Security — TechQuire Post

China-Linked APT Breached 361 Networks in Five Days via VMware vCenter; CISA Sets August 21 Patch Deadline Under BOD 26-04

A China-nexus APT compromised 361 organizations across 47 countries within five days of a VMware vCenter patch release, while CISA added four critical vulnerabilities to its KEV catalog on August 18 and set an August 21 patch deadline for Federal Civilian Executive Branch agencies. The combined campaigns collapse the historical patch grace period to days rather than weeks.

TechQuire Daily Staff / 3 weeks, 3 days ago / 7 min read

Microsoft Sounds Alarm as Perfect-10 Entra ID Vulnerability Is Exploited In the Wild

CVE-2026-69836, an unauthenticated deserialization flaw in Microsoft's cloud identity service, carries a CVSS 10.0 score. Microsoft says the bug is already mitigated and no customer action is required, but is not disclosing who exploited it or how widely.

TechQuire Daily Staff / 3 weeks, 3 days ago / 6 min read

Microsoft Ships August 2026 Patch Tuesday With 421 Fixes, Including a Windows Ancillary Function Driver Zero-Day Linked to Lazarus

Microsoft on August 12 released its August 2026 Patch Tuesday, fixing 421 vulnerabilities — 11 rated critical — including a Windows Ancillary Function Driver zero-day actively exploited by Lazarus-linked actors. CISA's August 18 CVE Brief added another zero-day to the actively exploited list, with 42 additional critical issues and 95 high-priority updates.

TechQuire Daily Staff / 3 weeks, 4 days ago / 6 min read

CISA and HHS Issue Joint Advisory on Medusa Ransomware After Healthcare Targets Spiked Through August

CISA, the FBI, and HHS on August 18 published a joint #StopRansomware advisory on Medusa, a ransomware-as-a-service operation that has accelerated attacks on healthcare and critical infrastructure operators. The advisory adds HHS as a co-sealer for the first time this year and lists technical indicators, known affiliates, and recommended mitigations.

TechQuire Daily Staff / 3 weeks, 5 days ago / 5 min read

Lazarus-Linked Actors Exploit Windows Ancillary Function Driver Zero-Day; Adobe Commerce and Magento Hit by Separate Skimming Chain

Microsoft's August 2026 Patch Tuesday addressed 421 vulnerabilities including CVE-2026-68820, a Windows Ancillary Function Driver for WinSock zero-day confirmed exploited by Lazarus-linked actors for SYSTEM-privilege escalation. Adobe separately shipped an urgent fix for CVE-2026-71362 in Adobe Commerce and Magento Open Source under active retail-skimming pressure.

TechQuire Daily Staff / 3 weeks, 6 days ago / 6 min read

ChainDrop Worm Poisons 444 npm Packages, Slipping Past Standard Defenses

A stealthy new variant of the Shai-Hulud worm dubbed ChainDrop has infected 444 npm packages downloaded about two billion times a month, spreading through tarballs and editor hooks rather than source commits, The Register reported August 15.

TechQuire Daily Staff / 4 weeks, 2 days ago / 7 min read

Cyber Attacks Pile Up in August: LexisNexis AWS Breach Exposes 364,000 Profiles, Wesco Confirms Incident

Threat actor FulcrumSec's February AWS breach of LexisNexis has now been confirmed to expose 364,000 profiles, while supply-chain giant Wesco confirmed a security incident on August 13 after the ExfilSquad group claimed theft of 2.6 million customer records.

TechQuire Daily Staff / 1 month ago / 6 min read

LiteLLM Supply Chain Attack Exposes 153GB of Corporate Credentials

A 153GB archive stolen during the LiteLLM supply chain attack exposes credentials linked to 2,488 corporate domains including AWS, Samsung, Cisco and Salesforce, according to new Hudson Rock research published August 13.

TechQuire Daily Staff / 1 month ago / 6 min read

CISA Orders Patching of Windows Zero-Day Exploited by North Korean Hackers

CVE-2026-68820 in Windows' AFD.sys driver — the only bug Microsoft confirmed under active attack in Tuesday's Patch Tuesday release — has a federal fix deadline of August 25, with Lazarus using it to deploy the FudModule v3.1 rootkit.

