421 bugs in Microsoft's Patch Tuesday release, and the Norks have already attacked one

This is an epic month for Microsoft patches, though not a record-setting one. Redmond addressed 421 bugs in its own products this month - about 200 fewer CVEs than last month, but likely the new norm with AI-assisted vulnerability disclosures and fixes. The big news is that North Korea's Lazarus Group (and possibly other miscreants) found and attacked one of these flaws as a zero-day in early June. The bug, tracked as CVE-2026-68820, is a use-after-free in the Windows Ancillary Function Driver for WinSock. A locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition," Redmond warned, adding that successful exploitation could allow an attacker to execute code with SYSTEM-level privileges, and with no user interaction required. Microsoft credited Check Point researchers Moshe Marelus and David Driker with finding and reporting CVE-2026-68820, and the security shop's threat intel lead told us that his analysts first observed attackers - namely North Korea's Lazarus Group - battering this CVE at the beginning of June. We are familiar with one successful implementation of the CVE - but we assume it was used widely in the campaign," Sergey Shykevich, director of threat intelligence at Check Point, told The Register. He's talking about Operation Dream Job, a long-running campaign targeting organizations worldwide, especially those in the defense sector, and attributed to Lazarus, an umbrella term for Pyongyang's government-sponsored goons who specialize in cryptocurrency theft, extortion attacks, and IT worker scams. It's probably best known for the Sony Pictures Entertainment hack in late 2014 and the WannaCry ransomware outbreak in 2017, although the group has been active since at least 2009. Lazarus' DreamJob campaigns have been around since 2020, and they use social engineering to lure job seekers with fake offers for high-profile positions, then trick the victims into clicking on malicious links or opening malware-laced documents. The goal in these attacks involves stealing IP and other sensitive data, conducting cyber spying missions, and collecting financial information. When Dream Job and Patch Tuesday collide This new wave of attacks focuses on the defense sector in Europe and India with dream jobs impersonating Lockheed Martin and privacy-tech firm Enveil. Attackers created at least three fake Enveil sites, and some even ranked as the top search result, making them even more believable to job seekers - and harder to spot a phish. In this campaign, the threat actor expanded its delivery method by leveraging impersonation websites and search engine optimization (SEO) techniques to distribute the trojanized applications, increasing its credibility and helping it evade some phishing-based detections," Check Point researchers said in a Tuesday blog. These attacks involve Lazarus distributing a modified PDF viewer called SecurityPDF designed to execute malicious payloads embedded within attacker-crafted PDF files when the user opens them. The PDFs, when opened, execute a never-before-seen backdoor that Check Point named Troy. And during the intrusions, the Norks exploited CVE-2026-68820 as a zero-day to deploy a new version of FudModule, Lazarus' kernel-mode rootkit. We will not be disclosing full technical details of the vulnerability in this article, as it was patched on the August 11 Patch Tuesday fix," the researchers wrote. At a high level, the exploit takes advantage of how afd.sys handles a socket is created when it is accessed concurrently by several threads at once." Shykevich told us that this campaign shows that this actor continues to develop new tools (like Troy), and finding and implementing new vulnerabilities in Windows to evade detection." Best of the rest Redmond lists one of the other 421 Microsoft CVEs as publicly known. It's CVE-2026-62832, an elevation-of-privilege flaw, and the Windows giant says exploitation is more likely," so patch this one sooner. An authenticated attacker who has credentials for another local account could run a specially crafted application to load another user's registry hive," according to the security advisory. Successful exploitation could allow the attacker to access or modify another user's data and gain administrator privileges. User interaction is not required." While CVE-2026-68820 and CVE-2026-62832 are the only vulnerabilities that Microsoft considers notable" in its August patch cycle, Trend Micro's Zero Day Initiative highlights five others, including one that came through ZDI's bug reporting program and another that was successfully exploited at ZDI's Pwn2Own contest in Berlin. All five of these should be considered notable and exploitable, so give those a read, too. CVE-2026-62893, a critical flaw in Windows Deployment Services TFTP Server that leads to remote code execution without user authentication or user interaction, is the one disclosed through ZDI. TFTP has no auth mechanism and is available remotely vid UDP port 69," ZDI bug boss Dustin Childs wrote. UDP port 69 should be blocked at your perimeter, but this could easily be used by attackers for lateral movement within an enterprise. Again, test and deploy this one quickly if you're using WDS for deployments in your enterprise." Meanwhile, CVE-2026-62911, one of the many Exchange bugs in this month's release, was demonstrated at ZDI's Pwn2Own in Berlin. It allows a privilege escalation via an authentication bypass, and exploitation would allow an attacker to take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments," according to Microsoft, which oddly deemed exploitation less likely." Childs calls BS on this. Ignore Microsoft's exploitability and Exploit Code Maturity ratings," he wrote. We handed them working exploits, so this is a real threat." (R)