AI Weekly Malaysia

Attackers are actively exploiting CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in Broadcom VMware vCenter, with 361 victim IPs across 47 countries as of August 2026. Patches were released by Broadcom in late July 2026, and exploitation began within days of disclosure, using reverse_ssh via cron jobs for persistent remote access. QUIRSO attributes the campaign to a suspected APT actor.

Why: If your team runs VMware vCenter and has not applied Broadcom's late-July 2026 patch, patch now — the exploit chain is trivial enough that 361 hosts were compromised within days of disclosure. The reverse_ssh persistence technique bypasses inbound firewall rules, so compromised hosts may not show obvious inbound connection alerts.

Adobe patched three CVSS 10.0 vulnerabilities across ColdFusion and Campaign Classic, including OS command injection (CVE-2026-48362) and eval injection (CVE-2026-48273) in ColdFusion, plus incorrect authorization flaws in Campaign Classic (CVE-2026-71398, CVE-2026-27302). ColdFusion fixes are in versions 2025.0.12 and 2023.0.23; Campaign Classic fixes require ACC v7 7.4.4 build 9400 for on-premise deployments only. Adobe rated these Priority 1 and recommends patching within 72 hours.

Why: If you maintain or inherit ColdFusion or on-premise Campaign Classic instances—common in legacy Malaysian enterprise, GLC, and some government digital service stacks—these are remotely exploitable arbitrary code execution bugs with no current wild exploitation, meaning patching now is cheap insurance before attackers reverse-engineer the fixes. Adobe-hosted Campaign instances are already patched, so only on-premise and hybrid deployments need action.

Microsoft's August 2026 Patch Tuesday closes 398 CVEs (62 Critical), including CVE-2026-68820, a use-after-free in afd.sys (Windows kernel WinSock driver) under active exploitation that escalates privileges to SYSTEM. Check Point Research attributes the zero-day to Lazarus's Operation Dream Job campaign. Four unauthenticated 9.8-CVSS remote code execution flaws affect Windows DNS Server (described as wormable by ZDI), Windows Deployment Services, Microsoft's QUIC implementation, and HPC Pack.

Why: If you operate on-prem Windows servers—especially DNS Server, SharePoint farms, or anything using QUIC—patch immediately and prioritize the actively exploited afd.sys privilege escalation first, then the four 9.8 unauthenticated RCEs. Cloud-native builders on managed infrastructure (AWS/Azure/GCP Linux) are largely unaffected and can deprioritize this.

A critical SharePoint authentication bypass (CVE-2026-55040, CVSS 9.1) patched in Microsoft's July 2026 Patch Tuesday is now being actively exploited after Rapid7 released a Python proof-of-concept. The flaw chains four weaknesses in SharePoint's JWT token validation pipeline (SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2) to let an unauthenticated attacker forge a valid Bearer S2S token and impersonate any site user or administrator.

Why: If your organization runs on-prem SharePoint and has not applied the July 2026 patch, patch immediately or restrict external access—public PoC code means exploitation is now trivial. For most SaaS founders and AI builders not running SharePoint, this is not actionable; the only transferable lesson is the JWT validation anti-pattern (accepting 'alg: none', not verifying x5t thumbprints against trusted issuers), worth checking in your own token-handling code.

Microsoft's August 2026 Patch Tuesday fixed 421 vulnerabilities, down ~200 from the prior month but described as the new norm under AI-assisted disclosure. One of them, CVE-2026-68820, was already exploited as a zero-day by North Korea's Lazarus Group since early June—a use-after-free in the Windows Ancillary Function Driver for WinSock allowing SYSTEM-level code execution by a locally authenticated attacker with no user interaction.

Why: If you manage Windows desktops or servers, patch immediately—CVE-2026-68820 is a local privilege escalation already weaponized by Lazarus in Operation Dream Job social-engineering campaigns targeting defense-sector job seekers in Europe and India. For most cloud-native or Linux-based builders in this community, there is no direct action; the bug requires local authentication and the attack chain targets a specific sector.