[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fB8lNBZaTXp0ooFR5-z98xBrmVfFn3zOb98DykFiBTRo":3},{"article":4,"iocs":49,"watch_terms":60,"solutions":61,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"8bc77bd6-acfd-4d36-ae77-a2056512da33","Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days","microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days-5a84ed","Today is Microsoft's August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]","Microsoft's August 2026 Patch Tuesday addresses a significant 400 vulnerabilities, including three zero-days. One of these zero-days, CVE-2026-68820, was actively exploited by North Korean threat actors Lazarus to deploy their kernel-mode rootkit, FudModule. The other two zero-days, CVE-2026-68820 and another in the Windows User Profile Service, were publicly disclosed.","Microsoft August 2026 Patch Tuesday fixes 400 flaws, including 3 zero-days.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fmicrosoft\u002Fmicrosoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F10\u002F08\u002Fpatch_tuesday_microsoft.jpg","2026-08-11T18:08:50+00:00","2026-08-11T20:00:10.105804+00:00",9,[17,20,23],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Lazarus Group","threat_actor",{"name":24,"type":25},"Windows","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,42,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[50,54,57],{"type":51,"value":52,"context":53},"cve","CVE-2026-68820","Actively exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability",{"type":51,"value":55,"context":56},"CVE-2026-62832","Publicly disclosed Windows User Profile Service Elevation of Privilege Vulnerability",{"type":48,"value":58,"context":59},"FudModule","Kernel-mode rootkit deployed by Lazarus Group",[18,24],{"controls":62,"vendors":146},[63,92,117],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,101,109],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":93,"product_name":98,"url":99,"description":100},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[147],{"slug":148,"name":18,"logo_path":149,"roles":150},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[151],"affected",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":169},"microsoft-patch-tuesday-400-flaws-including-actively-exploited-zero-day-used-by-lazarus-group","Microsoft Patch Tuesday: 400 Flaws Including Actively Exploited Zero-Day Used by Lazarus Group","Microsoft's August 2026 Patch Tuesday revealed a massive attack surface with 400 vulnerabilities, three of which were zero-days — one actively exploited by North Korea's Lazarus Group to deploy the FudModule kernel-mode rootkit before a patch was even available. This incident underscores the danger of zero-day exploitation windows, where threat actors leverage undisclosed flaws to gain deep system access (kernel-level) before defenders can respond. The use of a rootkit means attackers can persist invisibly, evade detection, and maintain long-term footholds within compromised environments. Organizations that delay patch deployment or lack compensating controls are especially vulnerable during this critical window between public disclosure and patch application.",[157,158,159,160,161,162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-3: Malicious Code Protection","NIST IR-4: Incident Handling","MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","MITRE ATT&CK G0032: Lazarus Group","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities","ITIL: Change and Release Management (Emergency Change Procedures)",{"MITRE ATT&CK T1014: Rootkit":170,"NIST SI-2: Flaw Remediation":171,"NIST IR-4: Incident Handling":172,"CIS Control 10: Malware Defenses":173,"MITRE ATT&CK G0032: Lazarus Group":174,"NIST SI-3: Malicious Code Protection":175,"CIS Control 7: Continuous Vulnerability Management":176,"CIS Control 2: Inventory and Control of Software Assets":177,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation":178,"NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management":179,"ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities":180,"ITIL: Change and Release Management (Emergency Change Procedures)":181},"Rootkits like FudModule hide in the kernel, requiring specialised detection.","Flaw remediation means applying the exploited zero-day fix immediately.","Incident handling should include checking for compromise where systems were exposed before patching.","Malware defences help detect FudModule rootkit activity.","Lazarus Group's activity informs prioritisation of the patch they exploited.","Malicious code protection helps detect kernel-mode rootkits like FudModule.","Vulnerability management ensures the Lazarus-exploited zero-day is patched as a priority among 400 flaws.","A software inventory helps prioritise patching across the large Windows estate affected by Patch Tuesday.","Privilege escalation exploits were used to deploy the rootkit, so patching such flaws is critical.","Patch management planning helps triage 400 flaws by prioritising those actively exploited.","Managing technical vulnerabilities requires prioritising exploited zero-days in large patch releases.","Emergency change procedures allow urgent patching of exploited flaws."]