Cybersecurity Brief — August 13, 2026

Threat actors actively exploit SharePoint auth bypass (CVE-2026-55040) after PoC release

Threat actors have begun exploiting a critical Microsoft SharePoint authentication bypass (CVE-2026-55040, CVSS 9.1) following the public release of a Rapid7 proof-of-concept exploit. The vulnerability chains four weaknesses in the JWT token validation pipeline, allowing unauthenticated attackers to forge valid JWT tokens and impersonate any SharePoint site user or administrator. Rapid7's Python-based PoC queries the target's domain controller, enumerates users by SID, and auto-locates a site administrator. KEVIntel telemetry recorded 12 exploitation attempts since July 19, 2026 — eight of them on August 12–13, indicating the PoC release accelerated exploitation. Attempts originated from eight unique IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. Microsoft patched this in July 2026 Patch Tuesday. (Source: The Hacker News)

Lazarus Group exploits Windows zero-day (CVE-2026-68820) in Operation Dream Job

North Korea's Lazarus Group is actively exploiting CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in Windows AFD.sys (Ancillary Function Driver for WinSock), patched in Microsoft's August 2026 Patch Tuesday. The zero-day is used in Operation Dream Job — a long-running espionage campaign targeting defense and aerospace firms across France, Germany, Brazil, and India via fake LinkedIn recruiter lures. Two infection chains were observed: (1) DLL side-loading via a trojanized libmupdf.dll that deploys the MISTPEN downloader (using Microsoft Graph API/OneDrive for C2) before triggering the AFD.sys exploit to deploy the ForestTiger backdoor; (2) a trojanized "SecurityPDF" viewer that decrypts and loads the Troy backdoor directly into memory when a specially marked PDF is opened. Troy supports 17 commands including file exfiltration, interactive shell, and in-memory DLL injection. The campaign also deploys an updated FudModule kernel rootkit. (Source: The Hacker News)

Chinese-made Zbtlink routers ship with factory-implanted backdoor (ENDLESSDOORS)

VulnCheck discovered a factory-shipped backdoor in at least 21 Zbtlink router models spanning over two years of firmware. The implant, codenamed ENDLESSDOORS, is a customized version of the obscure "rctl" (remote control linux) tool from a 2015 GitHub repo. It masquerades as a kworker kernel thread but runs as a root-privileged userland process, beaconing to Chinese C2 infrastructure (47.107.224.89, rbdg4nzqadui.wikaba.com, and others) every 35 seconds with no authentication or handshake. The protocol supports two commands: "run this as root" and "give me a root shell" (rctlbash opens a live interactive root shell on port 7001). All 21 affected models (including WE1026-5G-WD, WE1326, WE2007, WG1608-DSIM, Z8102AX-2DSIM, and 16 others) start the implant at boot via an init.d script named "skworker." Anyone on the network path or controlling the C2 domain resolution can hijack the implant and obtain a root shell. (Source: The Hacker News)

Metabase zero-day (CVSS 10.0) exploited in the wild; Framework and n8n confirmed compromised

Metabase disclosed active exploitation of a maximum-severity (CVSS 10.0) pre-auth SQL injection flaw in versions 1.58+, allowing unauthenticated attackers to gain admin access, steal database credentials, read/export all connected data, and modify configuration. Metabase Cloud is patched; self-hosted users must upgrade immediately (fixed versions: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5). Workaround: block /api/session/reset_password endpoint. IoCs: POST /api/session/reset_password returning 400 followed by GET /api/user/current returning 200. Confirmed victims: Framework (customer names, login IPs, addresses, phones, emails accessed; no payment data) and n8n (136 customer records with names/emails accessed; 5 records included bcrypt-hashed Cloud passwords). This is Metabase's second severe flaw in three years (CVE-2023-38646, CVSS 9.8, was the previous). (Source: The Hacker News)

Microsoft patches nearly 400 vulnerabilities in August Patch Tuesday; one actively exploited zero-day

Microsoft addressed 398 vulnerabilities (42 rated Critical) in August Patch Tuesday — double June's record and following July's 570+. The sole known zero-day is CVE-2026-68820 (the AFD.sys privilege escalation exploited by Lazarus, above). CVE-2026-62832 (Windows User Profile Service, likely related to the "LegacyHive" disclosure by Nightmare Eclipse) is rated likely exploitable. CVE-2026-72971 (low-impact local tampering) was also publicly disclosed pre-patch. Microsoft attributes the patch volume surge to AI-assisted vulnerability discovery. Industry experts note AI is effective at finding bugs but patching remains human-centric: 1Password research found LLMs produced broken or regression-introducing patches >50% of the time; SANS and Fortra emphasize iterative human-in-the-loop testing. Only 1 of 398 bugs is known actively exploited, so prioritize accordingly. (Source: Krebs on Security)

Canadian threat actor pleads guilty in Snowflake extortion campaign targeting 165+ organizations

Alexander Moucka (26, Kitchener, Ontario), known by aliases "Waifu" and "Judische," pleaded guilty to computer fraud and conspiracy for hacking and extorting 165+ Snowflake customers (including Ticketmaster, LendingTree, Advance Auto Parts, Neiman Marcus) between February–October 2024. Moucka also stole call/text history of 100M+ AT&T customers. The group targeted Snowflake accounts lacking MFA, stole billions of records (PII, financial, DEA numbers, SSNs, passports), and collected $2.5M+ in ransom payments. Moucka also re-extorted victims and harassed officials/researchers. Canadian authorities arrested him in October 2024 on a U.S. provisional warrant. (Source: Krebs on Security)