☕ Good Morning Security Gang
I could have easily brought twenty stories to today’s show. I settled on eleven, and together they point toward an uncomfortable reality every security practitioner needs to understand: our traditional patching timelines are increasingly disconnected from the speed of modern exploitation.
We have a maximum-severity VMware vCenter vulnerability that attackers began exploiting within days, with hundreds of systems compromised across 47 countries. North Korea’s Lazarus Group is exploiting the Windows zero-day Microsoft patched this week against defense and aerospace organizations. Another SharePoint vulnerability went from public proof-of-concept code to observed attacks in less than 24 hours. And we’re finally understanding the scope of the LiteLLM supply-chain compromise, which potentially exposed secrets across thousands of organizations and hundreds of thousands of CI/CD pipelines.
We’ll also cover active probing against Adobe Commerce, a year-long Salesforce and ServiceNow data-theft campaign, claims of a breach at Uber Freight, a British government security failure that went undetected for nearly two years, major ICS patches from Siemens and Schneider Electric, more than 80 Intel and AMD vulnerabilities and a new set of Palo Alto Networks fixes.
Whatever your patching SLA says on paper, today’s stories should force a conversation about whether it still reflects reality.
Grab your coffee, tea or whatever you’re drinking wherever you are in the world. Coffee Cup Cheers, Security Gang.
🧭 Today’s Cybersecurity Picture
The dominant theme today is speed.
Security programs have historically built vulnerability-management processes around fixed remediation windows: three days for critical issues, seven days for high severity, 30 days for everything else. Those policies make sense operationally because testing, change management and business availability matter. But attackers aren’t operating according to our change-control calendars.
We’re increasingly seeing researchers publish technical details, threat actors reverse-engineer patches and exploitation begin almost immediately. The VMware incident gave defenders roughly five days before large-scale compromise was visible. The latest SharePoint vulnerability went from public proof-of-concept code to exploitation attempts in less than 24 hours.
That doesn’t mean abandoning change management. It means building an emergency vulnerability lane capable of operating at attacker speed when the circumstances demand it.
📰 Today’s Top Stories
🚨 VMware vCenter Flaw Compromises Hundreds of Servers Across 47 Countries
We start with what I consider the most severe vulnerability on today’s docket: a critical directory-traversal vulnerability affecting VMware vCenter, the management plane sitting behind virtualization environments and data centers around the world. The vulnerability affects vCenter’s syslog server component and can allow an unauthenticated attacker with network access to a vulnerable instance to achieve remote code execution with SYSTEM-level privileges. The vulnerability carries a CVSS score of 9.8, and Broadcom has confirmed there is no workaround.
“Five days. That’s the entire runway you got between a vendor advisory and 95% of the eventual victims already being owned.” James Azar
Broadcom disclosed the vulnerability on July 29. Researchers began detecting compromised systems communicating with attacker-controlled infrastructure only days later. By August 5, 343 of the eventual 361 identified victim systems roughly 95% had already been compromised. Researchers identified victims across 47 countries, with Germany, the United States, Turkey, Iran and France among the most heavily affected.
Once inside, attackers deployed Reverse SSH, an open-source Go-based reverse-shell utility. That gives attackers persistent outbound connectivity capable of bypassing traditional inbound firewall controls while supporting port forwarding, lateral movement, file transfer and potential staging or exfiltration of virtual-machine data. Because the traffic appears as outbound SSH, it can also blend into legitimate administrative activity.
If you’re running vulnerable vCenter infrastructure, there isn’t much room for debate here. Patch it. Broadcom says there is no workaround. Pull management interfaces off the public internet, require VPN and MFA for administrative access, and hunt aggressively for Reverse SSH artifacts and anomalous outbound SSH connections.
Five days between disclosure and widespread compromise isn’t a patch cycle.
It’s an incident-response timer.
🇰🇵 Lazarus Exploits Windows Zero-Day Against Defense and Aerospace Organizations
Yesterday we discussed Microsoft’s August Patch Tuesday and CVE-2026-68820, the use-after-free vulnerability affecting the Windows Ancillary Function Driver for WinSock, AFD.SYS. Today we have more context, and it gets significantly more serious.
