In partnership with
Reply to everything. Edit nothing.
Your inbox is full. Slack is piling up. Client messages need a response yesterday. Typing thoughtful replies to all of it takes hours you don't have.
Wispr Flow turns your voice into clean, professional text you can send the moment you stop talking. Speak like you would to a colleague — tangents and all — and get polished output. Emails, Slack, LinkedIn, WhatsApp, whatever's open.
89% of messages sent with zero edits. Used by teams at OpenAI, Vercel, and Clay. Works on Mac, Windows, and iPhone.
Editor note (delete before send): Subject line in use — "ShieldBreak bypasses Defender, Lazarus's SYSTEM zero-day, Oklahoma State's 710GB leak." Alt option — "Defender's un-patched patch, a 5-day CISA deadline, and AI agents finding 100 bugs in 2 days." Preview text in use — "A zero-day undoes last week's fix, Lazarus has a SYSTEM shell with a 5-day CISA deadline, and a university just lost 710GB of student records."
Good morning. Microsoft's last Patch Tuesday didn't hold — a researcher just published a working bypass for one of its highest-priority fixes, and a nation-state crew is racing CISA's clock on a separate SYSTEM-level flaw. Layer in two fresh ransomware hits, a vishing-fueled breach nobody wants to call a "Salesforce hack," a fast-consolidating MSP market, and AI agents finding triple-digit vulnerabilities in 48 hours — here's what actually matters.
ShieldBreak Just Undid Microsoft's Fix for a Critical Defender Flaw
Researcher Nightmare Eclipse published "ShieldBreak," a working proof-of-concept that bypasses Microsoft's patch for CVE-2026-50656 ("RoguePlanet") and still grants SYSTEM-level privileges on fully patched Windows 11 and Server 2025 machines. The exploit registers a rogue cloud provider and abuses CLFS log manipulation plus object-manager symlinks to trick Defender's own scanning pipeline — vulnerability researcher Will Dormann confirmed it works, provided Defender is enabled. Microsoft is now tracking it as CVE-2026-69414 and says a real fix is in progress.
Why it matters: "patched" isn't a permanent state anymore. Treat this one as unresolved until Microsoft actually ships a fix, and don't assume last week's Patch Tuesday closed the book on RoguePlanet.
Source: BleepingComputer
Lazarus Is Exploiting a Windows Zero-Day — and CISA's Clock Is Running Out
CVE-2026-68820, a use-after-free flaw in the Windows Ancillary Function Driver (afd.sys), is being actively exploited by North Korea's Lazarus Group to deliver a never-before-seen backdoor against defense and aerospace targets as part of its "Operation Dream Job" campaign. It's the fourth afd.sys zero-day tied to Lazarus since 2022, and it lets a low-privileged local attacker jump straight to SYSTEM. CISA added it to the Known Exploited Vulnerabilities catalog with a hard patch deadline of August 25.
Why it matters: five days isn't much runway for federal and defense-adjacent clients, and any environment with unpatched Windows boxes on the network is exposed to the same escalation path Lazarus is already using.
Source: SecurityWeek
InterLock Ransomware Dumps 710GB of Student Records From a Public University
Southeastern Oklahoma State University confirmed the InterLock ransomware gang published roughly 710GB of data tied to more than 90,000 students, following a late-July intrusion that shut down its Durant, Oklahoma campus for several days. The haul reportedly includes Social Security numbers, grades, financial aid records, disciplinary files, and medical information, plus employee data covering injury claims and dependent details.
Why it matters: higher ed keeps proving out as a soft target with hard compliance exposure — FERPA and HIPAA obligations both apply here, and it's a solid talking point for any client sitting on comparably sensitive records without real segmentation or a tested incident-response plan.
Source: GÉANT Security
"Thegentlemen" Ransomware Crew Hits Critical-Infrastructure Contractor Babcock Africa
Babcock Africa, a 130-year-old engineering and asset-management firm serving mining, energy, and transport clients across the continent, was claimed by the Thegentlemen ransomware group on August 19. The gang's usual playbook is double extortion: exfiltrate first, encrypt second, negotiate under a leak-site deadline.
Why it matters: industrial and infrastructure-adjacent MSPs should treat this as a reminder that OT-adjacent engineering firms are squarely in scope for double-extortion crews, not just IT-heavy targets.
Source: ransomware.live
ShinyHunters' "Salesforce Hack" Turns Out to Be an Old-Fashioned Vishing Job
French IP-services firm Questel confirmed attackers used a voice-phishing call to gain access to part of its Microsoft 365 environment, after ShinyHunters listed the company claiming 21 million Salesforce records and 147GB of internal data for sale. Questel says the confirmed access point was a SharePoint environment, not Salesforce itself, and it's still running forensics on the leaked data before validating ShinyHunters' numbers.
Why it matters: the extortion crew's branding is outrunning the facts here — worth coaching clients that vishing-driven M365/help-desk social-engineering plays are the real entry point behind a lot of this year's headline "SaaS breach" claims.
Source: CyberInsider
Nexus IT Buys Its Way Into Texas With a 12th Acquisition
Nexus IT closed its acquisition of Austin-based Loyal IT, adding managed IT, cybersecurity, compliance, and cloud services to its national platform. It's Nexus's 12th deal as it chases a spot among the top 10 U.S. MSP/MSSPs, landing the same week Omdia data shows private equity involved in 69% of 2025's 169 disclosed MSP M&A transactions.
Why it matters: consolidation isn't slowing down. If you're an independent MSP watching PE-backed platforms roll up your market, Texas just got more competitive — "get bigger, add services, or get bought" keeps looking like the actual 2026 playbook.
Source: PR Newswire
Google's AI Agents Found 100+ Critical Vulnerabilities in Two Days
Mandiant publicly detailed its Agentic Vulnerability Discovery Harness (AVDH) — a pipeline of AI agents that has quietly hunted flaws inside Google for ten months, scanning tens of millions of lines of code and producing tens of thousands of findings. In one recent run, the harness surfaced more than 100 critical vulnerabilities in 48 hours, and Google is now sharing the architecture publicly so other security teams can build similar pipelines.
Why it matters: this is the flip side of every AI-in-attacks story above — agentic tooling is getting genuinely useful on defense too, and it's a preview of what "AI-assisted pentesting" looks like once it's past the marketing copy.
Source: Help Net Security
That's seven things worth interrupting your morning for. Patch what you can, verify the rest, and we'll see you back here tomorrow.
— The ChannelBytes Team
