August in Review: Patch Everything, Twice, Then Watch Your Certificates
August closed out with a Microsoft 365 outage caused by an expired certificate, capping a month of patch cycles, ransomware advisories, and a nation-state indictment.
August was a busy month for reasons that ranged from routine to genuinely strange. Here’s the recap, plus the one thing that closed out the month in a way nobody could have scripted.
The Routine Stuff Still Matters
Early in the month, Cisco pushed a hardening release fixing seven vulnerabilities (one rated 9.8 severity) in IOS XE, the software running a large share of business switches and routers. A week later, Microsoft’s August Patch Tuesday fixed roughly 400 vulnerabilities, three of them already under active attack. Neither is unusual for a given month, but together they’re a reminder that “patch management” has to cover network gear, not just servers and laptops.
The Threats Got More Aggressive
Mid-month brought a cluster of concerning news on the same day, August 18: the FBI issued an advisory on Medusa ransomware (500+ victims across healthcare, manufacturing, and several other sectors, with exploits weaponized within 24 hours of disclosure), and the Justice Department indicted 17 Iranians in a cyber theft campaign that hit roughly 8,000 victims across universities, companies, and government agencies. A healthcare data breach affecting nearly 4 million patients (originally detected back in March) was also formally disclosed this month, via CareCloud’s regulatory filing, a good example of how long breach notification can lag behind actual detection. Siemens also issued advisories after PLC vulnerabilities were exploited against water and power utilities in at least 12 states, with attackers reportedly using AI-written exploitation scripts.
Microsoft 365 Had a Genuinely Rough Month
Two separate outages hit Microsoft 365 in August, one around August 24 and a bigger one on August 31 that rolled into September. The second one is the standout: it was caused by an internal security certificate that simply expired, unrenewed, taking down Exchange Online, Outlook, Teams, and SharePoint for hours across a wide range of organizations. It’s an oddly reassuring story in one way: even Microsoft, with all its engineering resources, can lose to a missed renewal date. It’s a less reassuring story in another: if it can happen to them, it can happen to any of us.
General IT Tip: Close Out the Month With a Quick Access Review
A good habit to pair with month-end: spend twenty minutes reviewing who currently has administrative access to your critical systems (email admin, network gear, financial software) and whether all of it is still needed. Access review doesn’t need to be a formal quarterly audit to be useful. Even an informal monthly glance catches the account that should have been disabled when someone left, or the vendor access that was only supposed to be temporary.
Looking Ahead to September
September opens with a Chrome zero-day already patched and a Patch Tuesday landing early in the month. If August’s pattern holds, expect the usual mix: a large routine patch batch, at least one actively-exploited flaw that jumps the queue, and probably one more story nobody could have predicted. The one dependable move through all of it stays the same: patch what’s exploited first, patch what’s exposed second, and don’t assume “it’s always worked before” is a substitute for actually checking.
Sources: