North Korea's Fake Recruiters Are Back With a Zero-Day

North Korea's Lazarus Group has been caught running a new wave of Operation Dream Job, a long-running campaign, according to Check Point Research, that tricks professionals in defence and aerospace into thinking they are being headhunted by companies like Lockheed Martin and Enveil. Targets in France, Germany, Brazil, and India received convincing LinkedIn messages from fake recruiters before being handed malicious files.

The attack runs two parallel infection paths. In the first, victims download what looks like a legitimate PDF viewer called SecurityPDF. When a specially marked document is opened through it, the app quietly loads a backdoor called Troy directly into memory, giving attackers remote access and 17 commands to control the machine. In the second path, victims download an encrypted archive that triggers a DLL side-loading chain (where a legitimate application is tricked into loading a malicious code library instead of a legitimate one). This installs a downloader called MISTPEN, which communicates back to attacker-controlled servers through Microsoft OneDrive before deploying a second backdoor called ForestTiger.

Both paths eventually exploit CVE-2026-68820 (CVSS 7.0, High), a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock. Think of it like a thief who already slipped inside your building using a borrowed keycard, then finds a filing cabinet exploit to print themselves a master key for every room. Once triggered, the attacker jumps from limited access to full SYSTEM-level control of the machine, the kind of control normally reserved for the operating system itself.

What you should do: Apply Microsoft's August 2026 Patch Tuesday updates now. A device restart is required — there is no workaround.

A research team has identified a flaw in how OpenAI, Anthropic, and Google handle hidden reasoning inside their AI APIs, according to the paper covered by The Hacker News. When these models reason through a problem, they generate encrypted reasoning blocks that are meant to stay private. The flaw: those blocks could be replayed into a different session and decoded by a weaker model from the same provider family.

Across roughly 6,700 public agent logs, researchers recovered over 315,000 reasoning blocks and found 704 real user artefacts including 62 API keys, 33 passwords, and 24 access tokens. The encryption itself was not cracked. The problem was that intact reasoning blocks remained functional and portable across sessions.

All three providers have since deployed mitigations and the main extraction method is no longer reproducible. If you are a developer: strip reasoning blocks from any shared logs or agent traces before publishing them, even if the visible conversation text looks clean.

What Adobe ColdFusion is: ColdFusion is Adobe's web application server platform, used by developers to build and host database-driven websites and internal business applications.

What it is: This is an OS command injection vulnerability (a flaw where an attacker can feed specially crafted input that the server executes as a system-level command, rather than treating it as ordinary data). It carries a CVSS score of 10.0 and can lead to arbitrary code execution on the host server.

Who's at risk: Any organisation running ColdFusion versions prior to 2025.0.12 or 2023.0.23 with internet-accessible deployments. Adobe rates this Priority 1, meaning active targeting is considered likely.

CVSS: 10.0 (Critical — patch today. Stop reading, go patch.)

Root cause: The application fails to sanitise user-supplied input before passing it to underlying operating system functions. An attacker can craft a request containing shell commands that the server interprets and executes with its own privileges, bypassing application-layer controls entirely.

Attack vector: An attacker sends a malicious request to an exposed ColdFusion endpoint, embedding OS commands inside a parameter the server processes unsafely. The server executes those commands directly, potentially allowing the attacker to install malware, create new administrative accounts, or move laterally (pivot from one compromised system to reach other machines on the same network) through internal infrastructure.

Detection strategies: Look for unusual child processes spawned from the ColdFusion application server process (e.g. cmd.exe or /bin/sh). Review web server access logs for malformed or unexpectedly long parameter strings in POST requests. Monitor for new user accounts or scheduled tasks created around the time of any suspicious ColdFusion traffic.

Recommended actions:

1. Update ColdFusion to version 2025.0.12 or 2023.0.23 immediately.
2. Restrict external access to ColdFusion admin and API endpoints at the firewall or reverse proxy level.
3. Enable application-level logging and alert on unexpected process spawning from the ColdFusion service account.

Signal has launched Automatic Key Verification, a new feature described by Bleeping Computer that protects against man-in-the-middle attacks (where someone intercepts your messages by quietly swapping out your contact's encryption key for their own). Previously, confirming a contact's key required meeting in person or using a separate channel. Now Signal uses Cloudflare and Trail of Bits as independent auditors to verify that the key associated with a phone number has not been tampered with.

To enable it: open Signal, go to Settings > Privacy > Advanced, and toggle on Automatic Key Verification. A green "Encryption verified" badge will appear when a chat is confirmed clean.

This matters because Russian state-sponsored hackers previously compromised Signal accounts by abusing the Linked Devices feature. This feature closes a gap they exploited.

The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-68820, the Windows WinSock privilege escalation flaw exploited by North Korea's Lazarus Group, to its Known Exploited Vulnerabilities catalogue, according to The Record. Federal agencies have until 25 August to apply the patch. For everyone else, the directive underlines what the evidence already shows: this is the only confirmed in-the-wild exploit from August's Patch Tuesday. A device restart is required and no workaround exists.