Weekly recap: Week of 10 to 16 August 2026

• vulnerabilities4 sources
  Shattering the Dream - When a Job Offer Becomes a Zero-Day AttackSource ↗

  Check Point Research documented Operation Dream Job, a Lazarus-affiliated campaign targeting defense and aerospace sectors globally through fake job offers and trojanized PDF viewers. The campaign deployed new malware including the Troy backdoor and exploited CVE-2026-68820, a zero-day in Windows AFD.sys driver, to escalate privileges using an updated FudModule rootkit; Microsoft patched the vulnerability on August 11, 2026. The threat actors compromised Roundcube webmail and other web servers to establish command-and-control infrastructure, leveraging a previously undocumented PHP webshell called RelayShell to relay traffic and maintain persistence.

• vulnerabilities4 sources
  CISA Adds Three Known Exploited Vulnerabilities to CatalogSource ↗

  CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation evidence: a Cisco firewall heap inspection flaw, a Microsoft Windows use-after-free issue, and a Metabase SQL injection bug. The agency reinforced that federal agencies must prioritize patching KEV-listed vulnerabilities on publicly exposed systems and investigate potential compromise before patch application, per Binding Operational Directive 26-04. CISA encourages all organizations to adopt risk-based vulnerability management aligned with KEV prioritization.

  Grouped: similar headlines and the same Common Vulnerabilities and Exposures (CVE) record (CVE-2026-20349).

• vulnerabilities3 sources
  Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote AccessSource ↗

  Attackers are actively exploiting CVE-2026-59310, a critical directory-traversal vulnerability in Broadcom VMware vCenter with a CVSS score of 9.8. The flaw allows remote code execution for network-adjacent threat actors. Patches have been released, though the article text is incomplete.

  Grouped: similar headlines.

• vulnerabilities
  Metasploit Wrap Up: Lot of summer shells and fit http profilesSource ↗

  Metasploit Framework 6.5 released with 13 new exploit modules targeting remote code execution vulnerabilities in WordPress, Ghost CMS, Joomla, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, and a Linux kernel privilege escalation. The release also introduces HTTP malleable C2 profiles for Meterpreter payloads, Model Context Protocol (MCP) functionality, Windows ARM (AArch64) reverse shells, and numerous bug fixes and enhancements.

• vulnerabilities
  The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposureSource ↗

  Tenable's Research Special Operations team is tracking a cluster of seven agentic AI incidents since July 2026, anchored by Taiwan's confirmed August 2026 attack in which autonomous AI agents mapped 21 government systems, compromised 85 accounts, and exfiltrated 2,564 personnel records in four days. The cluster also includes JADEPUFFER (which exploited CVE-2025-3248 in Langflow for database extortion) and knaithe/KnYuan (a Chinese-speaking operator using the same AI agent framework for autonomous vulnerability scanning), demonstrating that the capability to deploy autonomous offensive AI has shifted from theoretical to operational and is accessible to solo operators. The common exploitation vector across all incidents is identity and authentication exposure: discoverable federation endpoints, weak credentials, and misconfigured SSO (single sign-on) systems that autonomous agents can traverse at machine speed without human direction between each action.

• vulnerabilities
  Microsoft Plugs Nearly 400 Security HolesSource ↗

  Microsoft released fixes for 398 security vulnerabilities across Windows and supported software in August, including one actively exploited zero-day (CVE-2026-68820) in the afd.sys driver and two previously disclosed flaws. The patch volume continues a trend driven by artificial intelligence-assisted vulnerability discovery, with 42 flaws rated critical. Security experts caution that while patching must continue, organizations should test thoroughly before deployment rather than rushing updates, and that AI-generated patches require human validation since they fail or introduce new weaknesses more than half the time.

• vulnerabilities
  N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577Source ↗

  N-able released a second security hotfix for N-central, its remote monitoring and management (RMM) solution, to address ongoing exploitation of CVE-2026-18577. The company stated that Hotfix 2 is required even for customers who applied the initial patch, as it includes additional hardening measures. N-able also disclosed new indicators of compromise observed in active attacks.

