Patch Tuesday week turned into patch-everything week. Cisco, Microsoft, Metabase, Zoom, WordPress, Windows AFD.sys, VMware vCenter, SAP Commerce Cloud, and a stack of MongoDB bugs all got fixes in the same stretch, and attackers didn't wait around. Several of these — the Cisco firewall DoS, the Metabase SQL injection, the Windows AFD.sys kernel flaw, the SonicWall SMA1000 pair — are already on CISA's exploited list, which means someone was using them before the vendor even had a patch out.
The pattern connecting most of today's breaches is third parties, not direct hacks. SafePal, Trezor, and Steam hardware buyers all got hit because a vendor they use — a plug-in, a shipping partner, Metabase itself — got popped first. Ceva Logistics alone is dragging down customer data at banks, retailers, and Valve. Beacon's single leaked AWS key took out every charity the company serves. None of these companies were breached directly; their suppliers were.
The zero-day count is also unusually high for one day, and North Korea's Lazarus group is behind more than one of them. Lazarus used the Windows AFD.sys flaw to drop an upgraded FudModule rootkit before Microsoft even shipped a fix, part of the same Dream Job campaign that's been running fake recruiter lures against defense and aerospace workers for years. Add in a live npm supply-chain compromise spreading
Cisco has confirmed active exploitation of CVE-2026-20349, an unauthenticated denial-of-service flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software. Attackers can send a crafted HTTP request to force a device reload, with devices at risk only if SSL VPN/WebVPN, IKEv2 client services, or (on FTD) Zero Trust Network Access are enabled; FMC is unaffected. Cisco has released hot fixes across multiple ASA and FTD branches and urges immediate patching, since no workaround fully resolves the issue.
Researcher Chaotic Eclipse has released "ShieldBreak," an exploit chain that bypasses Microsoft's July 2026 patch for CVE-2026-50656 ("RoguePlanet"), a privilege-escalation flaw in Defender's Malware Protection Engine (mpengine.dll). The bug lets low-privilege local users gain NT AUTHORITY\SYSTEM access via a race condition and improper link resolution, affecting all current Windows 10, 11, and Server 2025 systems running Defender, including fully patched ones (Engine v1.1.26060.3008). No fix exists yet for the bypass, and Arctic Wolf recommends compensating controls like ASR rules, tamper protection, and restricted admin rights until Microsoft issues an update.
WordPress 7.0.4 fixes a high-severity remote code execution flaw, CVE-2026-65640 (CVSS 8.8), affecting installations that use Imagick and Ghostscript. Attackers with Author-level permissions or higher can upload a malicious PNG containing embedded PostScript, which Ghostscript then executes. The fix, backported to all branches back to 4.7, updates the load() function to check file contents before passing them to Imagick, blocking the exploit.
Zoom fixed a critical zero-click flaw, tracked as CVE-2026-53413 and dubbed “Zoomsday,” in its annotation feature that let a meeting participant execute code on another user's device with no clicks or interaction required. The stack buffer overflow, found by A Security, affects Zoom clients on Windows, Mac, iOS, Android and Linux up to version 7.0.5. Zoom released patched versions 7.1.5 and 7.0.6 for Workplace, Rooms and Meeting SDK, alongside fixes for two related flaws, CVE-2026-53414 and CVE-2026-53415.
North Korea's Lazarus group exploited a Windows kernel zero-day, CVE-2026-68820, in the AFD.sys driver to deploy an upgraded FudModule rootkit, Check Point Research reported. Microsoft patched the flaw August 11. The campaign, part of the ongoing Operation Dream Job, targets defense, aerospace, and aviation organizations in Europe, India and Brazil using fake recruiter lures, trojanized PDF viewers, and hijacked Roundcube and WordPress servers for command-and-control.
