☕ Good Morning Security Gang
Today’s show is packed, and there’s a reason for it. Patch Tuesday and payday for attackers have landed almost simultaneously, giving security teams a massive remediation workload while adversaries continue exploiting the infrastructure and processes we inherently trust.
We’ve got Cisco confirming active exploitation against ASA and Firepower Threat Defense VPN gateways, Microsoft delivering an enormous 421-CVE August Patch Tuesday, including an actively exploited Windows kernel vulnerability, ransomware operators escalating their attack against a hospital system by hijacking its Facebook presence, and Sandworm turning something as routine as a technical job interview into a malware delivery mechanism. Then there’s Adobe, SAP and Zoom patching serious vulnerabilities, North Korea apparently managing to place a fraudulent remote IT worker inside a U.S. federal agency, ransomware moving command-and-control infrastructure onto blockchain technology, a DEF CON-related stunt aboard a commercial flight that crossed well beyond responsible research, and another round of cybersecurity layoffs.
The thread connecting today’s stories is trust. We trust our VPN gateway to stay available. We trust that installing a patch actually closes the vulnerability. We trust the recruiter messaging us about the next career opportunity. We trust software updates, identities and business processes. Attackers increasingly understand those assumptions and are building their operations around exploiting them.
Grab the double espresso or apparently tea for quite a few of you.
Coffee Cup Cheers, Security Gang.
🧭 Today’s Cybersecurity Picture
Today’s episode illustrates how much the definition of attack surface has expanded. The enterprise perimeter now includes not only firewalls and VPN concentrators but also job interviews, remote-work hiring processes, browser extensions, video meetings, third-party drivers and the software supply chain supporting everyday enterprise operations.
At the same time, the sheer volume of vulnerabilities security teams must process continues climbing. Microsoft alone delivered 421 fixes this month, while Cisco, Adobe, SAP and Zoom all have their own significant remediation requirements. That makes prioritization critical. Security teams cannot treat every vulnerability identically, but they also cannot blindly adopt a vendor’s recommended remediation timeline.
Prioritize what is exploitable, validate that the remediation works and understand what sits behind the vulnerable system.
📰 Today’s Top Stories
🚨 Cisco Confirms Active Exploitation Against ASA and FTD VPN Gateways
We start with Cisco because this belongs at the top of today’s remediation queue. Cisco confirmed active exploitation of a high-severity denial-of-service vulnerability affecting Secure Firewall ASA and Firepower Threat Defense software. An unauthenticated remote attacker can send a specially crafted request to a vulnerable SSL listening socket, causing the appliance to reload. No credentials and no user interaction are required.
The vulnerable configurations include remote-access VPN functionality, SSL VPN services and certain Zero Trust Network Access configurations on FTD. Firewall Management Center itself is not affected. Cisco has issued hotfixes across multiple supported ASA and FTD branches, and according to the show, there is no vendor workaround, making patching the primary remediation path. Cisco’s PSIRT confirmed exploitation this month but has not yet disclosed the attacker, victims or indicators of compromise, which makes proactive hunting considerably harder.
For organizations operating Cisco ASA or FTD with externally reachable remote-access services, I would treat this as today’s top priority. Get the hotfix deployed and review appliance availability and reload events for anomalous activity. This also arrives while Cisco is addressing separate ClamAV vulnerabilities affecting Secure Endpoint Connector, with public proof-of-concept code already circulating for some issues. Two separate Cisco security tracks in the same week deserve attention.
🪟 Microsoft Patch Tuesday Lands With 421 CVEs
Microsoft’s August Patch Tuesday arrived with a massive 421 resolved CVEs, including one vulnerability already being exploited in the wild. The highest priority is CVE-2026-68820, a use-after-free vulnerability affecting afd.sys, the kernel-mode driver underlying the Windows Sockets API. A locally authenticated attacker can trigger a race condition through a crafted application and escalate privileges directly to SYSTEM, without additional user interaction once the exploit executes.
Microsoft has not disclosed details about the attacks it has observed, but there is historical context worth watching. Tenable noted this is the fourth exploited AFD.SYS zero-day since 2022, with one earlier vulnerability associated with North Korea’s Lazarus Group. That doesn’t establish attribution for this incident, but it reinforces the attractiveness of this Windows component to sophisticated operators.
Two additional vulnerabilities deserve accelerated attention. One affects Windows User Profile Service and could allow an attacker with another local account to access another user’s registry hive before escalating privileges. A second publicly disclosed issue affects the Container Isolation FS Filter Driver. Beyond those, Microsoft patched remote-code-execution vulnerabilities across Windows DNS Server, Windows Deployment Services, TFTP Server, Microsoft QUIC and HPC Pack, alongside an Exchange Server elevation-of-privilege issue.
My priority order would be straightforward: the exploited AFD.SYS vulnerability first, the publicly disclosed User Profile Service vulnerability second, followed by risk-based deployment across the rest of the estate.
