Week 2026-W34

Check Point Research documented Operation Dream Job, a Lazarus-affiliated campaign targeting defense and aerospace sectors globally through fake job offers and trojanized PDF viewers. The campaign deployed new malware including the Troy backdoor and exploited CVE-2026-68820, a zero-day in Windows AFD.sys driver, to escalate privileges using an updated FudModule rootkit; Microsoft patched the vulnerability on August 11, 2026. The threat actors compromised Roundcube webmail and other web servers to establish command-and-control infrastructure, leveraging a previously undocumented PHP webshell called RelayShell to relay traffic and maintain persistence.

CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation evidence: a Cisco firewall heap inspection flaw, a Microsoft Windows use-after-free issue, and a Metabase SQL injection bug. The agency reinforced that federal agencies must prioritize patching KEV-listed vulnerabilities on publicly exposed systems and investigate potential compromise before patch application, per Binding Operational Directive 26-04. CISA encourages all organizations to adopt risk-based vulnerability management aligned with KEV prioritization.

Grouped because: title similarity 56 plus shared entities: CVE-2026-20349

Metasploit Framework 6.5 released with 13 new exploit modules targeting remote code execution vulnerabilities in WordPress, Ghost CMS, Joomla, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, and a Linux kernel privilege escalation. The release also introduces HTTP malleable C2 profiles for Meterpreter payloads, Model Context Protocol (MCP) functionality, Windows ARM (AArch64) reverse shells, and numerous bug fixes and enhancements.

Tenable's Research Special Operations team is tracking a cluster of seven agentic AI incidents since July 2026, anchored by Taiwan's confirmed August 2026 attack in which autonomous AI agents mapped 21 government systems, compromised 85 accounts, and exfiltrated 2,564 personnel records in four days. The cluster also includes JADEPUFFER (which exploited CVE-2025-3248 in Langflow for database extortion) and knaithe/KnYuan (a Chinese-speaking operator using the same AI agent framework for autonomous vulnerability scanning), demonstrating that the capability to deploy autonomous offensive AI has shifted from theoretical to operational and is accessible to solo operators. The common exploitation vector across all incidents is identity and authentication exposure: discoverable federation endpoints, weak credentials, and misconfigured SSO (single sign-on) systems that autonomous agents can traverse at machine speed without human direction between each action.

Microsoft released fixes for 398 security vulnerabilities across Windows and supported software in August, including one actively exploited zero-day (CVE-2026-68820) in the afd.sys driver and two previously disclosed flaws. The patch volume continues a trend driven by artificial intelligence-assisted vulnerability discovery, with 42 flaws rated critical. Security experts caution that while patching must continue, organizations should test thoroughly before deployment rather than rushing updates, and that AI-generated patches require human validation since they fail or introduce new weaknesses more than half the time.

N-able released a second security hotfix for N-central, its remote monitoring and management (RMM) solution, to address ongoing exploitation of CVE-2026-18577. The company stated that Hotfix 2 is required even for customers who applied the initial patch, as it includes additional hardening measures. N-able also disclosed new indicators of compromise observed in active attacks.

Attackers are actively exploiting CVE-2026-59310, a critical directory-traversal vulnerability in Broadcom VMware vCenter with a CVSS score of 9.8. The flaw allows remote code execution for network-adjacent threat actors. Patches have been released, though the article text is incomplete.

Grouped because: title similarity 68

Security researchers disclosed an AI-assisted exploit chain against Microsoft SharePoint that achieves unauthenticated remote code execution by impersonating any user, including administrators. The vulnerability, CVE-2026-55040 with a CVSS score of 9.1, impacts SharePoint Server Subscription Edition, 2019, and 2016. AI agents played a significant role in discovering the vulnerability chain.

A high-severity macOS vulnerability (CVE-2026-65400) in the screen sharing feature allows remote code execution with root privileges and is currently being exploited in the wild. The Netherlands National Cyber Security Centrum reported active abuse on systems with port 5900 exposed to the internet, where attackers installed Monero crypto miners after gaining access. Apple released patches for macOS Tahoe, Sequoia, and Sonoma last week.

Rapid7 Labs disclosed CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint with a CVSS score of 8.1 that stems from unsafe .NET type instantiation in Business Connectivity Services. The vulnerability affects all supported versions of SharePoint, Project Server, and Office Web Apps Server, and when chained with the previously disclosed authentication bypass CVE-2026-55040, enables unauthenticated RCE. Microsoft has released patches across multiple products, with Rapid7 planning to publish full technical details within 30 days of disclosure.