What has changed?

Check Point Patches Critical VPN Vulnerabilities

The alert provides no details on active exploitation, affected versions, or patch urgency , it is a generic patch announcement without context on threat activity or deployment timeline.

CVE-2026-84390 , Fortinet FortiMonitor OnSight Information Disclosure Vulnerability

Sensitive information hardcoded in source code allows unauthorized access to FortiMonitor instances; vague attack vector details suggest incomplete CVE documentation.

CVE-2026-70341: Use-after-free in Microsoft Edge (Chromium-based) Allows Remote Code Execution

No additional strategic information beyond patch announcement available; merely technical CVE classification without context of active exploits or campaigns.

CVE-2026-80469

The vulnerability requires user interaction to upload a malicious driver and is not documented in active attack scenarios to date.

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

APT29 leverages generative AI systems to automate malware regeneration after detection, undermining static detection mechanisms, and compromises supply-chain infrastructure (hospitality vendors) for network manipulation.

Anthropic caught Russia-linked spies using Claude in hacking operations

Russian state-linked actors are weaponizing commercial AI tools like Claude for targeted cyber-espionage against Western government and defense organizations, signaling strategic escalation of hybrid warfare with DACH implications.

Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion

Russian state-sponsored hacker groups directly targeted AI vendor infrastructure and leveraged Claude to automate malware evasion techniques, signaling a new attack model against cloud service providers and their customers.

CVE-2026-77490

Pure vulnerability report with no indication of active exploitation, PoC, or attacker TTPs.

ZDI-26-544: Microsoft Windows Deployment Services Use-After-Free Remote Code Execution Vulnerability

The flaw is only exploitable on systems with the WDS role enabled, so the effective attack surface depends heavily on role configuration, and no patch is yet confirmed.

ZDI-26-538: (Pwn2Own) Microsoft Exchange Improper Authorization Privilege Escalation Vulnerability

The flaw was demonstrated at Pwn2Own; it allows bypassing the existing authentication mechanism and thereby escalating privileges on Exchange servers, despite authentication being nominally required.

ZDI-26-534: (Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability

The vulnerability was demonstrated as a zero-day at Pwn2Own and allows unauthenticated bypass of Exchange authentication , an indication that patches may only become available with a delay.

ZDI-26-541: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability

This is a kernel LPE in win32kfull demonstrated at Pwn2Own, with no patch status communicated yet, which combined with an initial-access vector enables full system compromise.

ZDI-26-543: Microsoft Windows ICC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

The advisory highlights ICC color profiles as an attack vector for remote code execution on Windows; exploitation requires interaction with the color management library.

ZDI-26-536: (Pwn2Own) Microsoft Windows http.sys Integer Overflow Local Privilege Escalation Vulnerability

The flaw was demonstrated at Pwn2Own and allows an attacker who already has local code execution to escalate privileges on Windows systems; public exploit code is therefore fundamentally likely.

ZDI-26-537: (Pwn2Own) Microsoft Windows storport Integer Overflow Local Privilege Escalation Vulnerability

The vulnerability was demonstrated at Pwn2Own, indicating an available exploit; a local attacker with low privileges can gain system privileges.

ZDI-26-539: (Pwn2Own) Microsoft Windows ipt.sys Incorrect Permission Assignment Local Privilege Escalation Vulnerability

The Pwn2Own finding demonstrates exploitability of the local privilege escalation in ipt.sys; active exploitation is not known.

Microsoft SharePoint - Zero-Day and Critical Vulnerabilities Patched

The BSI has documented critical and zero-day vulnerabilities in Microsoft SharePoint without providing specific CVE identifiers or details on active exploitation , indicating a general security advisory without active-campaign context.

Microsoft Excel (2016), Office (2019, 2021 and 2024) and 365 Apps: Vulnerability Enables Code Execution

BSI warns of critical code execution vulnerability in multiple Microsoft Office versions triggered by Use-After-Free, requiring immediate patches.