Researchers have tied exploitation to North Korea’s Lazarus Group, which built an exploit specifically targeting modern Windows 11 builds and incorporated it into a new version of its FudModule rootkit. FudModule has previously been used to interfere with EDR telemetry, but this version adds additional functionality capable of tampering with Windows Smart App Control.
Lazarus is deploying the exploit alongside a new backdoor called Troy, which supports 17 commands covering capabilities including file exfiltration, in-memory DLL injection and remote process termination. The activity is part of the group’s long-running Operation Dream Job, where fake recruitment opportunities are used to target employees and contractors.
This latest wave is particularly focused on defense, aerospace and aviation organizations across Europe and India, with confirmed targeting including France, Germany and Brazil. The attackers are showing particular interest in military technology involving surveillance sensors, drones and robotics. In at least one case, a compromised French organization was subsequently used as infrastructure for spear-phishing additional targets.
The same operators are also scanning vulnerable Roundcube webmail deployments, combining leaked credentials with an authenticated deserialization vulnerability to deploy a PHP web shell known as RelayShell. Researchers have identified at least 17 infected servers.
For defense-industrial-base organizations, the message is straightforward: prioritize the Windows update immediately, investigate unexplained EDR telemetry gaps and ensure Roundcube environments are current while hunting for RelayShell indicators.
🔥 Fifth SharePoint Vulnerability Exploited This Summer
Microsoft SharePoint continues having an exceptionally difficult summer.
A newly disclosed SharePoint vulnerability allows authenticated users to bypass restrictions and access or modify information they shouldn’t be able to reach. On August 11, Rapid7 published detailed technical research and proof-of-concept exploit code. Less than 24 hours later, threat-intelligence researchers reported exploitation attempts against honeypots using that same public proof of concept.
At the time of the episode, Microsoft’s advisory had not yet been updated to acknowledge active exploitation. That doesn’t mean defenders should wait. We’ve repeatedly seen vendor advisories and exploitation catalogs lag behind telemetry coming from researchers observing attacks in real time.
More importantly, this is now the fifth SharePoint vulnerability exploited in the wild this summer alone.
Rapid7 separately disclosed another SharePoint vulnerability that can be chained with an existing weakness to achieve unauthenticated remote code execution against vulnerable servers. That second vulnerability was patched in this week’s Microsoft update and had not yet been observed under active exploitation at the time of the show but given the pattern we’ve seen, I wouldn’t build my risk decision around that remaining true.
If you’re operating on-premises SharePoint, confirm that both July and August updates are deployed. Then monitor authentication logs, anomalous access attempts and unusual activity against internet-facing SharePoint front ends.
The era of waiting until the next maintenance weekend is rapidly disappearing for exposed enterprise platforms.
🤖 LiteLLM Supply-Chain Attack Reaches 2,500 Organizations
The fourth major story is one we’ve known about for months, but we’re only now beginning to understand the potential scale.
Research cited in today’s show estimates that the LiteLLM supply-chain compromise potentially affected more than 2,500 organizations and exposed approximately 434,000 CI/CD pipelines. The attack chain demonstrates precisely why modern software supply chains are so difficult to secure.
Attackers first compromised Aqua Security’s Trivy vulnerability scanner. LiteLLM’s own automated build process subsequently pulled in the poisoned dependency, giving the attackers tracked as Team PCP access to LiteLLM’s release pipeline. They then published two malicious LiteLLM Python package versions to PyPI.
The malicious packages were available for only around 40 minutes.
Forty minutes was enough.
Automated dependency resolvers, build systems, caches and CI/CD pipelines propagated the packages across environments before they were removed. The reconstructed exposure list includes organizations such as NVIDIA, AWS, Samsung, Salesforce, Cisco, ServiceNow, Siemens, Regeneron, London Stock Exchange Group, FedEx, Volkswagen and Zscaler.
Importantly, appearing on that reconstructed list does not establish that every organization was successfully compromised. The research describes potential exposure based on package use, and organizations need to independently establish whether malicious versions executed inside their environments.
The potentially exposed information, however, is significant: cloud credentials, SSH keys, API tokens, package-publishing credentials, environment variables and AI-provider API keys.
