Daily · 2026-08-12
🔴 Zoomsday zero-click RCE patched, 📋 Microsoft Patch Tuesday hits ~400 CVEs with exploited WinSock zero-day, 🛡️ Cisco ASA/FTD zero-day joins KEV, 🎣 Sandworm trojanizes WireGuard in fake interviews, 🐳 CopyEscape Docker escape, ⚠️ Kimwolf botnet rebuilt with HTTP/2 floods
Zoom patched a zero-click RCE that lets meeting participants execute code on other attendees' devices, Microsoft shipped a near-record Patch Tuesday including an AFD.sys zero-day exploited by Lazarus, perimeter VPN appliances stayed under active attack, and Sandworm pushed trojanized WireGuard installers through fake job interviews.
Zoom's "Zoomsday" zero-click RCE is the day's defining story. CVE-2026-53413, a CVSS 8.3 flaw in the Zoom Client annotation engine, lets a meeting participant execute code on another attendee's device with no interaction beyond joining the call, so fleet-wide updates are the only mitigation.
Microsoft shipped one of its largest Patch Tuesday releases on record, roughly 400 CVEs including three zero-days. Priority is CVE-2026-68820, the WinSock AFD.sys privilege escalation flaw Lazarus exploits for SYSTEM, plus RCEs in QUIC, DNS Server, and Outlook via malicious Office files. Microsoft's AI-assisted discovery pipeline expects volumes like this to keep coming, making patch triage the binding constraint.
Perimeter appliances kept taking fire. Cisco patched an ASA/FTD SSL VPN zero-day that lets unauthenticated attackers crash firewalls with a crafted HTTP request; CISA added it to KEV on August 11, federal deadline August 14. Ivanti EPM and the ICS Patch Tuesday roundup from Siemens, Schneider, and Phoenix Contact fill out the appliance queue.
CERT-UA tied a trojanized WireGuard client delivered through fake IT job interviews to a Sandworm-adjacent cluster targeting system administrators, while a ClickFix chain ends in CNCMachineRMS, an undocumented no-import-table implant. The Kimwolf botnet rebuilt itself around HTTP/2 floods with full Chrome fingerprints, and CopyEscape lets a malicious container overwrite host files via docker cp. The Unsafe group claimed Presentations.AI, and DEF CON attendees ran an evil twin phishing attack on in-flight Wi-Fi. Watchlist: verify Zoom patching, deploy the AFD.sys fix, audit internet-facing ASA/FTD, distrust docker cp from untrusted containers, and treat unsolicited interview VPN installers as malicious.