Daily Cybersecurity Briefing — August 12, 2026

ACTIVELY EXPLOITED VULNERABILITIES

• Microsoft August 2026 Patch Tuesday: 421 CVEs patched including 3 zero-days. CVE-2026-68820 (Windows Ancillary Function Driver for WinSock, Use-After-Free, EoP) is actively exploited in the wild and added to CISA KEV. CVE-2026-72971 (Windows Container Isolation tampering) publicly disclosed pre-patch. Also notable: patches for Exchange Server, HTTP.sys, Hyper-V, NTFS, and GitHub Copilot.

• CISA added three CVEs to KEV on August 11: CVE-2026-20349 (Cisco ASA/FTD Heap Inspection), CVE-2026-68820 (Windows AFD Use-After-Free), and CVE-2026-72898 (Metabase SQL Injection). FCEB agencies must remediate immediately.

• CVE-2026-18577 (N-able N-central, CVSS 8.2): Authentication bypass enabling account takeover added to CISA KEV following reports of active customer compromises. FCEB patch deadline was August 6.

• CVE-2026-63077 (JetBrains TeamCity): Unauthenticated RCE flagged by CISA as actively exploited in the wild. A public PoC Python script is circulating that enables arbitrary command execution via .JSPWS file write, directly threatening CI/CD pipeline credentials and build artifacts.

• Microsoft SharePoint CVE-2026-45659 (deserialization RCE, low-privilege execution): CISA confirmed ransomware gangs are actively exploiting this flaw. August Patch Tuesday completes a two-part fix chain started in July. On-premises SharePoint administrators should patch immediately.

BREACHES

• Helix ransomware group claimed attacks on both Highwoods Properties (major US real estate firm) and Morguard (leading Canadian real estate firm, August 7), threatening to publish sensitive data unless ransom negotiations commence.

• PontoBR Sistemas (Brazilian IT firm) targeted by SpaceBears ransomware group, which is threatening to leak stolen sensitive data if demands are not met.

• DeadLock ransomware group documented using decentralized infrastructure — Session messaging network paired with blockchain-backed services — to conduct victim extortion communications and data leak operations, complicating law enforcement takedown efforts.

THREATS & POLICY

• The 2026 US Cyber Strategy formally shifts posture from 'defend and recover' to 'deter and disrupt.' Federal agencies are now directed to treat cybercrime organizations as transnational criminal networks, coordinating diplomatic, law-enforcement, and technical capabilities to dismantle them.

• Russia's Operation Matryoshka: Threat actors are using AI-generated deepfake videos to interfere with the German election cycle. Communities separately raise concerns that AI facial recognition is being deployed against them in a targeted manner.

• US lawmakers are pushing legislation to simplify cybersecurity regulation requirements and accelerate decommissioning of internet-facing routers and VPNs in federal environments.

• CVE submissions in Q1 2026 were approximately one-third higher than the same period in 2025. AI-assisted vulnerability discovery is a widely cited driver, enabling both defenders and threat actors to surface bugs at machine speed.

CLOUD & SAAS SECURITY

• Top cloud risk in 2026: Insecure machine identities. Service principals, secrets, and AI agents now outnumber human users 100:1. Just 0.01% of non-human identities control 80% of all cloud permissions — a massive, often ungoverned attack surface.

• SaaS supply chain attacks have increased 3.8x since 2022 and now account for 23% of all enterprise cyberattacks. The interconnected SaaS ecosystem is emerging as the most significant enterprise vulnerability in 2026.

• Agentic AI systems — autonomous agents operating with administrative-level cloud privileges — are identified as the fastest-growing attack surface. AI-driven phishing, automated cloud reconnaissance, prompt injection, and ungoverned internal AI agents are flagged as top 2026 threats.

• Check Point's 2026 Cloud Security Report warns that most organizations cannot fully track AI tool usage, data flows, or agent activity, creating significant governance and visibility gaps across multi-cloud environments.

IDENTITY & AUTHENTICATION

• Black Hat USA 2026 (August 5): SpecterOps presented 'Pass-the-Passkey' — demonstrating how chaining passkey-related weaknesses with Microsoft Entra ID flaws allows full privileged-user impersonation even when phishing-resistant MFA policies are enforced.