TechQuire Daily Staff / 1 month ago / 6 min read

Microsoft August Patch Tuesday Fixes 398 CVEs, Including Three Zero-Days and a Wormable DNS Flaw

Microsoft's August 11 update addressed 398 CVEs — three of them zero-days, one actively exploited — plus a wormable DNS flaw enabling remote code execution, across Windows, Exchange, SharePoint, GitHub Copilot and more.

TechQuire Daily Staff / 1 month ago / 5 min read

US and South Korea Warn of Gunra Ransomware as 51 Organizations Hit via Fortinet Flaws

A joint advisory details how the Conti-derived ransomware group breached hospitals, governments and banks by exploiting unpatched Fortinet products, demanding ransoms that mostly exceeded $10 million — and reveals its Linux encryptor can be broken without paying.

TechQuire Daily Staff / 1 month ago / 5 min read

Wesco Confirms Cloud CRM Incident After ExfilSquad Claims 2.6 Million Records Stolen

The distribution giant says it found no ransomware in the breach of its cloud CRM environment, after the extortion group published data allegedly covering customer and employee PII following an expired ransom deadline, per BleepingComputer.

TechQuire Daily Staff / 1 month ago / 5 min read

OpenAI Expands Daybreak Cyber Defense With New GPT-5.6-Cyber Model

OpenAI on August 10 expanded Daybreak, its cyber defense service, into Blue and Red tiers and unveiled GPT-5.6-Cyber, a purpose-trained model available only to trusted partners such as Accenture, IBM, CrowdStrike and Cloudflare, TechCrunch reported.

TechQuire Daily Staff / 1 month ago / 5 min read

China-Linked Storm-1175 Exploited N-able Flaw the Same Day It Was Disclosed

Microsoft says the ransomware group weaponized an authentication bypass in N-able's N-central within hours of disclosure, deploying new C++ ransomware StormEncryptor and dumping credentials with Mimikatz.

TechQuire Daily Staff / 1 month ago / 5 min read

Critical Metabase Zero-Day Exploited to Steal Customer Data at Framework and Tally

Metabase disclosed August 7 that an unauthenticated SQL injection flaw rated CVSS 10.0 was exploited in zero-day attacks on its cloud platform, with laptop maker Framework and form builder Tally confirming customer data theft.

TechQuire Daily Staff / 1 month ago / 6 min read

Levi Strauss Discloses Cyberattack After Hackers Social-Engineered Three Employees

Levi Strauss told the SEC that hackers used social engineering on three employees to steal corporate data from company-issued computers, though the jeans maker said consumer data was not impacted and business operations were not interrupted.

TechQuire Daily Staff / 1 month ago / 6 min read

Cyberattacks on US Water Systems Spread to at Least Seven States

Hackers have targeted water and wastewater utilities in at least seven states, locking operators out of monitoring systems in attacks the FBI and CISA have linked to Iranian actors, SecurityWeek and the Philadelphia Inquirer reported this week.

TechQuire Daily Staff / 1 month ago / 6 min read

ShinyHunters Dump 10.9 Million Emails From Abbott's Cancer Diagnostics Unit

The ShinyHunters extortion crew published data stolen in a vishing attack on Exact Sciences, the cancer diagnostics business Abbott acquired this year, exposing 10.9 million unique email addresses, The Register reported.

TechQuire Daily Staff / 1 month, 1 week ago / 6 min read

Wall Street Hedge Funds Hit by Coordinated AI 'Vishing' Attacks, FINRA Fusion Center Activated

Citadel, Two Sigma and Point72 were targeted in a wave of AI voice-cloning attacks that Bloomberg called 'vishing.' The industry's Fusion Center has been activated to coordinate a response.

TechQuire Daily Staff / 1 month, 1 week ago / 6 min read

Hackers Steal Over $130 Million by Exploiting Flaw in Coldcard Hardware Wallets

At least a dozen attackers have drained bitcoin from Coldcard 'cold' wallets by exploiting predictable seed-phrase generation, blockchain security firms say. The heist highlights that offline hardware is only as safe as the code that creates its keys.

TechQuire Daily Staff / 1 month, 1 week ago / 7 min read

WebKit Leaks Expose Real IPs in Proxy Browsers and Apple's iCloud Private Relay

Security researchers found three WebKit features that bypass configured proxies on iOS and macOS, affecting Tor browsers, the Psylo app, and Apple's iCloud Private Relay.

TechQuire Daily Staff / 1 month, 1 week ago / 6 min read