The Weekly
Brief

On 11 August Microsoft shipped another enormous security update — around 400 flaws across Windows, Office and the services behind them, 42 of them rated critical. (Counts vary between 398 and 421 depending on whose tally you read, because vendors differ on whether to include third-party components.) It continues a run of unusually heavy months; July's release was larger still. Buried in the pile were three zero-days — flaws that were public, or being exploited, before a fix existed. Two had merely been disclosed. The third had already been put to work.

That one is CVE-2026-68820, a use-after-free bug in the Windows Ancillary Function Driver for WinSock (afd.sys) — an unglamorous kernel driver that sits underneath every network connection a Windows machine makes. Rated CVSS 7.0, it needs local access, so on its own it doesn't get an attacker in; what it does is let someone who is already running as an ordinary user promote themselves to SYSTEM. Check Point traced its use to Lazarus, the North Korean state-linked group, which used it during intrusions at defence firms to install a new build of FudModule — a rootkit that runs in the Windows kernel itself, where most security tooling can't easily see it. It is the fourth zero-day in this same driver in three years.

On 13 August the New Zealand Security Intelligence Service published its annual Security Threat Environment report — the one public document each year in which the country's spy agency says plainly what it is worried about. The 2026 edition names four: espionage, foreign interference, insider threats and violent extremism. What's changed is who it says is in the firing line.

It is no longer just government. The NZSIS assesses that foreign states and their proxies are targeting New Zealand companies, universities and research institutions, and that the objective is usually intellectual property, technology and other non-public information — anything that shortens the road to an industrial or military capability. Firms and researchers working on dual-use technology, such as AI and commercial drones, are singled out as particularly exposed, often approached through academic exchanges, conferences and flattering recruitment offers rather than anything that looks like spying. Alongside that, the agency reports a rise in insider cases — staff who cause harm deliberately, under outside influence, or simply by having access they shouldn't — and notes that the NCSC has seen espionage-motivated cyber activity climb steadily for three years. The report expects espionage against New Zealand to increase over the next twelve months.

From 18 August Microsoft begins changing the Copilot app across web, desktop and mobile. Most of it is cosmetic — a simplified name and icon, and clearer labelling so people can tell at a glance whether they are using their work account or their personal one, including a green shield badge on work sign-ins. The part worth an administrator's attention is the address: the web app moves from m365.cloud.microsoft to copilot.cloud.microsoft.

Users are redirected automatically — unless the new address is blocked on your network. Microsoft's advice to partners is explicit: confirm copilot.cloud.microsoft isn't caught by an existing proxy, firewall or web-filtering rule, and where appropriate allow *.cloud.microsoft as a whole. An early preview of the updated Windows and Mac desktop app also lands on 18 August, with broad deployment starting mid-September. Security, compliance and governance controls are unchanged.

On 4 August the NCSC published guidance for organisations that use third parties to collect and store information — written, it says, in the wake of several incidents where the breach happened at a supplier rather than at the organisation whose customers were affected. Its central point is unfashionably simple: managing a supplier is an ongoing process, not a decision you make once at signing.

The legal position underneath it is worth stating plainly, because a lot of businesses have it backwards. Under the Privacy Act 2020 your organisation is required to have reasonable security safeguards over the personal information you hold — and handing that information to a supplier does not hand over the obligation with it. The NCSC's guidance sets out questions to ask when choosing a provider and, more usefully, how to keep asking them afterwards. It also makes a point that cuts against a common assumption: attackers rarely need anything sophisticated to get into a poorly protected system, and how attractive your data is has very little to do with how big your company is.