CISA has added two SonicWall SMA1000 vulnerabilities, CVE-2026-15409 (CVSS 10.0, an unauthenticated SSRF flaw) and CVE-2026-15410 (CVSS 7.2, a code-injection bug allowing authenticated admins to run OS commands), to its KEV catalog after ransomware groups exploited them. Attackers, including the INC Ransomware operation and a cluster tracked as UTA0533, have chained the flaws to gain root access on SMA 6210, 7210, and 8200v appliances running hotfix versions 12.4.3 or 12.5.0. SonicWall has released patched versions and urges immediate updates, log review, and password resets, as federal agencies faced a July 17, 2026 patch deadline.
Attackers are actively exploiting CVE-2026-59310, a critical directory traversal flaw in VMware vCenter Syslog Server disclosed by Broadcom on July 29, to deploy the open-source reverse_ssh tool for persistent remote access. Researchers at QUIRSO tracked 361 compromised IPs across 47 countries, with Germany, the US, Turkey, Iran, and France hit hardest, and suspect an APT actor is behind the campaign. Broadcom has released patches for vCenter 8.0, 9.0, and 9.1 but no workarounds exist for unpatched systems.
Apple began sending a new round of threat notifications to iPhone users on August 13, warning them of mercenary spyware attacks, a practice it has followed since 2021 for highly targeted incidents. The alerts don't name a specific attacker or spyware, though Apple has previously cited NSO Group's Pegasus, and typically target journalists, activists, politicians and diplomats. Apple advises recipients to enable Lockdown Mode, consult a security expert, and verify alerts at account.apple.com, noting it never asks for passwords, verification codes or files.
A supply chain attack traced back to Aqua Security's compromised Trivy scanner hit the LiteLLM Python library, exposing more than 2,500 organizations and 434,000 CI/CD pipelines, according to CloudSEK. Two malicious LiteLLM versions, 1.82.7 and 1.82.8, were live on PyPI for roughly 40 minutes but had already begun stealing package credentials, cloud and SSH keys, tokens, and AI provider keys from affected systems. Organizations named in CloudSEK's findings include Nvidia, AWS, Samsung, Cisco, FedEx, and Volkswagen, though CloudSEK cautions the figures reflect reconstructed exposure, not confirmed compromise for every listed party.
Cisco patched multiple critical vulnerabilities in Catalyst SD-WAN Software, found internally rather than by outside researchers, with no evidence of active exploitation. The most severe flaws, CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, score 9.9 and involve input validation, access control, and link resolution issues affecting all deployment modes, including on-premises, cloud, and government FedRAMP environments. There are no workarounds; Cisco says fixes are available in versions 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, and 26.1.2, and urges customers on older or unsupported branches to upgrade immediately.
WordPress plugin vendor BdThemes suffered a supply chain compromise after attackers gained write access to its DigitalOcean Spaces bucket, poisoning JSON data used by seven plugins—including Element Pack Addons for Elementor with over 100,000 installs—to exploit a medium-severity (CVSS 5.4) XSS flaw in the "Biggopti" banner component. The malicious script silently creates rogue admin accounts, installs a PHP web shell, and establishes persistence via a magic-login backdoor, with the C2 infrastructure linked to prior attacks on Advanced Responsive Video Embedder and OptinMonster. WordPress.org has pulled all affected plugins from its directory pending review.
OpenAI has launched GPT-5.6-Cyber, a specialized model built on GPT-5.6-Sol for authorized penetration testing, exploit chain development, and zero-day discovery, completing 95% of dual-use security prompts versus 1.5% for its predecessor. Access is restricted to trusted partners through the expanded Daybreak program's new Blue and Red tiers, with participants including CrowdStrike, Palo Alto Networks, IBM, and Accenture. The model has already found a high-severity V8 engine flaw and bugs in an unnamed mobile OS, database, and kernel.
Microsoft disclosed CVE-2026-70329, an integer overflow flaw in Outlook rated 8.8 on CVSS, as part of its August 2026 Patch Tuesday, affecting Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Outlook 2016 in 32-bit and 64-bit versions. Exploitation requires a user to open a malicious file and is rated "unlikely," with no active exploitation reported; Microsoft credited an anonymous researcher and released fixes, including KB5002755 for Outlook 2016, among 394 vulnerabilities patched that month.