Skip to content
OriginalSign in
Image: Dark Reading

Dark ReadingJai Vijayan

Microsoft's Patch Tuesday Deluge Continues With August Updates

Part of the CVE-2026-68820 story · since 11 Aug

Quiet for 12 weekslast report 17 Aug17 articles10 outlets
11 Aug · Check Point first28 Sep14 OctNowThis article5th of 17
  • Tue 11 Aug, 17:51 UTC. Check Point, first report. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 18:58 UTC. SecurityWeek, its first report on the story. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 20:11 UTC. SANS ISC, its first report on the story. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:01 UTC. Krebs on Security, its first report on the story. Microsoft Plugs Nearly 400 Security Holes. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates. Cites a CVE in CISA KEV. This article, 5th of 17.
  • Tue 11 Aug, 22:36 UTC. CISA, its first report on the story. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Flags Windows Driver Use After Free Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:47 UTC. Rapid7, its first report on the story. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline, its first report on the story. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. Infosecurity, its first report on the story. Microsoft Fixes 400 Flaws on August Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.

In August 2026, Microsoft released fixes for 421 unique CVEs during its Patch Tuesday, including two zero-day vulnerabilities. The bulk of these vulnerabilities (236) affect Windows, with 98 impacting Office products. Among the critical issues, CVE-2026-68820, an elevation of privilege vulnerability, is actively exploited.

Experts emphasize prioritizing vulnerabilities due to the overwhelming number of patches, urging security teams to focus on the most critical threats, particularly those with high CVSS scores, like CVE-2026-62878 and CVE-2026-62815, which are remote code execution vulnerabilities. Microsoft's shift toward larger update volumes is attributed to AI tools enhancing vulnerability identification.

How the story developed

All 17 articles
Quiet for 12 weekslast report 17 Aug17 articles10 outlets

17 articles from 10 outlets since 11 Aug. Quiet since 17 Aug. This was the 5th report, 5 hours after the first.

Now11 Aug12131415161718First reportCheck Point · 11 Aug, 17:51
  • Tue 11 Aug, 17:51 UTC. Check Point, first report. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 18:58 UTC. SecurityWeek, its first report on the story. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 20:11 UTC. SANS ISC, its first report on the story. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:01 UTC. Krebs on Security, its first report on the story. Microsoft Plugs Nearly 400 Security Holes. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates. Cites a CVE in CISA KEV. This article, 5th of 17.
  • Tue 11 Aug, 22:36 UTC. CISA, its first report on the story. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Flags Windows Driver Use After Free Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:47 UTC. Rapid7, its first report on the story. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline, its first report on the story. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. Infosecurity, its first report on the story. Microsoft Fixes 400 Flaws on August Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 17 articles as a list
  1. Tue 11 AugDay 06
    1. Lazarus hits defence via fake job PDFs, CVE-2026-6882017:51 · Check Point · First report · Known exploited CVE
    2. Microsoft's Patch Tuesday Deluge Continues With August Updates22:32 · Dark Reading · Known exploited CVE · This article, 5th of 17
    3. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV22:36 · CISA · official · CISA alert · Known exploited CVE
    Show 3 more from 11 Aug
    1. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-6882018:58 · SecurityWeek · Known exploited CVE
    2. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th)20:11 · SANS ISC · Known exploited CVE
    3. Microsoft Plugs Nearly 400 Security Holes22:01 · Krebs on Security · Known exploited CVE
  2. Wed 12 AugDay 19
    1. CISA Flags Windows Driver Use After Free Flaw CVE-2026-6882000:17 · CISA · official · Known exploited CVE
    2. Microsoft Fixes 421 Flaws Including SharePoint Zero Day00:47 · Rapid7 · Known exploited CVE
    3. Microsoft Patch Tuesday Patches Critical WinSock Exploit03:40 · SecurityOnline · Known exploited CVE
    Show 6 more from 12 Aug
    1. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks03:41 · SecurityOnline · Known exploited CVE
    2. Microsoft patches wormable DNS flaw and critical WinSock zero day07:31 · Security Affairs · Known exploited CVE
    3. Lazarus uses fake job offers to exploit Windows CVE-2026-6882009:11 · SecurityWeek · Known exploited CVE
    4. Microsoft Fixes 400 Flaws on August Patch Tuesday09:11 · Infosecurity · Known exploited CVE
    5. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed13:32 · SecurityOnline · Known exploited CVE
    6. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day14:11 · Infosecurity · Known exploited CVE
  3. Thu 13 AugDay 21
    1. Lazarus Group exploits CVE‑2026‑68820 via fake job offers08:52 · Security Affairs · Known exploited CVE

  4. Quiet for 4 days

    Mon 17 AugDay 61
    1. Critical Metabase SQLi flaw lets attackers seize full admin control02:40 · SecurityOnline · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in