Microsoft's August Patch Tuesday release, published August 11, fixed 398 vulnerabilities — including three zero-days, one confirmed exploited in the wild — plus a wormable DNS flaw enabling remote code execution, according to Tenable and SecurityAffairs.
The Critical Fixes
The exploited flaw is CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock (AFD.sys) that attackers — including the North Korea-linked Lazarus Group — have used to escalate privileges and deploy backdoors. The release also covers a wormable DNS remote-code-execution bug and fixes spanning Windows HTTP.sys, Hyper-V, NTFS, Desktop Window Manager, Exchange Server, SharePoint, Teams, Dynamics Business Central, GitHub Copilot, Visual Studio Code, .NET and Azure services.
Patch Pressure
The August release lands as CISA adds actively exploited flaws to its Known Exploited Vulnerabilities catalog — including the Cisco Secure Firewall ASA/FTD heap-inspection bug CVE-2026-20349 and a Metabase SQL injection rated CVSS 10.0 that exposed connected database credentials at five companies. Security teams are being urged to prioritize the three zero-days and the DNS bug, which can spread without user interaction.
Related Articles
CISA and HHS Issue Joint Advisory on Medusa Ransomware After Healthcare Targets Spiked Through August
CISA, the FBI, and HHS on August 18 published a joint #StopRansomware advisory on Medusa, a ransomware-as-a-service operation that has accelerated attacks on healthcare and critical infrastructure operators. The advisory adds HHS as a co-sealer for the first time this year and lists technical indicators, known affiliates, and recommended mitigations.
Lazarus-Linked Actors Exploit Windows Ancillary Function Driver Zero-Day; Adobe Commerce and Magento Hit by Separate Skimming Chain
Microsoft's August 2026 Patch Tuesday addressed 421 vulnerabilities including CVE-2026-68820, a Windows Ancillary Function Driver for WinSock zero-day confirmed exploited by Lazarus-linked actors for SYSTEM-privilege escalation. Adobe separately shipped an urgent fix for CVE-2026-71362 in Adobe Commerce and Magento Open Source under active retail-skimming pressure.
ChainDrop Worm Poisons 444 npm Packages, Slipping Past Standard Defenses
A stealthy new variant of the Shai-Hulud worm dubbed ChainDrop has infected 444 npm packages downloaded about two billion times a month, spreading through tarballs and editor hooks rather than source commits, The Register reported August 15.
Comments (0)
Log in or sign up to leave a comment.
No comments yet. Be the first to share your thoughts.