Sam's News — security — 2026-08-12¶
Security¶
8.5 ShieldBreak zero-day proof-of-concept bypasses Microsoft Defender patch with SYSTEM access¶
Security researchers released a zero-day exploit dubbed 'ShieldBreak' that allows attackers to gain SYSTEM-level privileges in Microsoft Defender.
Sources: The Hacker News RSS, BleepingComputer RSS
8.5 Minnesota water systems targeted in coordinated cyberattack affecting 30+ municipalities¶
A coordinated cyberattack targeted more than 30 municipal water systems across Minnesota on July 26–27, 2026, primarily affecting operational technology including PLCs and human-machine interfaces. No water service loss or quality issues occurred; U.S. officials suspected Iranian involvement, and the FBI investigated similar attacks across seven states.
- Attack targeted 30+ Minnesota municipal water systems (July 26–27, 2026)
- Affected operational technology: PLCs and human-machine interfaces
- Braham (population 1,700) and Plymouth (~80,000) among affected communities
- No water service loss or quality issues reported
- U.S. officials suspected Iranian involvement, possibly CyberAv3ngers
- FBI investigating similar attacks across seven states
Sources: FOX 9 Minneapolis-St. Paul AI Web Searched, StateScoop AI Web Searched, Serper Discovery RSS
8 LiteLLM Supply Chain Attack Compromises Over 2,500 Organizations¶
Analysis of data from a March 2026 LiteLLM supply chain attack reveals nearly 2,500 organizations were compromised.
Sources: SecurityWeek RSS, CyberInsider RSS, cyberinsider.com Web Search
8 API flaw in OpenAI, Anthropic, and Google models exposed hidden reasoning and credentials¶
A newly disclosed vulnerability in encrypted reasoning objects used by OpenAI, Anthropic, and Google allowed researchers to recover internal reasoning, API keys, and passwords from session logs.
Sources: The Hacker News RSS
8 North Korean Lazarus Group exploits Windows zero-day to deploy backdoor¶
The North Korean-backed Lazarus Group exploited CVE-2026-68820, a Windows zero-day with a CVSS score of 7.0, to deploy multiple backdoors targeting defense and aerospace companies across France, Germany, Brazil, and India. Attacks were linked to Operation Dream Job, a social engineering campaign using fake job offers and trojanized PDFs.
- CVE-2026-68820 Windows privilege escalation in AFD.sys, CVSS 7.0, patched August 2026
- Targets defense and aerospace in France, Germany, Brazil, India
- Multiple backdoors: MISTPEN (lightweight downloader), ForestTiger/ScoringMathTea, Troy (17 operator commands)
- Operation Dream Job uses fake recruiters on LinkedIn with malicious PDFs and trojanized viewers
- Troy supports file ops, shell access, process termination, DLL injection, config updates
Sources: The Hacker News AI Web Searched
7.5 Attackers Actively Exploit VMware vCenter Critical Directory-Traversal Vulnerability¶
Threat actors have begun exploiting CVE-2026-59310, a critical directory-traversal flaw in Broadcom VMware vCenter, to gain persistent remote access to systems.
Sources: The Hacker News RSS
7.5 737 malicious Chrome VPN extensions found routing traffic through proxies¶
More than 737 malicious browser extensions on the Chrome Web Store impersonated legitimate VPN services while routing traffic through a single unauthorized SOCKS5 proxy.
Sources: The Hacker News RSS, BleepingComputer RSS
7 Adobe patches critical CVSS 10.0 vulnerabilities in ColdFusion and Campaign Classic¶
Adobe released security updates addressing multiple critical flaws rated CVSS 10.0 in ColdFusion, Commerce, and Campaign Classic that could enable arbitrary code execution.
Sources: The Hacker News RSS
7 SharePoint vulnerability exploited after PoC release¶
A Microsoft SharePoint vulnerability patched in July has begun being exploited in the wild shortly after a proof-of-concept was released.
Sources: SecurityWeek RSS
Cybersecurity¶
7 DeadLock ransomware uses blockchain infrastructure to resist law enforcement takedown¶
The DeadLock ransomware operation employs decentralized blockchain-backed services to protect its communications and data-leak platform from infrastructure disruption.
Sources: BleepingComputer RSS