August 12, 2026
- Microsoft's August 2026 Patch Tuesday fixes 421 CVEs, including one actively exploited zero-day. CVE-2026-68820 is a use-after-free in the
afd.sysWindows kernel-mode driver that lets an attacker with local code execution escalate to SYSTEM; two other flaws were publicly disclosed pre-patch. Sixty-two of the fixes are critical, spanning QUIC and DNS Server RCE and container-tampering bugs (Krebs on Security, SANS ISC, The Hacker News). · Vulnerabilities & Exploits - Lazarus revived Operation Dream Job with a new Windows zero-day, delivering malicious PDFs via fake recruiters to exploit CVE-2026-68820 — the same afd.sys bug Microsoft patched this week — alongside CVE-2025-49113. Check Point traced a chain including a new in-memory backdoor, a kernel rootkit, and webshells against defense sectors in Europe and India (Check Point Research). Separately, ANY.RUN, BCA and NorthScan stood up a fake DeFi startup ("Blue Whale LTD") and knowingly hired suspected Famous Chollima operatives to observe DPRK IT-worker infiltration from the inside (ANY.RUN). · Threat Activity