🏥 AnMed Ransomware Attack Escalates Into Public Extortion
The cyberattack against nonprofit hospital system AnMed continues, and more than two weeks after the original disclosure, operational disruption remained significant, with multiple facilities closed for appointments. But the ransomware group calling itself The Gentlemen has now escalated the attack beyond encryption and data theft by hijacking AnMed’s Facebook page and posting ransom demands directly to the hospital’s audience before the page was removed.
The attackers claim to have stolen approximately six terabytes of data, including extraordinarily sensitive records allegedly involving sexual assault, mental health, abortion care and sexual-harassment complaints. AnMed had not confirmed the scope of patient information affected at the time of the episode, and the attackers had not publicly substantiated those specific claims.
The Gentlemen has emerged as a highly active ransomware-as-a-service operation, with affiliates reportedly retaining 90% of ransom payments—an unusually generous model likely helping the operation recruit aggressively. Their attack methodology should look familiar to defenders: target internet-facing edge infrastructure, brute-force VPN and web-panel credentials, exploit known vulnerabilities or purchase initial access, obtain administrative privileges, disable security tools, exfiltrate information and finally encrypt systems.
Researchers have also observed the group abusing vulnerable third-party drivers to terminate EDR products. That makes EDR tamper protection and vulnerable-driver controls particularly important alongside the usual VPN, identity and edge-device hardening.
🎯 Sandworm Turns the IT Job Interview Into an Attack Vector
Ukraine’s CERT is warning that attackers linked to Russia’s Sandworm operation have been running a recruitment-themed social engineering campaign against system administrators and IT professionals since at least May. And this is one of the stories security leaders should discuss directly with their technical teams because the attack is designed specifically to survive the scrutiny of people trained to detect attacks.
The adversaries research resumes published on legitimate employment platforms, contact candidates while posing as recruiters, move conversations to Telegram and arrange apparently legitimate Zoom interviews. During the interview, the candidate receives a technical exercise requiring connection to a corporate VPN. In one documented incident, attackers impersonated the real IT company Sopra Steria using lookalike infrastructure associated with its Bulgarian operations.
The technical assignment directs the victim to download a modified WireGuard client masquerading as a corporate VPN application. On Windows, the trojanized client decrypts and executes embedded PowerShell, establishes persistence through a scheduled task and retrieves additional payloads. The Linux version similarly retrieves malware through the VPN tunnel. Attackers even modified WireGuard’s standard Base64 implementation with a dynamically generated alphabet to frustrate static detection.
That’s what makes this campaign effective. Nothing about receiving a technical exercise during an IT interview is inherently suspicious.
The attacker has simply taken a legitimate hiring workflow and inserted malware into the part where the candidate expects to install technology.
🧠 Why Technical Employees Need Different Security Awareness
This Sandworm campaign exposes a blind spot in traditional security-awareness programs.
We’ve spent years telling users not to click suspicious links, verify unexpected attachments and question unusual requests. But we rarely train highly technical employees to think defensively about career opportunities. A sysadmin considering another job expects recruiters, Zoom interviews, coding exercises and potentially a corporate VPN.
And organizations cannot realistically tell employees not to explore other opportunities.
That means security awareness needs to evolve beyond traditional phishing simulations. Technical teams should understand that job interviews, open-source contribution requests, recruiter outreach and technical assessments can all become delivery mechanisms for sophisticated threat actors.
The people most capable of spotting malicious infrastructure are still vulnerable when the attack arrives inside a workflow they inherently expect to trust.
⚡ Quick Hits
“Attackers are just as happy to exploit your process as your code.” James Azar
🅰️ Adobe Patches More Than 50 Vulnerabilities
Adobe released fixes for more than 50 vulnerabilities, including three Priority 1 critical vulnerabilities affecting ColdFusion. The issues include an OS command injection vulnerability carrying a perfect severity score, an expression-language injection vulnerability and a serious authorization flaw. Campaign Classic also received three critical Priority 1 updates, while Commerce received seven additional fixes.
Adobe reported no known exploitation at the time of the episode, but Priority 1 tells you how seriously Adobe expects organizations to treat these issues. My recommendation remains the same: vendor patch timelines are guidance, not your risk model.
🏢 SAP Fixes Critical Commerce Cloud and NetWeaver Vulnerabilities
SAP’s August security release includes four critical vulnerabilities, led by a perfect-severity authorization bypass affecting Commerce Cloud’s Data Hub Adapter. Additional critical vulnerabilities include code-injection flaws affecting Manufacturing Integration and Intelligence and a memory-corruption vulnerability affecting NetWeaver Application Server ABAP that can be exploited without authentication.
No exploitation had been reported, but Commerce Cloud and NetWeaver represent attractive enterprise targets. These belong high in the remediation queue.
🎥 “Zoom’s Day” Delivers a Zero-Click RCE
Zoom patched a zero-click remote-code-execution vulnerability researchers appropriately nicknamed “Zoom’s Day.” The vulnerability allows another meeting participant to potentially compromise a victim’s machine through Zoom’s annotation functionality without requiring clicks or warning prompts.
