Cybersecurity briefing, 2026-08-12

Microsoft starts the day with an exploited Windows zero day in afd.sys.

• Gunra shifts ransomware to perimeter break-ins
• Kimwolf offloads break-ins from its DDoS core
• Sandworm used private APN to reach CHP controls
• CISA orders two-week fix for exploited Windows bug
• SAP Commerce Cloud faces probing days after patch
• Zoom fixes four annotation flaws after disclosure
• City Forum emerges as one persistent scraper
• SeaweedFS SSRF exposes internal cloud services
• Delta fake Wi-Fi drew FBI scrutiny
• CEVA breach exposes Steam and retail shipping data
• Hostile SIMs gain control of Quectel modems
• LiteLLM breach grew into CI secret spill
• Helix claims Uber Freight mailbox theft
• Head Mare turns TrueConf updates into malware delivery
• CISA’s KEV update spans four live exploits
• Arista VeloCloud patch reaches a trust anchor
• FBI probe validates North Korean remote-hire threat
• SonicWall GMS RCEs hit retired management platform

Recent editions

• Tuesday, August 11, 2026: VulnCheck chains SharePoint bypass into RCE · 18 stories
• Monday, August 10, 2026: Head Mare turns TrueConf updates into malware delivery · 17 stories
• Sunday, August 9, 2026: Metabase exploitation exposes connected databases · 3 stories
• Saturday, August 8, 2026: SharePoint patches didn’t clear BIT’s breach · 15 stories
• Friday, August 7, 2026: Cisco IOS XE fixes expose broader codebase weaknesses · 19 stories
• Thursday, August 6, 2026: npm worm now spreads through stolen tokens · 17 stories
• Wednesday, August 5, 2026: Imported agents become server commands in Paperclip · 18 stories