Latest / Daily DefSec Brief / Cyber Security News for August 12 2026 - Daily DefSec Brief
Transcript
- Jerry: Patch Tuesday is a monster this month, including a WindSock Zero Day that's already in the hands of Lazarus. And on the same day, someone dropped a public bypass of the Defender Fix Microsoft just shipped. So two of today's 14 are chasing each other. This is the daily Def Sec brief. I'm Jerry Bell with a day's security news in five minutes for Wednesday, August 12th, 2026. Fourteen items on the board today. One, there's a use after free in Windows WinSock in AFD.sys that lets a low privileged local attacker win a race and land a system in North Korea's Lazarus is already using it. Apply August Patch Tuesday now. 2. A flaw in Cisco's ASA and FTD remote access SSL VPN lets an unauthenticated attacker reload the box, causing a denial of service and it's being exploited. Patches are available. 3. There's a public proof of concept nicknamed Shield Break that bypasses the Defender patch Microsoft just released and spawns a system shell on fully patched machines. There's no fix for the bypass yet, so watch for that advisory and hunt for unexpected system shells. Coming out of mpengine.dl. Four. A second SharePoint bug chains with last month's flaw for unauthenticated remote code execution and both halves are now public. Apply today's updates. Five, SAP Commerce Cloud has a max severity RCE, a default auth client plus a missing input validation lets an unauthenticated attacker run code and reach internal components. It's still theoretical, but it's a 10 out of 10, so patch to a fixed release and redeploy per Onapsis' guidance. 6. Adobe shipped priority fixes for critical flaws in Cold Fusion, Campaign Classic, and Commerce, including OS command injection at max severity. Apply them now. ColdFusion in particular is a repeated exploitation target, so it won't stay theoretical for very long. 7. A memory corruption bug in Zoom's annotation feature lets any meeting participant run code on another attendee's client with zero interaction. That is amazing. The fixes shipped in June and July and are now public, so just confirm that your clients are past 7.15 and 7.0.6. 8. Sonic while patched an unauthenticated command injection And a zip slip file rate in its GMS management platform. Apply the effects, and by the way, GMS was retired last October, so this is your nudge to plan the migration off of it. Nine. Ivanti Endpoint Manager has two flaws reachable by remote unauthenticated attackers, including a man in the middle credential leak on external SQL connections. ten. A Sandworm subgroup is running fake job interviews where a recruiter moves a conversation with an IT admin to a Zoom call, then hands them a technical task that requires a booby trapped wire guard client that can run commands. Warn your IT staff about recruiter driven connect to our VPN tasks and block unsanctioned VPN installers from executing. Eleven. A clickfix campaign is steering victims into IBM's SPSS scripting IDE using the signed legitimate app and decoy DLLs to run shellcode and drop a red. Hunt for SPSS launching scripts unexpectedly and keep reminding people not to paste commands they were told to run. 12. An espionage toolkit called Cavern relays its command and control traffic through Google Apps script to blend in with legitimate use. Baseline your opbound app's script traffic and treat unexplained automation from script.google.com as suspect. Thirteen. Researchers showed a crafted SIM card can order its host cellular module to run attacker commands. They used it to take over a commercial EV charger. Most of the affected parts are Quectile modules, so inventory your machine-to-machine cellular hardware, restrict physical sim access, and check with the module vendors for firmware updates. 14. Microsoft also patched a high severity integer overflow in Outlook that lets an unauthenticated attacker run code over the network. Microsoft rates exploitation is unlikely, but it's part of today's rollout, so apply it with the rest. That's the board for today. All the sources are linked in the show notes. Thanks for watching. If the show's useful to you, a like and subscribe help and pass it to someone on your team who'd want it. Back again tomorrow.