If your organization consumed the affected LiteLLM versions during the exposure window, don’t waste time debating whether a particular secret was actually accessed. Treat secrets reachable by the process as potentially compromised and rotate them. That includes credentials stored in process memory, environment variables, disk or instance metadata, along with associated service accounts and sessions.
This is why software supply-chain incidents are so dangerous: 40 minutes of malicious code can create months of remediation work.
⚡ Quick Hits
“No workaround means no excuse.” James Azar
🛒 Adobe Commerce and Magento Vulnerability Already Being Probed
Adobe patched seven vulnerabilities affecting Commerce and Magento, and researchers are already detecting probing activity against one of them. According to the episode, web application firewalls have begun blocking exploitation attempts capable of potentially hijacking customer accounts without credentials.
If you’re operating Adobe Commerce, Commerce B2B or Magento, this is another patch that shouldn’t sit in a routine monthly queue. Get the update deployed and review authentication activity for indications of account takeover attempts.
☁️ Salesforce and ServiceNow Guest Accounts Expose Data for More Than a Year
Researchers have identified a data-theft campaign dubbed CityForum that has reportedly been quietly extracting information from Salesforce and ServiceNow customer portals for more than a year.
And this isn’t a zero-day.
It’s a configuration problem.
Attackers abused guest-user permissions that unintentionally allowed unauthenticated users to access sensitive information through customer-facing portals. A single server was reportedly used to systematically collect exposed information across affected environments.
Organizations running Salesforce or ServiceNow customer portals should audit guest-user sharing rules, record visibility and portal permissions immediately.
Sometimes the fastest vulnerability to fix doesn’t require a patch at all.
🚚 Helix Claims Uber Freight Breach
A hacking group known as Helix, also tracked as UNC6671, is claiming it breached Uber Freight and stole information from mailboxes, cloud storage and dispatch documentation.
Uber Freight has said operations remain unaffected but had not confirmed the attackers’ claims at the time of the show. The group reportedly generated approximately $10.6 million in ransom payments between January and May, primarily through social-engineering attacks against IT help desks.
Until Uber Freight confirms the scope, treat the attackers’ claims as claims rather than established facts. But the help-desk attack vector deserves attention regardless. Identity verification at IT support desks continues to be one of the most exploitable human control points inside the enterprise.
🇬🇧 UK Criminal Records Office Missed Security Breaches for Nearly Two Years
Britain’s data protection regulator reprimanded the ACRO Criminal Records Office following three breaches that reportedly remained undetected for nearly two years.
The root cause wasn’t sophisticated nation-state tradecraft. According to the episode, antivirus alerts went unread while a content-management system remained unpatched for almost four years. Information belonging to nearly 11,000 people was reportedly staged for theft before the activity was identified.
This is the kind of incident security leaders should use internally because it demonstrates something uncomfortable: buying security tools doesn’t create security.
Someone has to monitor them, respond to them and maintain the systems they’re protecting.
🏭 Siemens, Schneider Electric and Phoenix Contact Release Major ICS Updates
Patch Tuesday wasn’t limited to Windows endpoints.
Siemens issued ten new security advisories, including a maximum-severity unauthenticated remote-code-execution vulnerability affecting SIMATIC IOT2050 devices. Schneider Electric and Phoenix Contact also released fixes covering vulnerabilities affecting industrial equipment including APC PowerChute and PLCnext firmware.
If you’re responsible for operational technology, don’t let these disappear inside the enterprise Patch Tuesday noise. Industrial systems have different maintenance constraints, but they also carry different consequences when compromised.
Plant-floor teams should read the vendor advisories directly, establish exposure and determine remediation windows based on operational consequence not simply CVSS scores.
💻 Intel and AMD Patch More Than 80 Vulnerabilities
Intel and AMD combined to address more than 80 vulnerabilities this month. Intel accounted for 72 issues spanning products including Xeon processors and wireless drivers, while AMD corrected high-severity vulnerabilities affecting its Vitis development environment and Ryzen Master utility.
No active exploitation was identified in the episode.
