Microsoft Plugs Nearly 400 Security Holes
August’s Patch Tuesday saw Microsoft fix 398 vulnerabilities across Windows and supported software, with 42 rated critical. The lone actively exploited zero-day, a privilege escalation flaw in the AFD.sys WinSock driver, gives attackers a path to SYSTEM control after gaining an initial low-privilege foothold. Microsoft has attributed the swelling patch volumes to vulnerability discoveries increasingly aided by artificial intelligence, and researchers note that while AI is proving adept at finding flaws, generating reliable fixes for them remains a largely human-driven task.
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
A supply chain compromise at WordPress plugin vendor BdThemes let attackers silently create rogue administrator accounts and install web shells across seven popular Elementor add-ons without altering a single line of code in the official repository. Threat actors instead poisoned a JSON feed pulled by an internal promotional banner system, exploiting a cross-site scripting flaw so the malicious script fires in every logged-in admin’s browser, creates a hidden administrator, and deploys a persistence backdoor. The affected plugins have been pulled from the WordPress directory pending review.
A cyberattack that began July 29 against logistics giant Ceva has disrupted at least eight European warehouses and exposed customer names, addresses, phone numbers and order details belonging to clients including Bol, De Bijenkorf, Ajax, ING and Valve’s Steam hardware division. Ceva says the operational impact is confined to those eight sites and that all other global operations continue normally, though its own website was intermittently unreachable following the incident. Dutch authorities have received breach reports from ten separate organizations tied to the intrusion.
Healthcare and Victim Support Charities Affected by Beacon Cyber Incident
Roughly 1,500 UK charities, including hospices and victim-support organizations, were notified that donor and supporter data held in the Beacon CRM platform was likely accessed and exfiltrated after a compromised access key gave an unauthorized party entry to the company’s systems. The stored data was encrypted, but Beacon warned it cannot rule out that the attacker managed to decrypt it, and has told customers to assume any information they stored, including attachments, was downloaded. No financial or payment data was involved, and affected organizations have been directed to report the incident to the UK’s Information Commissioner’s Office.
CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)
Researchers disclosed a critical authentication bypass in the JWT token validation pipeline of on-premises SharePoint Server, allowing an unauthenticated attacker who knows a target user’s identifier to impersonate that user, including administrators, and carry out actions on their behalf. The flaw was chained with a still-unpatched remote code execution bug to achieve full unauthenticated RCE during a Pwn2Own entry, though patching this authentication bypass alone breaks that exploit chain. A substantial portion of the research that uncovered the flaw was conducted through AI agentic tooling, which the researchers say markedly improved between their first and second research sprints.
