Daily Cybersecurity Briefing — August 13, 2026

ACTIVELY EXPLOITED VULNERABILITIES

• CVE-2026-68820 (Windows Ancillary Function Driver for WinSock — Use-After-Free): Actively exploited in the wild by North Korean threat actors (Lazarus Group / Operation Dream Job) to deploy a kernel-mode rootkit targeting defense-sector organizations. Successful exploitation grants SYSTEM privileges. Added to CISA KEV; FCEB agencies must patch by August 25, 2026. Part of Microsoft's August 2026 Patch Tuesday (394–421 CVEs, 3 zero-days total — 1 exploited, 2 publicly disclosed).

• CVE-2026-72898 (Metabase SQL Injection — CRITICAL): Unauthenticated remote attackers can inject arbitrary SQL to gain full administrator access. Added to CISA KEV with an FCEB patch deadline of August 14, 2026. Immediate patching required.

• CVE-2026-20349 (Cisco Secure Firewall ASA and FTD — Heap Inspection): Added to CISA KEV on August 11, 2026. Organizations running Cisco ASA or Firepower Threat Defense should apply available patches immediately.

• CVE-2026-59310 (Broadcom VMware vCenter — Directory Traversal RCE): Critical severity; threat actors are actively exploiting this flaw to execute arbitrary code on vCenter servers. Patch immediately if not already applied.

• CVE-2026-18577 (N-able N-central — Authentication Bypass via Alternate Path): Added to CISA KEV on August 3, 2026. Allows attackers to bypass authentication on N-central management platforms.

BREACHES

• LiteLLM AI Supply Chain Breach (Largest AI Supply Chain Attack of 2026): Threat actor group 'TeamPCP' compromised Trivy's GitHub Actions pipeline and injected credential-stealing code into malicious LiteLLM PyPI packages (versions 1.82.7 and 1.82.8). The breach exposed 153GB of data from 118,829 CI/CD pipeline runs tied to 2,488 organizations including AWS, Samsung, Cisco, Salesforce, Siemens, and ServiceNow. Stolen data includes AWS secrets, Azure tokens, GitLab credentials, SSH keys, Kubernetes secrets, Slack/Salesforce credentials, and AI provider API keys. The compromise originated in March 2026 but full scope was revealed this week.

• Colombian Justice Ministry Ransomware Attack (August 12, 2026): A ransomware attack hit Colombia's Ministry of Justice days before the country's presidential transition. Threat actor affiliation has not yet been confirmed.

• Gunra Ransomware Campaign (August 12, 2026): The Gunra ransomware gang exploited Fortinet vulnerabilities and successfully bypassed MFA in a new campaign targeting organizations. The group is leveraging known Fortinet flaws as initial access vectors.

• Morguard (Canadian Real Estate) — Helix Ransomware (August 7, 2026): The Helix ransomware group announced an attack against Morguard, a leading Canadian real estate firm, and is threatening data exposure after unsuccessful ransom negotiations.

THREATS & POLICY

• North Korea / Lazarus Group — Operation Dream Job: Check Point researchers confirmed North Korean threat actors are actively exploiting CVE-2026-68820 to deploy a kernel-mode rootkit in a new wave of Operation Dream Job, targeting defense-sector companies in the United States and allied nations.

• FBI Disrupts NetNut Botnet (July 3, 2026): The FBI and private-sector partners dismantled NetNut, a network of approximately 2 million compromised home devices used to proxy cybercriminal traffic. The operation is part of broader U.S. government efforts to disrupt cybercriminal infrastructure.

• Scattered Spider Member Extradited: A 19-year-old Scattered Spider member was extradited to the United States and awaits sentencing on cybercrime charges. Scattered Spider is the threat group responsible for several high-profile attacks on hospitality and entertainment sectors.

• GAO Flags Regulatory Redundancy (July 22, 2026): The Government Accountability Office wrote to Congressional committees highlighting redundancy and inefficiency in federal cybersecurity regulations, calling for consolidation and rationalization of overlapping requirements.

• Sen. Wyden Pushes VPN Elimination (July 27, 2026): Sen. Ron Wyden urged OMB, CISA, and NIST to lead a campaign to remove older, internet-accessible VPNs from federal agency networks, citing their frequent exploitation as initial access vectors.

CLOUD & SAAS SECURITY

• LiteLLM Supply Chain Attack — CI/CD Pipeline Exposure: The LiteLLM breach (detailed in Breaches section) compromised 434,000 CI/CD pipelines across 2,488+ organizations, making it the largest AI supply chain breach of 2026. The attack vector — a compromised open-source AI library — highlights the risk of unvetted PyPI dependencies in production ML/AI pipelines.

• Cloud Misconfigurations Remain Root Cause of Most Breaches: A Security Boulevard analysis (August 2026) finds that 95% of cloud security failures still stem from human-introduced misconfigurations — not platform vulnerabilities. Improperly configured storage buckets, exposed management interfaces, and incorrect network controls are the primary culprits in high-velocity DevOps environments. CSPM and SSPM adoption is strongly recommended.