The bigger problem is cumulative workload. Add more than 80 processor and driver vulnerabilities to 421 Microsoft CVEs, Cisco, Adobe, SAP, VMware and everything else released this week, and patch prioritization becomes an operational necessity rather than a vulnerability-management preference.
🛡️ Palo Alto Networks Releases PAN-OS, GlobalProtect and Prisma Access Fixes
Palo Alto Networks released additional security updates on August 12 affecting PAN-OS, GlobalProtect and Prisma Access rather than joining the traditional Patch Tuesday release.
The highest severity reported in the episode was 7.2, with no vulnerabilities known to be under active exploitation. The largest concentration of updates affects GlobalProtect desktop clients.
These aren’t necessarily drop-everything emergency fixes based on the information currently available, but GlobalProtect sits directly inside enterprise remote-access architecture. Get the updates into your normal accelerated remediation process and continue watching for any change in exploitation status.
🧠 James Azar’s CISOs Take
What I take away from today’s show is that we have to rethink vulnerability-management SLAs around exploitability rather than calendar time. I’m not arguing that every critical CVE should become an emergency change. That’s impossible at enterprise scale, and this week’s vulnerability volume proves it. But when you’ve got an internet-facing management plane, public exploit code, observed scanning and a vulnerability capable of giving an unauthenticated attacker SYSTEM-level access, your standard seven-day or 30-day remediation policy becomes irrelevant. VMware gave us a perfect example: five days from disclosure to the overwhelming majority of identified victims already being compromised. We need emergency remediation paths that allow infrastructure, security and business teams to move at that speed without abandoning responsible change management.
The LiteLLM incident reinforces the other side of the problem. Our attack surface isn’t limited to the infrastructure we directly operate anymore. Automated build pipelines are pulling packages, libraries and dependencies from ecosystems we don’t control, and AI development is accelerating that dependency chain even further. Forty minutes of exposure was enough for a malicious package to potentially propagate across thousands of organizations and hundreds of thousands of pipelines. That means software composition, CI/CD security, secrets management and credential rotation need to become core operational security disciplines.
We aren’t going to eliminate dependencies or stop using open source. The answer is knowing what we’re consuming, controlling what can access secrets and being able to rotate credentials at machine speed when the supply chain fails.
🛠️ Action Items
Emergency-patch vulnerable VMware vCenter instances and do not wait for a normal maintenance window where exposure exists.
Remove vCenter management interfaces from direct internet exposure and require VPN plus MFA for administrative access.
Hunt for Reverse SSH activity and investigate anomalous outbound SSH connections from virtualization infrastructure.
Prioritize CVE-2026-68820 across Windows environments, particularly defense, aerospace and other Lazarus-targeted organizations.
Investigate unexplained EDR telemetry gaps as potential indicators of rootkit activity rather than assuming an endpoint-agent malfunction.
Patch and audit Roundcube deployments and hunt for RelayShell indicators where the platform is exposed.
Confirm July and August SharePoint patches are installed across every on-premises deployment.
Monitor SharePoint authentication and front-end logs for exploitation attempts, particularly where systems are externally accessible.
Identify whether affected LiteLLM versions entered any CI/CD pipeline and establish the exact exposure window.
Rotate all secrets potentially reachable by compromised LiteLLM processes, including cloud credentials, SSH keys, API tokens and AI-provider keys.
Audit Salesforce and ServiceNow guest-user permissions and eliminate unnecessary anonymous access to sensitive records.
Strengthen IT help-desk identity verification against social-engineering attacks targeting password and MFA resets.
Prioritize Adobe Commerce and Magento updates where affected platforms are internet-facing.
Review Siemens, Schneider Electric and Phoenix Contact advisories directly with OT and plant operations teams.
Risk-rank Intel and AMD patches based on deployed hardware and exposure rather than adding more than 80 vulnerabilities blindly to the same queue.
Deploy Palo Alto GlobalProtect updates through your accelerated maintenance process and continue monitoring for changes in exploitation status.
Reevaluate vulnerability-management SLAs so actively exploited and internet-facing vulnerabilities can bypass standard patch cycles through a controlled emergency process.
🔥 Stay Cyber Safe.
