Cyber Threat Brief — August 25 2026
⚠️ This report is AI-generated. Always validate findings.
1. Gitea Org-Mode File Read → RCE — CVE-2026-59774
TL;DR: Unauthenticated arbitrary file read in Gitea (CVSS 9.8) via Org-mode #+INCLUDE directive chains to full RCE by extracting INTERNAL_TOKEN from app.ini. 10,000+ instances exposed; exploitation confirmed ITW.
What’s New:
- Disclosed August 2, patched in v1.27.1; active exploitation confirmed by Rescana and Criminal IP in late August
- Unauthenticated
POST /{owner}/{repo}/markupwith Org-mode#+INCLUDE: "/etc/gitea/app.ini"leaks secrets, database credentials, andINTERNAL_TOKEN - RCE chain: read
app.ini→ extractINTERNAL_TOKEN→ inject Git hook via internal API → trigger hook on anonymous clone - Affects Gitea v1.22.1 through v1.27.0; any public repo with code unit enabled is sufficient
- Not yet on CISA KEV; no CVE scanner signature widely deployed
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST /{owner}/{repo}/markup with #+INCLUDE: containing absolute paths | Initial Access | T1190 | Gitea access logs, WAF logs | Block/alert on Org-mode markup requests containing filesystem paths (/etc/, /opt/, /home/) |
Reads of app.ini, /etc/passwd, /etc/shadow | Credential Access | T1552.001 | Gitea audit log, auditd | Hunt for file access to app.ini from web service context |
Internal API calls using extracted INTERNAL_TOKEN | Execution | T1059 | Gitea internal API logs | Alert on internal API authentication from non-localhost IPs |
Git hook injection (post-receive, pre-receive) | Persistence | T1546 | File integrity monitoring | Monitor custom/hooks/ directories for unexpected scripts |
| Outbound connections from Gitea service account | C2 | T1071.001 | Firewall/proxy logs | Baseline Gitea server egress; alert on new destinations |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No Gitea-specific coverage; need custom rule on access logs for POST /markup with #+INCLUDE patterns |
| Elastic | None | No coverage for Org-mode file inclusion abuse |
| Sigma | web_application_attack.yml (generic) | Missing Gitea-specific path traversal via markup rendering detection |
Sources: The Hacker News · Rescana Active Exploitation Alert · Criminal IP Analysis · CyberSecurity News
2. Windows AFD.sys Privilege Escalation — CVE-2026-68820 (KEV Deadline TODAY)
TL;DR: CISA KEV federal remediation deadline is TODAY (August 25). Lazarus Group continues exploiting this use-after-free in afd.sys to deploy FudModule v3.1 rootkit against defense and aerospace targets via Operation Dream Job.
What’s New:
- CISA KEV deadline August 25 — federal civilian agencies must have applied the August 11 Patch Tuesday fix by end of day
- Lazarus exploited as zero-day for 5+ weeks pre-patch targeting defense/aerospace firms in France, Germany, Brazil, India
- Attack chain: fake job offer PDF →
SecurityPDFloader →Troybackdoor →ForestTigerC2 → CVE-2026-68820 EoP → FudModule v3.1 kernel rootkit - Use-after-free race condition in
afd.sys(CWE-416); local attacker escalates from standard user to SYSTEM - CVSS 7.0; exploitation requires existing code execution on target
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
SecurityPDF.exe (trojanized PDF viewer) | Execution | T1204.002 | EDR, Sysmon Event 1 | Block/alert on unsigned PDF viewers spawning child processes |
ForestTiger backdoor | C2 | T1071.001 | EDR, DNS logs | Hunt for DGA-like domains and beaconing from endpoints with defense-sector users |
FudModule v3.1 kernel rootkit | Defense Evasion | T1014 | Kernel driver load events (Sysmon 6), ETW | Alert on unsigned driver loads; hunt for DKOM-based process hiding |
Anomalous afd.sys IOCTL calls | Privilege Escalation | T1068 | ETW, EDR kernel telemetry | Monitor for high-volume IOCTLs from non-networking processes |
| Token elevation: standard user → SYSTEM | Privilege Escalation | T1134.001 | Windows Event 4672, 4688 | Alert on SYSTEM-level process creation from standard user sessions |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Windows Drivers Loaded by Non-Standard Processes (partial) | No specific AFD.sys IOCTL abuse detection; no Lazarus Operation Dream Job behavioral coverage |
| Elastic | Kernel Driver Load (generic) | Missing specific FudModule v3.1 rootkit indicators and DKOM detection |
| Sigma | driver_load_unsigned.yml (partial) | No CVE-2026-68820-specific race condition detection; gap on token manipulation from low-privilege sessions |
Sources: The Hacker News · SecurityWeek · SOC Prime · CISA KEV
Status Updates
- CVE-2026-50656 / ShieldBreak (Defender): Still UNPATCHED. ShieldBreak bypass released Aug 12. WDAC/AppLocker remain primary mitigation. Original brief.
- CVE-2026-33824 (Windows IKE): 9 public PoCs now on GitHub including kaleth4 and EpSiLoNPoInTOrI repos. KEV deadline passed Aug 21. Patch from April 2026. Original brief.
- CVE-2026-55040 (SharePoint JWT): Active exploitation ongoing since Aug 12 per Rapid7 PoC. ~8,500 on-prem instances exposed. Apply July + August CUs. Original brief.
- CVE-2026-59310 (VMware vCenter): China-nexus APT — 361 victims across 47 countries. Babuk-derived ESXi ransomware. Reverse_ssh persistence. Original brief.
- CVE-2026-65400 (macOS Screen Sharing): Monero cryptojacking ongoing on exposed Macs. XMRig deployed as
.config/sysmond. Patch in macOS 26.6.1/15.7.9/14.8.9. Original brief. - LegacyHive / CVE-2026-62832 (Windows User Profile Service): PATCHED by Microsoft in August Patch Tuesday (Aug 11). Previously tracked as unpatched 0-day since July 16. Apply KB immediately. Original brief.