--- title: 17th August – Threat Intelligence Report | daily.dev description: A weekly roundup covers major breaches including a ransomware attack on Colombia's Ministry of Justice, a 19-million-record data breach at Poland's MyDr... canonical: https://daily.dev/posts/17th-august-threat-intelligence-report-ezsszqe2y twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 17th August – Threat Intelligence Report | daily.dev og:description: A weekly roundup covers major breaches including a ransomware attack on Colombia's Ministry of Justice, a 19-million-record data breach at Poland's MyDr... og:url: https://daily.dev/posts/17th-august-threat-intelligence-report-ezsszqe2y og:image: https://api.daily.dev/og/posts/EzsSzQe2y.png og:image:alt: 17th August – Threat Intelligence Report og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 17th August – Threat Intelligence Report **[Check Point Research](https://daily.dev/sources/cpresearch)** · 4 min read · 0 upvotes · 0 comments ## Summary A weekly roundup covers major breaches including a ransomware attack on Colombia's Ministry of Justice, a 19-million-record data breach at Poland's MyDr healthcare platform, and a social-engineering attack on Levi Strauss. AI-related threats include China-linked autonomous agent attacks on Taiwanese infrastructure, North Korea's Kimsuky building offline AI tooling for phishing and malware, and a flaw letting encrypted reasoning blocks be replayed across OpenAI, Anthropic, and Google APIs, exposing thousands of secrets. Patch coverage includes Microsoft's August Patch Tuesday fixing 421 vulnerabilities (including an actively exploited SYSTEM-privilege bug), a critical macOS Screen Sharing auth flaw, an Adobe Commerce/Magento authentication bug under active attack, and critical Zoom Workplace RCE vulnerabilities. Check Point also details Lazarus-linked Operation Dream Job and Q2 2026 ransomware trends showing a 33% year-over-year rise. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does CVE-2026-68820 affect and is it being actively exploited? CVE-2026-68820 is a Windows Ancillary Function Driver for WinSock vulnerability that allows local attackers to gain SYSTEM privileges, and it is being actively exploited. Microsoft patched it as part of its August Patch Tuesday update alongside 420 other vulnerabilities, including 42 rated critical. Lazarus-linked Operation Dream Job also used this zero-day to disable security visibility on compromised systems. _Security teams tracking exploited Windows vulnerabilities can follow patch coverage like this on daily.dev._ ### What Zoom Workplace versions fix the critical screen sharing RCE vulnerability CVE-2026-53413? Zoom fixed CVE-2026-53413 in versions 7.0.6 and 7.1.5 for fast-track users. The vulnerability affected annotation functionality during screen sharing and could enable remote code execution on other participants' devices without any interaction required from the targeted user, making it one of three critical flaws addressed in that update. _Teams rolling out Zoom patches can keep tabs on meeting-software vulnerabilities via daily.dev._ ### How can encrypted reasoning blocks from OpenAI, Anthropic, and Google APIs leak sensitive data? Encrypted reasoning blocks used by these providers' APIs can be replayed across sessions, letting attackers extract sensitive content from them. Analysis of more than 315,000 blocks recovered hundreds of sensitive artifacts from published agent logs, including API keys, passwords, authentication tokens, and private cryptographic keys, exposing a previously unrecognized data leakage path in AI agent workflows. _Developers building on LLM APIs can track findings like this AI security risk through daily.dev._ ## Similar posts on daily.dev - [3rd August – Threat Intelligence Report](https://daily.dev/posts/3rd-august-threat-intelligence-report-y3hw57hhz) · Check Point Research · 0 upvotes · 0 comments - [13th July – Threat Intelligence Report](https://daily.dev/posts/13th-july-threat-intelligence-report-zeslwjclw) · Check Point Research · 0 upvotes · 0 comments - [7th September – Threat Intelligence Report](https://daily.dev/posts/7th-september-threat-intelligence-report-fdycnrc54) · Check Point Research · 1 upvotes · 0 comments - [21st September – Threat Intelligence Report](https://daily.dev/posts/21st-september-threat-intelligence-report-o1dlvtvb0) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/17th-august-threat-intelligence-report-ezsszqe2y) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"17th August – Threat Intelligence Report","url":"https://daily.dev/posts/17th-august-threat-intelligence-report-ezsszqe2y","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/17th-august-threat-intelligence-report-ezsszqe2y"},"datePublished":"2026-08-17T13:41:53.109Z","dateModified":"2026-08-17T13:42:19.219Z","description":"A weekly roundup covers major breaches including a ransomware attack on Colombia's Ministry of Justice, a 19-million-record data breach at Poland's MyDr...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Check Point Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Check Point Research","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7e3b130555214df2bf737ee6c764fa42","url":"https://daily.dev/sources/cpresearch"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/17th-august-threat-intelligence-report-ezsszqe2y","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware,ai-security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Check Point Research","item":"https://daily.dev/sources/cpresearch"},{"@type":"ListItem","position":3,"name":"17th August – Threat Intelligence Report"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/17th-august-threat-intelligence-report-ezsszqe2y#faq","mainEntity":[{"@type":"Question","name":"What does CVE-2026-68820 affect and is it being actively exploited?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-68820 is a Windows Ancillary Function Driver for WinSock vulnerability that allows local attackers to gain SYSTEM privileges, and it is being actively exploited. Microsoft patched it as part of its August Patch Tuesday update alongside 420 other vulnerabilities, including 42 rated critical. Lazarus-linked Operation Dream Job also used this zero-day to disable security visibility on compromised systems. Security teams tracking exploited Windows vulnerabilities can follow patch coverage like this on daily.dev."}},{"@type":"Question","name":"What Zoom Workplace versions fix the critical screen sharing RCE vulnerability CVE-2026-53413?","acceptedAnswer":{"@type":"Answer","text":"Zoom fixed CVE-2026-53413 in versions 7.0.6 and 7.1.5 for fast-track users. The vulnerability affected annotation functionality during screen sharing and could enable remote code execution on other participants' devices without any interaction required from the targeted user, making it one of three critical flaws addressed in that update. Teams rolling out Zoom patches can keep tabs on meeting-software vulnerabilities via daily.dev."}},{"@type":"Question","name":"How can encrypted reasoning blocks from OpenAI, Anthropic, and Google APIs leak sensitive data?","acceptedAnswer":{"@type":"Answer","text":"Encrypted reasoning blocks used by these providers' APIs can be replayed across sessions, letting attackers extract sensitive content from them. Analysis of more than 315,000 blocks recovered hundreds of sensitive artifacts from published agent logs, including API keys, passwords, authentication tokens, and private cryptographic keys, exposing a previously unrecognized data leakage path in AI agent workflows. Developers building on LLM APIs can track findings like this AI security risk through daily.dev."}}]} ```