☀️ Good morning. Here's everything that happened in cybersecurity yesterday — in under 5 minutes.
Microsoft dropped one of the largest Patch Tuesdays ever — 421 CVEs and a kernel zero-day North Korea was already exploiting; the Gunra ransomware crew kept breaking into critical infrastructure using Fortinet flaws patched back in early 2025; researchers showed a public AI tool could build a working zero-click Zoom exploit in under 20 prompts; Rapid7 chained two SharePoint bugs into unauthenticated remote code execution with an AI agent's help; and OpenAI shipped GPT-5.6-Cyber, a model deliberately tuned to refuse less. The thread running through all of it: AI is collapsing the distance between a vulnerability and a working exploit, right as defenders face a record patch pile.
🔥 Top Stories
01 — Microsoft's August Patch Tuesday: 421 CVEs and a Zero-Day Under Active Attack
Vulnerabilities
Microsoft's August 2026 Patch Tuesday is one of the largest on record — 421 CVEs by Rapid7's count, 62 of them rated critical. The standout is a use-after-free in the afd.sys kernel driver that North Korea's Lazarus group has already been exploiting as a zero-day to escalate to SYSTEM on compromised machines.
With this volume, blanket patching isn't a plan — prioritization is. Push the actively exploited afd.sys fix first, then the critical QUIC and DNS Server remote code execution bugs, and treat the two publicly disclosed issues as next in line before working through the rest.
02 — Gunra Ransomware Exploits Fortinet Flaws and Bypasses MFA With Leaked Conti Code
Ransomware
A joint U.S.–South Korea advisory ties the Gunra ransomware-as-a-service crew to a repeatable playbook: two unpatched Fortinet authentication-bypass flaws, defeated multi-factor authentication, and an encryptor built from leaked Conti source code. The group is hitting healthcare, financial services, and government targets worldwide.
The uncomfortable part is that the fixes have been available since early 2025 — this is a patching-and-hygiene failure, not a novel exploit. Patch your Fortinet appliances now, rotate credentials, and don't assume MFA alone closes the door when the underlying auth flaw is still open.
03 — Zoom Patches Zero-Click Annotation Flaw That Let Any Attendee Hijack Another's Computer
Vulnerabilities
Zoom has patched ZOOMSDAY, a zero-click flaw in its annotation tool that let any meeting participant run code on another attendee's device — presenter to viewer and viewer to presenter. It asked nothing of the victim beyond being in the call: no click, no download, no on-screen sign.
The detail that should worry defenders: researchers built a working exploit using a public AI tool in fewer than 20 prompts. Update Zoom clients across your fleet immediately, and treat "just being in the meeting" as an attack surface for any screen-sharing tool.
Vulnerabilities
Rapid7 Labs disclosed a two-CVE SharePoint chain that reaches unauthenticated remote code execution as any user, including an administrator. A JWT authentication bypass (CVE-2026-55040, CVSS 9.1) feeds an RCE flaw (CVE-2026-63520), and both were fixed in the August 11 Patch Tuesday. The chain affects SharePoint Server Subscription Edition, 2019, and 2016.
Notably, an AI agent did a significant part of the discovery work — a preview of how quickly complex exploit chains will surface from here. If you run on-prem SharePoint, apply the August updates as a priority; unauthenticated RCE on a document hub is about as bad as it gets.
05 — OpenAI Ships GPT-5.6-Cyber With Reduced Refusals, One Day After Pausing Astra
Artificial Intelligence
OpenAI launched GPT-5.6-Cyber, a cyber-tuned model trained to find zero-day vulnerabilities and build exploit chains — and deliberately tuned to refuse fewer high-risk, dual-use requests. Access sits behind a two-tier Daybreak program: Blue removes some guardrails for defenders, Red grants the frontier offensive capability, and both are gated to vetted partners.
The timing is pointed: it landed one day after OpenAI paused its more capable Astra model over the same class of concern. For defenders, the takeaway isn't panic but planning — assume adversaries will get comparable capability, and shorten your own vulnerability-to-patch window accordingly.
📊 By The Numbers
421 CVEs — Microsoft's August Patch Tuesday by Rapid7's count, 62 rated critical — one of the largest ever.
1 zero-day under active attack — an afd.sys kernel use-after-free that North Korea's Lazarus group used to reach SYSTEM; patch it first.
Fewer than 20 prompts — what it took a public AI tool to build a working exploit for Zoom's zero-click annotation flaw.
2 chained CVEs — CVE-2026-55040 (CVSS 9.1) plus CVE-2026-63520 turn on-prem SharePoint into unauthenticated RCE.
Since early 2025 — how long fixes for the Fortinet flaws Gunra is still exploiting have been available.
⚡ The Signal
Two forces met yesterday, and they're pulling in opposite directions. On one side, defenders got handed a record patch load — 421 Microsoft CVEs, plus critical fixes from Adobe, SAP, Cisco, and SonicWall the same day. On the other, the day's exploit stories all shared a new ingredient: AI. A public tool built the Zoom exploit in under 20 prompts. An AI agent helped chain the SharePoint bugs. OpenAI shipped a model tuned to refuse less of exactly this work.
The through-line is the shrinking gap between disclosure and working exploit. That gap used to be a defender's grace period — the days or weeks between "a patch exists" and "someone has a reliable exploit." AI is compressing it toward zero. When a model can turn a vulnerability advisory into functional exploit code faster than most organizations can schedule a maintenance window, the old patch-when-convenient rhythm stops working.
And yet Gunra is a reminder that the basics still decide most breaches. That crew isn't using anything exotic — it's walking through Fortinet flaws that were patched eighteen months ago, at organizations that never applied the fix. So the mandate coming out of yesterday is two-sided: close the year-old holes that ransomware crews rely on, and simultaneously accept that new holes will be weaponized faster than ever. The middle ground — patching eventually — is exactly where both kinds of attacker live.
🔍 What You May Have Missed
Cisco patches an ASA and FTD firewall zero-day already exploited in the wild — CVE-2026-20349 (CVSS 8.6) lets an unauthenticated remote attacker trigger denial-of-service on Secure Firewall appliances; it's under active attack, so patch edge devices now.
Ceva Logistics breach ripples across European retailers and Steam customers — A cyberattack on the shipping giant disrupted eight European warehouses and exposed customer data across multiple brands that rely on it, a reminder of third-party logistics as a soft supply-chain target.
Malicious SIM cards can run attacker code inside cellular modems — Researchers abused a legitimate "Proactive SIM" function across 26 tested phones and modules to hijack devices, steal files, and force 2G downgrades — relevant to EV chargers, industrial routers, and IoT fleets.
📅 What to Watch
Chrome rolls out device-bound session credentials against account takeover — DBSC binds a session to the device that created it, blunting stolen-cookie replay; watch for broader adoption as one of the stronger takeover defenses yet.
Malicious MCP servers can split instructions to make AI coding agents leak secrets — A hostile tool server can fragment a request into routine-looking pieces and walk off with SSH keys and source code — an emerging risk for every team wiring agents into their toolchain.
NIST wants to overhaul the National Vulnerability Database for the AI age — NIST is seeking public input to modernize the NVD for machine-scale security data; the outcome will shape how vulnerabilities are tracked for years.
Mozilla revokes its Firefox and Thunderbird Linux signing key after a leak — An unencrypted copy of the key landed in a private repo, so Mozilla scrapped it; Linux users and distros packaging the browser will need to update how they verify downloads.
Stay sharp. Stay ahead.
Till next time,
The CyberSignal Team