Briefing — 12 August 2026

🎧 Subscribe to the podcast feed

Security News

August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day (SecurityWeek) — Microsoft's August update is among the heaviest on record; one vulnerability was already being exploited in the wild by North Korean threat actors before the patch landed.

421 bugs in Microsoft's Patch Tuesday release, and the Norks have already attacked one (The Register) — DPRK-attributed threat actors weaponised a zero-day flaw ahead of today's Microsoft patch release, with Microsoft Threat Intelligence confirming active exploitation.

Microsoft Plugs Nearly 400 Security Holes (Krebs on Security) — Krebs characterises August Patch Tuesday as a "deluge," urging immediate patching across Windows environments.

Cisco Patches Firewall Zero-Day Exploited for DoS Attacks (SecurityWeek) — A Cisco firewall zero-day actively exploited to crash devices has been patched; a separate flaw in the ASA and FTD VPN stack is also being exploited in the wild.

Cisco warns of ASA and FTD VPN flaw exploited to crash devices (BleepingComputer) — Second Cisco active exploit in the same day; the ASA/FTD VPN denial-of-service flaw is being used against organisations in the wild.

Sandworm hackers target IT pros with trojanized WireGuard VPN client (BleepingComputer) — Russia's GRU-linked Sandworm is distributing a backdoored WireGuard installer targeting IT professionals via convincing fake download sites.

Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA (Dark Reading) — The Gunra ransomware group is specifically targeting Fortinet vulnerabilities and circumventing MFA, rendering common defences ineffective against their attacks.

DeadLock ransomware uses blockchain to resist infrastructure takedown (BleepingComputer) — DeadLock has implemented blockchain-based victim recovery communications to eliminate centralised infrastructure and complicate law enforcement takedowns.

Ransomware group hijacks hospital system's Facebook page amid ongoing cyberattack fallout (The Record) — A ransomware operator seized control of a US hospital's official Facebook page mid-attack to apply public pressure and force payment, highlighting the need for social media account security in IR planning.

Signal adds an extra layer of security to make sure you're actually chatting with the right person (The Register) — Signal has introduced a new identity verification layer to prevent users being silently rerouted to a fake contact.

Chrome adopts what may be the best protection yet against account takeovers (Ars Technica) — Chrome is rolling out device-bound session credentials as a new defence against account takeover attacks, potentially closing a significant authentication gap.

DEF CON crowd suspected in fake-hotspot attack on Delta flight (Ars Technica) — A rogue Wi-Fi hotspot targeting DEF CON attendees appeared on a Delta flight from Las Vegas; passengers connected before the deception was identified.

Adform compromised to serve crypto stealer via supply chain attack (DoublePulsar) — Advertising platform Adform was compromised and used to distribute a cryptocurrency stealer to downstream users via a supply chain attack.

Ransomware Victims (48h)