AI Weekly Malaysia

Microsoft's August 2026 Patch Tuesday closes 398 CVEs (62 Critical), including CVE-2026-68820, a use-after-free in afd.sys (Windows kernel WinSock driver) under active exploitation that escalates privileges to SYSTEM. Check Point Research attributes the zero-day to Lazarus's Operation Dream Job campaign. Four unauthenticated 9.8-CVSS remote code execution flaws affect Windows DNS Server (described as wormable by ZDI), Windows Deployment Services, Microsoft's QUIC implementation, and HPC Pack.

Why: If you operate on-prem Windows servers—especially DNS Server, SharePoint farms, or anything using QUIC—patch immediately and prioritize the actively exploited afd.sys privilege escalation first, then the four 9.8 unauthenticated RCEs. Cloud-native builders on managed infrastructure (AWS/Azure/GCP Linux) are largely unaffected and can deprioritize this.

A critical SharePoint authentication bypass (CVE-2026-55040, CVSS 9.1) patched in Microsoft's July 2026 Patch Tuesday is now being actively exploited after Rapid7 released a Python proof-of-concept. The flaw chains four weaknesses in SharePoint's JWT token validation pipeline (SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2) to let an unauthenticated attacker forge a valid Bearer S2S token and impersonate any site user or administrator.

Why: If your organization runs on-prem SharePoint and has not applied the July 2026 patch, patch immediately or restrict external access—public PoC code means exploitation is now trivial. For most SaaS founders and AI builders not running SharePoint, this is not actionable; the only transferable lesson is the JWT validation anti-pattern (accepting 'alg: none', not verifying x5t thumbprints against trusted issuers), worth checking in your own token-handling code.

Microsoft's August 2026 Patch Tuesday fixed 421 vulnerabilities, down ~200 from the prior month but described as the new norm under AI-assisted disclosure. One of them, CVE-2026-68820, was already exploited as a zero-day by North Korea's Lazarus Group since early June—a use-after-free in the Windows Ancillary Function Driver for WinSock allowing SYSTEM-level code execution by a locally authenticated attacker with no user interaction.

Why: If you manage Windows desktops or servers, patch immediately—CVE-2026-68820 is a local privilege escalation already weaponized by Lazarus in Operation Dream Job social-engineering campaigns targeting defense-sector job seekers in Europe and India. For most cloud-native or Linux-based builders in this community, there is no direct action; the bug requires local authentication and the attack chain targets a specific sector.