that combo has been observed.
Windows Defender Zero-Day CVE-2026-50656 (ShieldBreak)
Nightmare Eclipse dropped a fresh zero-day on August 2026 Patch Tuesday targeting Microsoft Defender. CVE-2026-50656 exploits a user-mode callback hook during Defender's cloud-hydration scan via Cloud Filter API to gain SYSTEM privileges. The exploit works on the latest Windows 11 and Windows Server 2025, likely affects Windows 10, and requires Defender to be active. Researchers disagree with the claim that ShieldBreak bypasses the July-patched RoguePlanet (CVE-2026-50656 is distinct in mechanism). Detection queries are public. EPSS 10.7% (95th percentile).
Lazarus Exploits Windows Zero-Day CVE-2026-68820 in Operation Dream Job
North Korea's Lazarus Group exploited CVE-2026-68820 (CVSS 7.0, patched August 2026, CISA KEV due August 25) to escalate privileges and deploy backdoors at defense and aerospace companies in France, Germany, Brazil, and India. The campaign uses fake recruiter lures on LinkedIn, trojanized PDF viewers, and DLL side-loading to install the Troy backdoor and ForestTiger. The exploit targets Windows Ancillary Function Driver for WinSock (AFD.sys) and grants SYSTEM access. The attack also deploys MISTPEN, a lightweight downloader using Microsoft Graph API and OneDrive for C2, along with reconnaissance, persistence, and screenshot modules. EPSS 0.4% (28th percentile), but CISA KEV listed.
Ransomware Hits Colombian Justice Ministry
Colombia's Ministry of Justice confirmed a ransomware attack on August 2, five days before the presidential transition. The attack encrypted files and degraded services around drug monitoring and legal processes. Acting Minister Cielo Rusinque denied data exfiltration, stating only encryption occurred. ColCERT had issued a warning one day prior noting increased ransomware focus on Colombia. The country has seen a surge in attacks, including breaches at DIAN (tax authority) in March and Ecopetrol (oil and gas) in July. Exploit attempts in Colombia tripled in the past year, driven by exposed infrastructure and rapid cloud adoption outpacing security controls.
Canadian Hospital Ransomware Disables Doors and HVAC
A ransomware attack on a Manitoba hospital (Winnipeg's largest) hit facility management systems, affecting building doors and HVAC equipment. The incident underscores growing threats to operational technology in healthcare.
Akira Ransomware Breaks Its Own Encryptor
Akira ransomware operators blocked a victim's security tools during an attack and inadvertently broke their own encryption process. The incident highlights operational mistakes even among established ransomware groups.
Enterprise Defenses Fail Inside the Perimeter
Picus Labs' Blue Report 2026 shows perimeter defenses recovered to 69% effectiveness (matching 2024), but post-compromise prevention dropped to 37%. Noisy actions (lateral movement via SMBExec, UAC bypass) are blocked ~85-90% of the time, but quiet reconnaissance (domain enumeration, session mapping) is stopped only 10% of the time. Credential theft from memory locations other than LSASS succeeds 94% of the time, while the classic LSASS dump is blocked. The report analyzed 338 million attack simulations across client production environments in H1 2026.
JWR Phishing Framework (Likely "The Outsider" Variant)
Cisco Talos identified an undocumented phishing framework branded "JWR" that impersonates checkout and login pages for Shopify, PayPal, Apple, Klarna, and banks. The client uses an AES-CTR encrypted WebSocket to let operators steer victim sessions in real time, harvesting payment cards, SSNs, passport images, 2FA codes, and device fingerprints. Talos assesses with medium confidence that JWR is a variant of "The Outsider" PhaaS platform. Real-world campaigns targeted Southeast Asia and the Middle East via SMS lures impersonating toll authorities and postal services.
