Future TechnologyA Windows Bug Lazarus Was Already Exploiting Just Got Patched
Key takeaways
- CVE-2026-68820, a use-after-free bug in the Windows WinSock driver afd.sys, was already being exploited by Lazarus before the patch landed
- Attackers used the flaw to load FudModule, a kernel-mode rootkit built to blind security tools from inside the operating system
- Microsoft shipped fixes for 421 CVEs this month, 62 of them rated critical, alongside serious remote code execution bugs in Windows DNS, DHCP and Deployment Services
- If you manage Windows machines, patching this month is not optional. If you use a personal Windows PC, turn on automatic updates and let it install
Every second Tuesday, Microsoft ships a pile of fixes and most of them are routine. This month's batch is not. Buried in the 421 CVEs patched in the August 2026 rollout is CVE-2026-68820, a flaw in afd.sys, the kernel driver that handles the Windows Sockets API. It had already been used in the wild by North Korea's Lazarus group before Microsoft got a fix out the door.
The bug is a use-after-free, the kind of memory-handling error that lets an attacker who already has a foothold on a machine escalate to full kernel access. Lazarus used it to plant FudModule, a rootkit that runs at the deepest level of the operating system and is built specifically to disable or blind endpoint security tools from the inside. Once FudModule is running, antivirus and EDR software can be looking directly at the machine and still miss what is happening.
It is not the only critical bug this month
The WinSock flaw is the one being actively exploited, but it shares the spotlight with a run of serious remote code execution vulnerabilities. CVE-2026-62893 hits Windows Deployment Services' TFTP server with a 9.8 severity score, exploitable by an unauthenticated attacker sending crafted network packets. CVE-2026-62823 does similar damage to Windows DHCP Server. A cluster of DNS Server bugs rounds out the list, several of them critical enough that unpatched domain controllers are a real risk sitting on the network.
Why it matters
A patch already existing does not help you if it is not installed. Lazarus had a working exploit for this bug before the fix shipped, which means anyone running unpatched Windows systems is playing catch-up against attackers who got there first. For IT teams, this is a this-week job, not a this-month job. For everyone else, it is the reminder behind every one of these account security stories: the operating system update sitting in your notifications is not nagging you for nothing.
Sources and further reading below.