InfoSecBulletin Cybersecurity for mankind
Cisco warns customers that it has fixed a serious security hole in firewalls using Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaw tracked as CVE-2026-20349, is related to the processing of HTTP requests.
An attacker can make a device restart and make a denial-of-service (DoS) issue by sending a special HTTP request to the Remote Access SSL VPN service. Cisco has asked customers to use the hotfixes right away. CISA added CVE-2026-20349 to its list of known problems on Tuesday, telling federal agencies to fix it by August 14.
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Windows AFD.sys 0-Day Actively Exploited
North Korea’s Lazarus group has been found using a Windows flaw to install a new version of its FudModule rootkit, based on new findings from Check Point Research.
The flaw, dubbed CVE-2026-68820, is found in AFD.sys, which is the driver that controls network sockets in the Windows kernel. Microsoft fixed it on August 11 during its August Patch Tuesday update, just a few days after Check Point shared the issue.
Successful use of CVE-2026-68820 gives attackers SYSTEM-level access and starts FudModule, the Lazarus group’s known kernel-mode rootkit that first appeared in 2021 and was earlier connected to a different AFD.sys use-after-free issue, CVE-2024-38193.
Check Point found at least 17 different hacked relay nodes. They also saw the group using VPN services like ExpressVPN to hide where they came from.
Organizations using Windows 11 versions 26100 or 26200 should focus on the August Patch Tuesday update to fix CVE-2026-68820. Security teams in the defense sector should closely monitor outgoing traffic to Roundcube and CMS-hosted systems that might be acting as hidden relay points instead of real mail servers.
