Cybersecurity Brief — 2026-08-12

Active Exploitation & Zero-Days

Threat actors actively exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8) — German security firm QUIRSO discovered active exploitation of a directory-traversal flaw in Broadcom VMware vCenter. Attackers deploy malicious cron jobs using reverse_ssh for persistence, with 361 unique victim IPs across 47 countries (mostly Germany, US, Turkey, Iran, France). First compromise observed August 3, five days after Broadcom disclosure. Suspected APT activity. (Source: The Hacker News)
North Korean actors exploiting fresh Windows zero-day (CVE-2026-XXXXX) — A newly discovered Windows vulnerability is being actively exploited by North Korean threat actors to deploy the ForestTiger backdoor, granting full system control. (Source: SecurityWeek)
Microsoft Patch Tuesday: 398 vulnerabilities fixed, one actively exploited zero-day — Microsoft addressed 398 flaws including 42 rated Critical. The sole known zero-day is CVE-2026-68820 (CVSS 7.0), a privilege escalation in afd.sys (Windows socket driver) actively exploited in the wild. Two additional flaws (CVE-2026-62832, CVE-2026-72971) were publicly disclosed prior to patching. Microsoft attributes the record patch volume to AI-assisted vulnerability discovery. (Source: Krebs on Security)

Malicious LiteLLM packages on PyPI exposed 2,500+ organizations — Two trojanized LiteLLM releases (versions 1.82.7 and 1.82.8) were live on PyPI for ~40 minutes in March 2026, harvesting cloud keys, SSH keys, Kubernetes tokens, and database passwords. CloudSEK obtained 434,000 captured files mapping to 2,500+ orgs (NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, X Corp among them). The compromise is linked to the TeamPCP/UNC6780 supply-chain campaign via Trivy (CVE-2026-33634). FBI FLASH advisory urges rotation of CI/CD secrets and long-lived credentials. (Source: The Hacker News)

Ivanti EPM patches remotely exploitable flaws — Ivanti released updates for vulnerabilities that could leak credentials for external SQL connections or crash agent services. (Source: SecurityWeek)
AI-driven vulnerability discovery creating "bugpocalypse" patching burden — Microsoft, Adobe, Cisco, Google, Mozilla, and Oracle are all shipping dramatically more patches monthly due to AI-assisted discovery. Adobe moved to twice-monthly bulletins. Research from 1Password shows LLMs generate flawed patches >50% of the time; SANS and Fortra emphasize human-in-the-loop validation remains essential. (Source: Krebs on Security)

Canadian threat actor pleads guilty in Snowflake extortion campaign — Connor Riley Moucka (a.k.a. "Judische", "Waifu"), 26, of Kitchener, Ontario, pleaded guilty to hacking and extorting 165+ organizations via stolen Snowflake credentials (targeting accounts without MFA). Victims included TicketMaster, Lending Tree, Advance Auto Parts, Neiman Marcus. Also admitted to stealing call/text records of 100M+ AT&T customers. Co-conspirators include U.S. Army soldier Cameron Wagenius ("Kiberphant0m", pleaded guilty July 2025) and John Erin Binns ("IRDev", linked to 2021 T-Mobile breach). Operation netted $2.5M+ in ransom payments. (Source: Krebs on Security)

AI flooding security with unproven bug reports — SANS warns that AI-generated vulnerability findings are creating a triage burden, with unproven reports piling up and overwhelming analysts. (Source: The Hacker News)