Three Days

Summary

A bug is a mistake in software, a spot where the code does something its makers never intended. The worst bugs let outsiders in, and those get scored 1 to 10 by the harm they allow. SAP fixed a bug scored 10 out of 10 on 11 Aug 26. By 14 Aug 26 attackers were trying that bug against real systems. Nobody had published example attack code anywhere. Somebody studied the fix itself and built the attack from what it showed. Researchers say machines are doing the studying now.

Findings

SAP is a German software company. The letters come from a German name that translates to Systems, Applications and Products in Data Processing. Its software runs the sales and inventory records for much of the world's big business. Every security bug gets a number in a public registry called the Common Vulnerabilities and Exposures (CVE) list. This one is CVE-2026-58231. It sits in the part of SAP Commerce Cloud that moves data between a company's online store and its other systems. An attacker needs no password, the system only has to be reachable from the internet. SAP shipped the fix on 11 Aug 26. SecurityWeek reports attack attempts started three days later, with no example code public anywhere.

A research team found bugs in Zoom's annotation feature, the drawing tool used during screen shares. One bad participant could take over every other computer in the meeting. No click needed, and nothing shows on the victim's screen. The team says the working attack came together with fewer than 20 prompts to public artificial intelligence (AI) models, in under one day. A prompt is one typed instruction to the AI. Zoom shipped fixes in Jun and Jul, and the bugs went public 11 Aug 26.

Patch Tuesday is Microsoft's monthly fix day, the second Tuesday of the month. On 12 Aug 26 it fixed 421 flaws by SecurityWeek's count. One was already being used. North Korean government hackers used it to hide a rootkit, a program built to stay invisible to the machine's owner. They reached those machines with fake job offers.

The Cybersecurity and Infrastructure Security Agency (CISA) is the federal agency that warns the country about computer threats. On 13 Aug 26 it published a batch of advisories for controls gear from Siemens and Schneider Electric. It flagged Rockwell Automation controllers too. A controller is the small computer that runs the pumps and valves in a plant. That gear gets patched during planned shutdowns, a few times a year at most.

The water-system attacks in the last three reports needed none of this speed. Those ran on controllers left on the internet with factory passwords, plus one flaw published in 2017. New bugs now get attacked within days, old bugs stay open for years. Same failure seen from both sides, nobody keeping up.

Impact

Patch schedules were set when turning a fix into an attack took skilled people weeks or months. Quarterly patching was a reasonable bet under that timing. As of this week the attack can start in three days, sometimes one. Nobody sent the trades a notice that the timing changed. Anything reachable from the internet now needs its fixes applied in days.

Recommendations

Sort your systems by one question first: can the internet reach it. That question matters more than any severity score. Patch exposed systems within days of a fix shipping. A system that can only be patched quarterly should lose its internet connection instead. CISA keeps a running list of the bugs attackers are actually using, called the Known Exploited Vulnerabilities catalog. Watching that list beats reading 421 bulletins.