• Black Hat 2026 PoC: Researchers demonstrated cross-platform webmail attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail — capable of capturing typed passwords and leaking authentication tokens across providers.

• AiTM (Adversary-in-the-Middle) attacks rose 146% year-over-year with approximately 40,000 incidents detected daily. MFA fatigue attacks rose 217% YoY per the 2025 Verizon DBIR; push-notification MFA is increasingly considered a liability in high-risk environments.

• Okta published a 2026 threat advisory documenting custom phishing kits designed for live, caller-led attacks — threat actors posing as IT support who capture credentials and MFA tokens in real time over the phone.

MOBILE SECURITY

• Kaspersky Q2 2026 mobile threat report: 1.99M+ mobile attacks blocked. Trojan-Banker malware led all categories at 30.77% of detections, with 304,000+ malicious installation packages discovered — including 93,574 mobile banking Trojan packages.

• Google Play Protect identified 27 million new malicious sideloaded apps in 2025 via real-time scanning — more than double the 13 million in 2024 — underscoring the ongoing risk of unofficial app distribution channels.

• Advanced mobile spyware in 2026 relies on persistent background processes that evade detection and silently exfiltrate data to remote servers. Romance-scam app distribution tactics — including fake chat platform apps — continue to be documented in the wild.

RESEARCH & TOOLS

• Public PoC released for CVE-2026-63077 (JetBrains TeamCity): A Python script enables unauthenticated RCE by writing a .JSPWS file to execute arbitrary commands — directly exposing CI/CD pipeline credentials and build artifacts.

• Black Hat USA 2026 research highlights: 'Pass-the-Passkey' (SpecterOps) and cross-platform webmail token-capture chains — both with working PoC demonstrations — were among the most significant practitioner-facing findings at the conference.

• A security researcher released a Microsoft Defender exploit on Patch Tuesday granting SYSTEM privileges, highlighting the irony of a security product becoming an EoP vector. Organizations should apply August 2026 patches immediately.

• Multiple Linux kernel use-after-free vulnerabilities with public PoC exploit code were disclosed in August 2026. Linux administrators should review vendor advisories and prioritize patching affected kernel components.

Sources

BleepingComputer — Microsoft August 2026 Patch Tuesday: https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/

The Hacker News — Microsoft Patches 398 Flaws: https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html

CISA — Adds Three Known Exploited Vulnerabilities (Aug 11, 2026): https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog

The Hacker News — CISA Adds N-able N-central Flaw to KEV: https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html

The Hacker News — CISA Flags TeamCity CVE-2026-63077: https://thehackernews.com/2026/08/cisa-flags-teamcity-cve-2026-63077-rce.html

BleepingComputer — SharePoint flaw exploited in ransomware: https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/

Palo Alto Unit 42 — SharePoint Active Exploitation (Updated Aug 12): https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/

The Hacker News — New Passkey Attacks Bypass Phishing-Resistant MFA: https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html

WorkOS — How attackers are bypassing MFA using AI in 2026: https://workos.com/blog/how-attackers-are-bypassing-mfa-using-ai-in-2026

Securelist — IT threat evolution Q2 2026, Mobile: https://securelist.com/malware-report-q2-2026-mobile-statistics/120948/

Cloud Security Alliance — State of Cloud and AI Security 2026: https://cloudsecurityalliance.org/blog/2026/03/13/the-state-of-cloud-and-ai-security-in-2026

SC Media — Cloud and SaaS risks rise in 2026: https://www.scworld.com/feature/cloud-and-saas-risks-rise-in-2026-as-trust-and-outages-collide

Weaver — 2026 US Cyber Strategy and Cybercrime Executive Order: https://weaver.com/resources/strategic-priorities-in-the-2026-us-cyber-strategy-and-cybercrime-executive-order/

Senserva — CISA KEV Additions This Week (August 2026): https://senserva.com/exploited-this-week.html

Check Point — 2026 Cloud Security Report: https://blog.checkpoint.com/securing-the-cloud/2026-cloud-security-report-why-traditional-network-cloud-and-security-architecture-are-lagging-behind-the-ai-transformation/

Proofpoint — More CVEs, Same Playbook: 2026 Vulnerability Exploitation: https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild

Rapid7 — Patch Tuesday August 2026: https://www.rapid7.com/blog/post/em-patch-tuesday-august-2026/