Which Patch Stops Lazarus?

# Which Patch Stops Lazarus? Microsoft just dumped a mountain of updates on us, and CISA is adding to the pile. For the sysadmin staring at a dashboard full of red alerts, the instinct is to panic-patch everything. That's a great way to break your production environment and spend your weekend in a cold server room. You can't patch every hole. You have to rank them by how likely they are to actually hurt you today. My hierarchy is simple: if it's being exploited in the wild, it goes first. If it's sitting on your perimeter facing the raw internet, it goes second. Everything else can wait until you've had a coffee and checked your backups. Right now, CVE-2026-68820 is the only thing that matters for most of you. It's a Use-After-Free vulnerability in the Windows Ancillary Function Driver for WinSock. Lazarus is already using it to snag SYSTEM access and drop backdoors. If you're running Windows, this isn't a "suggestion"; it's a requirement. CISA gave the federal government until August 25th to fix it, but criminals don't follow federal deadlines. Since I promised to make the technical bits stick: what is a Use-After-Free (UAF)? Imagine a librarian who gives you a ticket for a specific book on a shelf. While you're walking toward that shelf, the librarian shreds the book and puts a small, ticking bomb in its place. You arrive, present your ticket, and the system, trusting the ticket is still valid, lets you interact with whatever is now occupying that memory address. In this case, the "bomb" is attacker-controlled code. A UAF isn't some mystical cryptographic failure; it's a basic memory management error. It's the digital equivalent of forgetting to hang up the phone before leaving the room. When Lazarus triggers this, they aren't breaking an encryption algorithm; they're just exploiting the fact that Windows forgot to clean up after itself. Then we have the perimeter. If you're running Cisco ASA or FTD, CVE-2026-20349 is your next priority. CISA's deadline for this one is August 14th. It can trigger a remote DoS, and while "denial of service" sounds like a nuisance, it's often the smokescreen used to hide more surgical movements. These devices are frequently marketed as providing "military-grade" security. I hate that phrase. Usually, "military-grade" is shorthand for "we spent a lot on marketing and didn't spend enough on fuzzing our code." The second-order effect here is the real danger. If your ASA goes down or gets popped, it's not just about your internal traffic. It's about the VPN tunnels you've extended to third-party vendors and partners. A compromise at the edge turns your trusted partner tunnels into a highway for attackers to bypass your internal segmentation entirely. After those two, look at Metabase (CVE-2026-72898) and Progress LoadMaster (CVE-2026-8037). Both are serious. Metabase is dealing with an SQL injection that could have a massive blast radius depending on what data you're visualizing. People love to call SQL injection a "security flaw," but it's actually a failure of protocol trust. The application is trusting the user's input as if it were a command from the database administrator. It's a lack of discipline in how data is sanitized. Leonhard Euler would probably find the imprecision of this offending code offensive; there is no elegance in letting a string of text rewrite your query logic. If you're using Metabase, patch it before August 14th. If you use Progress LoadMaster, you're already late. The federal deadline was August 10th. Now, let's talk about what can wait. JetBrains TeamCity (CVE-2026-63077) is on the KEV list, but unless your CI/CD pipeline is directly exposed to the public internet (which, please tell me it isn't), you have a moment to breathe. Deserialization flaws are nasty, but they require an attacker to be able to send data to the service. If that service is tucked behind three layers of authentication and a bastion host, you aren't the primary target today. The same goes for the SAP Commerce Cloud flaws (CVE-2026-58231 and CVE-2026-44758). Unless your business depends on that specific cloud stack for your storefront, this is noise. The common thread here is a misunderstanding of risk. A CVSS score of 9.8 doesn't mean you should panic; it means the hole is big. But if the hole is in a room that's locked and bolted from the inside, it's less urgent than a tiny crack in your front door that Lazarus has already found a way to wedge open. The fix for most of this is just clicking "Update," but the real cost isn't the CPU cycles. It's the regression testing. The price of deploying these patches is the two hours you spend making sure your legacy accounting software doesn't stop talking to the database because a WinSock driver update changed how packets are handled. The uncomfortable question for next week: if we can't even get basic memory management right in a core Windows driver, why are we trusting "AI-driven" security agents to find these holes for us? Patch the WinSock flaw and the Cisco edge today. Everything else is just chores.