• AI-Driven Automated Cloud Exploitation: Threat actors are increasingly leveraging AI to conduct large-scale, automated exploitation of cloud misconfigurations and API vulnerabilities at speeds that outpace manual incident response. AI-driven phishing is projected to account for more than 42% of all global intrusions by end of 2026.

IDENTITY & AUTHENTICATION

• Pass-the-Passkey Attack / CVE-2026-34348 (Black Hat USA 2026 — SpecterOps): Researchers demonstrated that Windows 11 logs complete WebAuthn assertion responses — including challenge, authenticator data, credential ID, user handle, and signature — in the Microsoft-Windows-WebAuthN/Operational event log. This enables attackers with local access to extract and replay passkey credentials, bypassing phishing-resistant MFA in Microsoft Entra ID. Microsoft addressed the flaw in July 2026 by truncating logged signatures.

• Gunra Ransomware MFA Bypass: Gunra ransomware actors successfully bypassed MFA protections in their August 2026 campaign by chaining Fortinet exploits with credential theft — highlighting that MFA alone is insufficient when initial access vulnerabilities exist in network perimeter devices.

• MFA Fatigue Attacks Surge 217% YoY: Per the 2025 Verizon DBIR, push-notification MFA fatigue attacks rose 217% year-over-year. Security practitioners increasingly recommend migrating to FIDO2 passkeys to eliminate push-based MFA as an attack surface — though today's Black Hat research demonstrates passkeys also require careful implementation.

MOBILE SECURITY

• Android Security Bulletin — August 2026: Google released the August 2026 Android Security Bulletin patching multiple CVEs including CVE-2026-28662 (improper input validation) and CVE-2026-45515 (local access enables arbitrary activity launch and device inoperability). The Pixel Update Bulletin was also released. Devices should be updated to security patch level 2026-08-05 or later.

• SNI5GECT Downgrade Attack: A newly discovered technique allows attackers to force mobile devices to downgrade from 5G to 4G connectivity, exposing them to interception, location tracking, and man-in-the-middle attacks. No patch is currently available; mitigation requires carrier-level enforcement of 5G standalone networks.

• Android Banking Malware Landscape: 34 active Android banking malware families are currently targeting 1,243 financial institutions across 90 countries. NFC relay attacks — which combine contactless payment theft with automated bank transfers — are an increasing concern. Spyware detections are up 51% year-over-year per Kaspersky.

RESEARCH & TOOLS

• Black Hat USA 2026 + DEF CON 34 Recap (August 1–7, Las Vegas): AI security dominated both conferences — 35 of 121 Black Hat briefings addressed AI/LLM security, agentic system attacks, or LLM-assisted offensive tooling. Key themes: agentic AI as primary new attack surface, LLMs as production-grade offensive tools, and defensive tooling racing to close the gap.

• OpenAI GPT-5.6-Cyber ('Daybreak'): OpenAI released an offense-grade cybersecurity model for vetted defenders, with safeguards calibrated for authorized penetration testing and defensive research. Simultaneously, Microsoft announced MAI-Cyber-1-Flash, a specialized AI model for security scanning that reduces compute costs by 50% compared to general-purpose models.

• Pass-the-Passkey PoC (SpecterOps): Published in conjunction with Black Hat 2026, the PoC demonstrates extraction of full WebAuthn assertion data from Windows 11 event logs to facilitate passkey relay attacks against Entra ID. Defenders should audit WebAuthn event log access and apply July 2026 Windows updates.

• Huntress RMM Guard (Black Hat Arsenal 2026): Huntress released RMM Guard, a tool that inventories remote monitoring and management software across an environment and moves unauthorized or unrecognized RMM instances toward blocking — addressing a key attacker persistence technique.

• Opal MCP Servers for Identity Governance: Opal introduced three role-scoped MCP servers (end-user, admin provisioning, and admin auditing) enabling structured identity governance workflows. Available as first-party or self-hosted deployments.

Sources

CISA KEV Alert — August 11, 2026: https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog

BleepingComputer — Microsoft August 2026 Patch Tuesday: https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/

Tenable — CVE-2026-68820 Analysis: https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820

Help Net Security — CVE-2026-68820: https://www.helpnetsecurity.com/2026/08/12/august-2026-patch-tuesday-cve-2026-68820/

SecurityWeek — LiteLLM Supply Chain: https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/

The Hacker News — LiteLLM/Trivy: https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html

CloudSEK — LiteLLM Breach Scope: https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines

The Hacker News — Pass-the-Passkey: https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html

GBHackers — Pass-the-Passkey Entra ID: https://gbhackers.com/pass-the-passkey-attack-exploits-windows-and-entra-id/

Android Security Bulletin August 2026: https://source.android.com/docs/security/bulletin/2026/2026-08-01

Cyware — Black Hat USA 2026 Recap: https://www.cyware.com/blog/black-hat-usa-2026-where-research-becomes-operational

Security Boulevard — Cloud Misconfigurations 2026: https://securityboulevard.com/2026/08/why-cloud-misconfigurations-continue-to-cause-data-breaches-in-2026/

CISA KEV — August 3, 2026 (N-able): https://www.cisa.gov/news-events/alerts/2026/08/03/cisa-adds-one-known-exploited-vulnerability-catalog

Senserva — CISA KEV August 2026: https://senserva.com/exploited-this-week.html