“A real-sounding company, a Zoom interview and a technical assignment, that’s the whole point. It’s built to survive scrutiny from people whose job is scrutiny.” James Azar
Three additional vulnerabilities affecting annotation functionality and VDI clients were corrected alongside it. Organizations should update Zoom Workplace, Rooms and Meeting SDK deployments to the fixed versions identified for their environment.
A meeting participant silently obtaining code execution through a collaboration feature is exactly the type of vulnerability that deserves accelerated deployment.
⛓️ Deadlock Ransomware Moves Command-and-Control Onto Blockchain Infrastructure
The Deadlock ransomware operation is experimenting with a more resilient infrastructure model by storing command-and-control addresses on the Polygon blockchain rather than relying exclusively on traditional domains or Tor infrastructure. The group also uses decentralized communications for victim negotiations and cloud storage for stolen information.
The strategy is designed to make traditional law-enforcement infrastructure takedowns more difficult. According to the episode, Deadlock had affected eight organizations, primarily in Europe. Microsoft recommends EDR block mode, tamper protection, controlled-folder access and attack-surface-reduction rules aimed at restricting the lateral-movement tooling used by the operation.
Attack infrastructure is becoming more decentralized because criminals understand exactly how defenders and law enforcement dismantle conventional operations.
🇰🇵 North Korean IT Worker Reportedly Reaches a U.S. Federal Agency
The FBI is investigating how a North Korean national allegedly obtained a remote IT position inside an undisclosed U.S. federal agency, representing a significant escalation of the fraudulent remote-worker scheme previously documented across hundreds of private-sector organizations.
The episode notes that it remains unclear how government vetting was bypassed or whether information was compromised. Those details matter, and we should avoid filling the gaps until investigators release more information.
But if confirmed as described, this should force organizations to rethink remote-worker verification. Identity validation cannot end after onboarding. Organizations need continuous assurance that the individual performing the work is actually the person who was hired.
🦊 Mozilla Rotates Firefox and Thunderbird Package-Signing Key
Mozilla is rotating the GPG key used to sign Linux packages for Firefox and Thunderbird after an unencrypted copy was accidentally committed to a private GitHub repository.
Mozilla reported no evidence of unauthorized access, and exposure was limited because the repository itself was available only to a small group of already authorized users. Most users do not need to take action, although organizations manually validating signatures or installing Firefox through RPM workflows should update their verification procedures.
🤦 Boneheaded Move: DEF CON Apparently Continued at 30,000 Feet
And then we have today’s boneheaded move.
Delta is reportedly investigating allegations that passengers returning from DEF CON conducted a Wi-Fi deauthentication attack aboard an Atlanta-bound flight from Las Vegas, disrupting connectivity for other passengers while allegedly broadcasting a rogue Delta-branded access point designed to capture credentials. The crew disabled onboard Wi-Fi for approximately 30 minutes, and federal agents met the aircraft and seized equipment. No aircraft safety systems were reportedly affected.
If the allegations are accurate, there’s not much nuance required here. Responsible security research requires authorization. A commercial aircraft filled with passengers isn’t your lab. DEF CON ended when you left the conference.
👥 Rapid7 Cuts 12% of Its Workforce
Finally, Rapid7 is eliminating approximately 314 positions, or 12% of its workforce, as its new CEO restructures the vulnerability-management company. For customers, the immediate operational question is whether support coverage, product development or account management will be affected. That is worth discussing directly with your account team.
The broader cybersecurity market is also going through a significant transition. Platform consolidation, AI and changing customer expectations are placing enormous pressure on established security vendors. Market leadership doesn’t guarantee future relevance if innovation slows or customer requirements move elsewhere.
The important part, however, is remembering that layoffs affect people, not logos. The employees losing their jobs generally aren’t the people responsible for strategic complacency, and our cybersecurity community should continue helping talented practitioners land their next opportunity.
💬 Two Memorable Quotes from James Azar
🧠 James Azar’s CISOs Take
What I take away from today’s show is that trust is becoming one of our largest attack surfaces. We trust the VPN because it’s security infrastructure. We trust Microsoft when an update installs successfully. We trust the recruiter because they know our background and understand our technology stack. We trust the remote employee because they passed onboarding. Every one of those assumptions can now be weaponized. That doesn’t mean eliminating trust, it means validating it. Patch the Cisco appliance, but verify the service afterward. Install Microsoft’s fixes, but continue hunting for exploitation. Verify the remote employee after hiring, not just before. And teach technical teams that a perfectly credible job opportunity can still be an attack chain.
The second issue is speed. Four hundred and twenty-one Microsoft vulnerabilities in one release sounds overwhelming because it is. Add Cisco, Adobe, SAP and Zoom on the same cycle and no enterprise can realistically treat everything as Priority 1. The answer isn’t panic; it’s disciplined prioritization. Start with active exploitation, then public disclosure and exploitability, then exposure and business consequence. Your patch queue should reflect your architecture and threat model rather than somebody else’s generic severity rating. Attackers are moving faster, but defenders have better telemetry and better automation than we’ve ever had. The organizations that combine those capabilities with disciplined fundamentals are going to be just fine.
Stay Cyber Safe 🔥