• vulnerabilities
  Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCESource ↗

  Security researchers disclosed an AI-assisted exploit chain against Microsoft SharePoint that achieves unauthenticated remote code execution by impersonating any user, including administrators. The vulnerability, CVE-2026-55040 with a CVSS score of 9.1, impacts SharePoint Server Subscription Edition, 2019, and 2016. AI agents played a significant role in discovering the vulnerability chain.

• vulnerabilities
  Vulnerability giving attackers full control of Macs is under active exploitationSource ↗

  A high-severity macOS vulnerability (CVE-2026-65400) in the screen sharing feature allows remote code execution with root privileges and is currently being exploited in the wild. The Netherlands National Cyber Security Centrum reported active abuse on systems with port 5900 exposed to the internet, where attackers installed Monero crypto miners after gaining access. Apple released patches for macOS Tahoe, Sequoia, and Sonoma last week.

• vulnerabilities
  CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)Source ↗

  Rapid7 Labs disclosed CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint with a CVSS score of 8.1 that stems from unsafe .NET type instantiation in Business Connectivity Services. The vulnerability affects all supported versions of SharePoint, Project Server, and Office Web Apps Server, and when chained with the previously disclosed authentication bypass CVE-2026-55040, enables unauthenticated RCE. Microsoft has released patches across multiple products, with Rapid7 planning to publish full technical details within 30 days of disclosure.

Leak-site claim data is unverified: RansomLook (CC BY 4.0).

• CVE-2026-72898Metabase Metabasedue 2026-08-14
• CVE-2026-20349Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) due 2026-08-14
• CVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSock due 2026-08-25

• CVE-2026-34908Ubiquiti UniFi OSEPSS up 23 points in about a week
• CVE-2026-58644Microsoft SharePointEPSS up 39 points in about a week
• CVE-2026-48907Widget Factory Joomla Content Editor EPSS up 10 points in about a week
• CVE-2026-72898Metabase MetabaseAdded to CISA KEV 2026-08-11; Added to ENISA EUVD 2026-08-11; Exploitation active since 2026-08-10
• CVE-2024-56064Azzaroco WP SuperBackup Azzaroco WP SuperBackupEPSS up 15 points in about a week

• claimZEBRA.COMUnverified claim. Claimed by Clop.
• claimAOL.COMUnverified claim. Claimed by Clop.
• claimGATE7LLC.COMGBBEV.COMUnverified claim. Claimed by Clop.
• claimENTERATEK.MXESBERBEVERAGE.COMUnverified claim. Claimed by Clop.
• claimNUVITIA.COMUnverified claim. Claimed by Clop.
• claimIPMSOLUTIONS.SKUnverified claim. Claimed by Clop.
• claimECCELLENT.COMUnverified claim. Claimed by Clop.
• claimSTNET.ITUnverified claim. Claimed by Clop.
• claimTeikoku USAUnverified claim. Claimed by Qilin.
• claimAGUNSAUnverified claim. Claimed by Qilin.
• claimCofaceUnverified claim. Claimed by Qilin.
• claimSpoonful of ComfortUnverified claim. Claimed by Qilin.
• claimMulino PadanoUnverified claim. Claimed by Qilin.
• claimWEBA MeubelenUnverified claim. Claimed by Qilin.
• claimMOSAID TechnologiesUnverified claim. Claimed by Qilin.
• claimINVENSITYUnverified claim. Claimed by Qilin.
• claimIPSUnverified claim. Claimed by The Gentlemen.
• claimGfeller Treuhand und VerwaltungsUnverified claim. Claimed by The Gentlemen.
• claimGravity CoffeeUnverified claim. Claimed by The Gentlemen.
• claimOllies Place KidswearUnverified claim. Claimed by The Gentlemen.

Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a voluntarily credited failover.

All leak-site claims and confirmed breaches