Belgian eID Browser Extension Allows RCE and Identity Theft
The Connective signing extension, used by 2 million Belgian citizens to authenticate to government and banking portals with electronic ID cards, contained multiple critical vulnerabilities allowing RCE, identity theft, and payment card hijacking. The extension failed to verify which website was connecting, accepted generic activation tokens, and allowed replay attacks. Issues were fixed July 22, 2026. The extension currently has a 1.7-star rating on Chrome Web Store.
737 Chrome VPN Extensions Route Traffic Through SOCKS5 Proxies
Socket discovered 737 free VPN and proxy extensions targeting Russian-speaking users, routing browser sessions through a single SOCKS5 infrastructure. 274 impersonate legitimate VPN brands (Proton, NordVPN, Surfshark, ExpressVPN). The extensions place the operator in an adversary-in-the-middle position to observe destinations, TLS SNI, and plaintext HTTP. 221 have been removed, 516 remain active. The operator appears to run a subscription VPN business in Russia and submitted false claims to Chrome Web Store reviewers.
OpenAI, Anthropic, Google API Flaw Exposes Hidden AI Reasoning
Researchers recovered hidden AI reasoning, API keys, and passwords from encrypted reasoning objects in OpenAI, Anthropic, and Google reasoning APIs. The flaw allowed replay of reasoning blocks across sessions and users, and weaker models could decode reasoning from stronger models. Across 6,708 public agent trajectories, researchers decoded 315,320 thinking blocks and found 704 privacy artifacts: 62 API keys, 33 passwords, 24 access tokens, 7 private keys. The attack also enabled invisible prompt injection via opaque reasoning blocks. Mitigations were deployed as of August 2026.
Salesforce and ServiceNow Campaign "City-Forum"
An unknown threat actor has been using custom tools since March 2025 to steal data from Salesforce and ServiceNow instances with overly permissive guest access. The campaign targets telecom, financial services, enterprise software, security, and public-sector portals worldwide. The attacker researched Salesforce Lightning Web Runtime (LWR) data-access layers and ServiceNow Service Portal search endpoints, building tools to extract account data, contacts, leads, knowledge bases, and catalogs.
See Critical Alerts for CVE-2026-68820 (Lazarus AFD.sys exploit) and CVE-2026-50656 (ShieldBreak Defender zero-day).
Adobe Patches Three CVSS 10.0 Flaws
Adobe fixed critical vulnerabilities in ColdFusion (CVE-2026-48362, OS command injection; CVE-2026-48273, eval injection; CVE-2026-71384, DoS), Commerce (CVE-2026-71362, privilege escalation), and Campaign Classic (CVE-2026-71398, CVE-2026-27302, both RCE; CVE-2026-48381, SQL injection leading to RCE). ColdFusion and Campaign Classic updates are Priority 1. Sansec reports CVE-2026-71362 (Commerce/Magento) is being actively exploited to switch customer sessions and steal data.
Intel, AMD Patch 80+ Vulnerabilities
Intel published 42 advisories covering 72 vulnerabilities, including high-severity flaws in PROSet/Wireless WiFi (privilege escalation, DoS), Xeon processors, Data Center Attestation Primitives, and Active Management Technology. AMD patched 12 vulnerabilities across Vitis, Ryzen Master, SEV-SNP, and Power Design Manager, including five high-severity issues in Vitis leading to private key disclosure, privilege escalation, and arbitrary code execution.
Microsoft Dynamics NAV/365 Business Central Update
Microsoft updated CVE-2022-41127 (RCE) build numbers. Informational update only.
Attackers are exploiting SharePoint vulnerabilities within days of PoC releases, a pattern seen five times this summer. Post-compromise defenses remain weak against quiet reconnaissance and credential theft, while perimeter controls have recovered. Nation-state actors (Lazarus) continue to burn zero-days in targeted espionage campaigns, and phishing frameworks are becoming more sophisticated with real-time operator control via encrypted WebSockets. The Belgian eID incident and the 737 fake VPN extensions highlight browser extension supply-chain risks.