Cybersecurity briefing, 2026-08-12

Microsoft starts the day with an exploited Windows zero day in afd.sys.

• Gunra Shifts Ransomware to Perimeter Break-ins
• Kimwolf Offloads Break-ins From Its DDoS Core
• Sandworm Used Private APN to Reach CHP Controls
• CISA Orders Two-Week Fix for Exploited Windows Bug
• Zoom Fixes Four Annotation Flaws After Disclosure
• City Forum Emerges as One Persistent Scraper
• SeaweedFS SSRF Exposes Internal Cloud Services
• Delta Fake Wi-Fi Drew FBI Scrutiny
• CEVA Breach Exposes Steam and Retail Shipping Data
• Hostile SIMs Gain Control of Quectel Modems
• LiteLLM Breach Grew Into CI Secret Spill
• Helix Claims Uber Freight Mailbox Theft
• Head Mare Turns TrueConf Updates Into Malware Delivery
• CISA’s KEV Update Spans Four Live Exploits
• Arista VeloCloud Patch Reaches a Trust Anchor
• FBI Probe Validates North Korean Remote-Hire Threat
• SonicWall GMS RCEs Hit Retired Management Platform

Recent editions

• Tuesday, August 11, 2026: VulnCheck Chains SharePoint Bypass Into RCE · 17 stories
• Monday, August 10, 2026: Head Mare Turns TrueConf Updates Into Malware Delivery · 17 stories
• Sunday, August 9, 2026: Metabase Exploitation Exposes Connected Databases · 3 stories
• Saturday, August 8, 2026: Metabase Exploitation Exposes Connected Databases · 15 stories
• Friday, August 7, 2026: Cisco IOS XE Fixes Expose Broader Codebase Weaknesses · 19 stories
• Thursday, August 6, 2026: npm Worm Now Spreads Through Stolen Tokens · 17 stories
• Wednesday, August 5, 2026: npm Worm Now Spreads Through Stolen Tokens · 18 stories