17th August – Threat Intelligence Report
Microsoft released its August 2026 patch updates to address 421 vulnerabilities, critically including CVE-2026-68820, a Windows Ancillary Function Driver for WinSock zero-day that is currently being exploited by Lazarus-linked actors to achieve SYSTEM privileges via local privilege escalation.
Simultaneously, Adobe deployed an urgent fix for CVE-2026-71362 in Adobe Commerce and Magento Open Source, reporting immediate attacks shortly after public disclosure that allow unauthorized session switching and account takeover. Additionally, Zoom issued patches for three critical flaws, such as CVE-2026-53413, which permit remote code execution without user interaction through meeting annotations.
For the latest discoveries in cyber research for the week of 17th August, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes. Officials confirmed that some files were encrypted but stated that no data theft was detected during the incident.
- MyDr, Poland’s primary healthcare platform for appointments, medical records, and prescriptions, has suffered a data breach potentially affecting nearly 19 million citizens. Attackers claimed to hold 2.5TB of information and shared a senior politician’s identification details, phone numbers, and prescriptions as evidence of the compromise.
- Levi Strauss & Co., the global American apparel company, has reported a cyberattack after attackers used social engineering to compromise three employee devices and steal corporate information. According to the firm, preliminary findings indicate no consumer data was accessed or copied. The company notified affected individuals and relevant regulators.
- IEH Corporation, a US defense and aerospace component manufacturer, has confirmed a phishing compromise of an employee’s Microsoft 365 mailbox. Attackers used a fraudulent document-sharing link to steal credentials, potentially exposing customer communications, purchase orders, engineering documents, and export-controlled technical information.…