North Korean hackers have been exploiting a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector companies as part of the Operation Dream Job campaign.

Microsoft patches 398 flaws, including exploited CVE-2026-68820 that lets local attackers reach SYSTEM, plus four unauthenticated 9.8 RCEs.

Microsoft has released a patch for a Windows use-after-free zero-day vulnerability already being exploited to deploy malware used by the Lazarus hacking group.