Feed aggregator

Patch Tuesday: Update now to fix 421 flaws, including three zero-days

Malware Bytes Security - Wed, 08/12/2026 - 9:48am

Microsoft’s August 2026 Patch Tuesday addresses 421 Microsoft vulnerabilities, including 62 rated Critical. One Windows vulnerability has been exploited in the wild by the Lazarus group to gain SYSTEM privileges.

The August update is smaller than July’s record-breaking release, but it’s still among Microsoft’s largest Patch Tuesday batches. More importantly, it includes several flaws likely to attract attacker interest: a publicly disclosed Windows privilege escalation flaw with a proof-of-concept (PoC), a newly completed unauthenticated SharePoint remote code execution (RCE) chain, and a potentially wormable Windows DNS Server flaw.

How to apply patches and check if you’re protected

These updates fix security problems and help keep your Windows PC protected. Here’s how to make sure you’re up to date:

  • Click the Start button, then open Settings.
  • Select Windows Update (usually at the bottom of the menu on the left).
  • Click Check for updates. Windows will search for the latest security updates. If you’ve enabled Get the latest updates as soon as they’re available under More options, you may be prompted to restart immediately to complete the update. Otherwise, continue to the next step.
  • If updates are available, they’ll start downloading automatically. When they’re ready, click Install or Restart now if prompted. Your computer may need a restart to finish the update.
  • After restarting, go back to Windows Update and check again. If it says You’re up to date, you’re all set.
Technical details

Windows Deployment Services (WDS) users should prioritize CVE-2026-62893 (CVSS score 9.8 out of 10), an unauthenticated RCE flaw in the TFTP (Trivial File Transfer Protocol) server. TFTP normally runs on UDP port 69 and has no built-in authentication. It is primarily an enterprise and school network issue, but it could enable lateral movement where WDS is deployed.

Microsoft also fixed CVE-2026-62832, a publicly disclosed elevation of privilege (EoP) vulnerability in the Windows User Profile Service. It maps to the issue researchers called LegacyHive, for which a limited public proof of concept was released in July.

The PoC demonstrates how a local authenticated attacker could abuse the service’s registry hive handling to load another user’s hive, potentially including an administrator’s. The released demonstration is deliberately constrained and requires credentials for another user, but the availability of code and the broad Windows footprint make this one a strong candidate for exploitation attempts.

Another good reason to promptly update is the number (I counted 48) of remote code execution (RCE) fixes for Office applications and components, including Excel, Word, Outlook, PowerPoint, and the Office graphics component. Document-borne vulnerabilities are attractive to phishing operators because email attachments and shared documents provide delivery mechanisms that people are likely to open.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review

Categories: Malware Bytes

Mindgard Raises $30 Million to Protect AI Systems

Security Week - Wed, 08/12/2026 - 9:24am

The cybersecurity startup will use the fresh investment to scale its product, engineering, sales, and marketing teams.

The post Mindgard Raises $30 Million to Protect AI Systems appeared first on SecurityWeek.

Categories: SecurityWeek

WhatsApp Unveils New Scam Alert Feature

Security Week - Wed, 08/12/2026 - 9:00am

Signal has also made a security announcement: an automatic key verification feature to complement its safety number system.

The post WhatsApp Unveils New Scam Alert Feature appeared first on SecurityWeek.

Categories: SecurityWeek

Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset

Security Week - Wed, 08/12/2026 - 9:00am

Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms.

The post Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset appeared first on SecurityWeek.

Categories: SecurityWeek

This Coin-Sized Device Can Hack a Boeing 737

Wired Security - Wed, 08/12/2026 - 8:00am
Security researchers found that in less than 60 seconds, they could open a hatch on a plane’s exterior, plug in a tiny device, and redirect the aircraft’s autopilot or sabotage its flight plan.
Categories: Wired Security

2026 Eclipse Webcams

Hacker News - Wed, 08/12/2026 - 7:53am
Categories: Hacker News

Pages