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Attackers use invisible Unicode characters to split financial lure words and bypass modern email filters,representing an evolution of AI-era evasion techniques into large-scale traditional phishing campaigns.

Patch Day SAP: Crafted Network Request Paves Way for Crashes

Heise reports on SAP patch day with multiple critical vulnerabilities but does not name active attacks or exploit code; typical patch reminder reporting without evidence of wild exploitation.

PaperCut Flaws Exploited in AI-Powered Attacks

A Russian threat actor group is using AI-generated exploits to automate and scale attacks against hundreds of PaperCut instances worldwide, combined with active post-exploitation for remote code execution and credential harvesting.

[UPDATE] Adobe Acrobat and Acrobat Reader: Multiple Vulnerabilities

The BSI warns of multiple vulnerabilities in Adobe Acrobat/Reader enabling a broad range of attack scenarios, though specific CVE numbers or version details are not provided in this alert.

[UPDATE] Google Chrome: Multiple Vulnerabilities

BSI warning regarding multiple Chrome vulnerabilities without specific CVE identification or patch-status details; typically an aggregated update advisory.

Exploit Kit Bluemoon: Chinese Hackers Attack Windows Users

The Bluemoon exploit kit is actively used by Chinese hackers against Windows users and poses an immediate threat to manufacturing environments.

CVE-2026-3869: Incorrect Implementation of Authentication Algorithm in PLC

The vulnerability enables authentication bypass in PLC systems through incorrect implementation of authentication algorithms, which is particularly critical for legacy or lower application levels.

[UPDATE] GNU libc: Multiple Vulnerabilities

The BSI advisory describes multiple vulnerabilities in GNU libc without specific CVE numbers, which may indicate coordinated disclosure or an incompletely documented vulnerability series.

[UPDATE] systemd: Multiple Vulnerabilities

BSI advisory on systemd vulnerabilities without specification of individual CVE IDs; patch status and active exploitation remain unclear.

Google Chrome: Multiple Vulnerabilities Allow Unspecified Attack

BSI warns of multiple Chrome vulnerabilities without full technical details; patches should be applied promptly once available.

Intel Processor: Multiple Vulnerabilities

BSI warns of multiple Intel processor vulnerabilities with high risk for local privilege escalation and data loss; specific CVE details are missing from this generic advisory.

Adobe Creative Cloud (Lightroom Classic): Multiple Vulnerabilities Enable Code Execution

Adobe Lightroom Classic contains multiple critical vulnerabilities (path traversal, unsafe deserialization, integer overflow, buffer overflows, authorization flaws) that can be combined to enable remote code execution.

Microsoft Edge: Multiple Vulnerabilities

BSI warns of multiple, partly critical vulnerabilities in Microsoft Edge with potential for code execution and data leaks; exploitation requires user interaction in some cases but remains practical.

Ubiquiti UniFi: Multiple Vulnerabilities

The BSI report summarises several vulnerabilities in Ubiquiti UniFi but provides no CVE IDs or affected versions, so the vendor advisories are needed for specifics.

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Attackers exploit passkey-themed phishing lures to trick users into revealing Microsoft 365 authentication credentials,a tactic that exploits modern security expectations.

Microsoft Patchday August 2026

CVE-2026-80981

There is no evidence of active exploitation, threat actors, or strategic implications; the report describes only a single kernel vulnerability with an available patch.

CVE-2026-89575

Pure patch information with no indication of active exploitation or strategic relevance.

CVE-2026-89761

The vulnerability is a local out-of-bounds write in the AppArmor parser that can be triggered via /proc/self/attr/apparmor/current, but requires loaded AppArmor profiles and has not been actively exploited so far.

CVE-2026-89762

The report contains no information beyond the patch details regarding active exploitation, attackers, or affected sectors.

CVE-2026-89770

The report contains no insights beyond patch information, as it is a pure NVD entry with no indication of active exploitation.

Adobe Creative Cloud Applications: Multiple Vulnerabilities

Google Chrome: Multiple vulnerabilities enable unspecified attack