Today’s digest is about attack surface hiding in the infrastructure you don’t usually think of as attack surface: the driver backing every network socket on Windows, the NAT translation layer routers and cloud gateways run silently, the antivirus engine scanning your files, and a dependency tree that skips the install hooks your tooling watches for. Here’s what changed since yesterday’s digest.
Actively exploited watch: Microsoft’s August Patch Tuesday closes a WinSock zero-day already being used for SYSTEM-level privilege escalation
Microsoft’s August 2026 Patch Tuesday landed August 11, addressing roughly 400 CVEs — SecurityWeek counted 421, other trackers put it closer to 398, with the gap coming down to how each source tallies chained or duplicate entries — including three zero-days, one of which is confirmed under active exploitation. CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver that backs the Windows Sockets API on every supported version of Windows. Successful exploitation lets a low-privilege local attacker elevate to SYSTEM, and researchers note this driver has a history of being a favored target in nation-state privilege-escalation chains. BleepingComputer · SecurityWeek
Patch CVE-2026-68820 first this cycle — it’s already being exploited for privilege escalation, and afd.sys sits under every process that touches a network socket, so exploitation gives an attacker a path from any low-privilege foothold to full SYSTEM control. If you can hunt for kernel-driver exploitation or unexpected SYSTEM-level process spawns, run it against hosts that haven’t patched yet.
Vulnerability watch: NatJack, a whole class of NAT implementation flaws, lets an attacker sharing your network hijack TCP sessions and spoof DNS
Security researcher Malcolm Stagg presented NatJack at Black Hat USA 2026 — not a single CVE but an attack class that manipulates NAT connection-state tables to hijack active TCP sessions, spoof DNS responses, expose externally mapped ports, or exhaust a NAT table entirely. Stagg tested 32 products and configurations spanning routers, firewalls, cloud NAT services, container platforms, and hypervisors, and found independently developed NAT implementations share the same underlying design weakness. Two implementation-specific flaws now carry CVEs: CVE-2026-56181 (CVSS 8.3) in Windows NAT as used by Hyper-V, and CVE-2026-63913 (CVSS 8.2) in Linux Netfilter conntrack. The prerequisite is privileged or co-tenant access to a system sharing the same NAT boundary as the target — exactly the shape of a multi-tenant cloud environment, a shared container host, or a corporate guest network. The Hacker News · SC Media
There’s no single patch for the attack class — the fix is architectural. If you operate shared NAT or cloud gateway infrastructure across tenants or trust boundaries, treat that boundary as a segmentation control rather than a routing convenience: don’t let untrusted workloads share a NAT table with anything sensitive, and apply the two implementation CVEs above wherever they touch your stack.
Supply chain watch: Nearly 800 npm packages deliver a cross-platform RAT — and skip the install hooks your tooling is watching for
Researchers tracking a threat actor dubbed “Flooding Dropper” identified close to 800 (1,033 in the latest confirmed count) malicious npm packages using randomly generated, slopsquatted names to deliver a downloader called WEL1DROPPER. Unlike the typical npm supply-chain attack, these packages don’t trigger on preinstall or postinstall lifecycle hooks — the behavior most software composition analysis tools watch for. Instead, each package ships a README instructing the developer to load it directly with require(), and the malicious code runs from there. WEL1DROPPER fingerprints the host OS and CPU architecture and pulls a matching payload from one of three Cloudflare Workers endpoints; if the HTTPS path is blocked, it falls back to a platform-specific domain and pulls the next stage from DNS TXT records. The payload combines RAT and infostealer capability across Windows, macOS, and Linux. The Hacker News · SC Media
If your dependency scanning only flags install-script behavior, this campaign walks straight past it — extend review to what a package’s own code does when it’s require()’d, not just what its lifecycle hooks run. DNS TXT-record lookups to unfamiliar domains from build agents or developer workstations are a reasonable signal to alert on; it’s the fallback channel this dropper leans on when the more common HTTPS path is blocked.
Vulnerability watch: Cisco discloses ClamAV parser flaws with public exploit code — your antivirus engine is attack surface too
Cisco published an advisory covering multiple high-severity ClamAV vulnerabilities affecting the scanning engine inside Cisco Secure Endpoint Connector on Windows, Linux, and macOS. The flaws — tracked across CVE-2026-20337 through CVE-2026-20339 and CVE-2026-20345 through CVE-2026-20348 — sit in ClamAV’s parsers for ZIP, GPT, PESpin, PDF, Mach-O, and XAR file formats; the ZIP parser issues alone include an out-of-bounds write from insufficient boundary checks and a double-free from improper memory management. An unauthenticated remote attacker who can get a crafted file scanned can crash the scanning process, denying antivirus coverage. Windows carries a High severity rating because the scanning process runs with more privilege there than it does on Linux or macOS. Cisco says it has no evidence of in-the-wild exploitation, but proof-of-concept code is already public. ClamAV 1.5.0 through 1.5.3 are affected; version 1.5.4, released August 7, fixes all of them. SecurityWeek · Cybersecurity News
Patch ClamAV to 1.5.4 across every Secure Endpoint Connector deployment, prioritizing Windows hosts given the higher severity rating there. With PoC code already public, the gap between disclosure and exploitation is the one you control by patching now — don’t wait for confirmed in-the-wild activity on a detection engine you’re relying on to catch everything else.
Also noted: OpenAI expands its cybersecurity-tuned model to more security vendors, and it’s already finding real zero-days
OpenAI expanded Daybreak Red, its restricted-access tier for cybersecurity work, with a new model called GPT-5.6-Cyber — built on GPT-5.6 Sol but tuned to reduce refusals on vulnerability research, exploit development, and penetration-testing tasks, completing 95% of Daybreak Red requests versus roughly 2% for the general-purpose model on the same tasks. Access stays limited to approved security vendors and consultancies. OpenAI says its researchers used the model to find two previously unknown vulnerabilities in V8, Chrome’s JavaScript engine, that chain together to escape the browser’s sandbox — one of which is now tracked as CVE-2026-15903 after being reported to Google. The Hacker News · OpenAI
Final thought
Three of today’s items land on the same point: attack surface doesn’t stop at the applications your team wrote. It includes the driver backing your network stack, the NAT layer routing your traffic, the antivirus engine scanning your files, and the open-source packages your build pulls in without a single suspicious install script running. Patching still closes most of it — the WinSock and ClamAV fixes are sitting there waiting — but the NAT and npm items need a process change, not just a version bump. If you want help figuring out which of your own trust boundaries or dependency review gates need that kind of second look, see our how-to guides or book a discovery call.