Tonight’s recovered rundown is security-heavy: a patched Copilot data-theft chain, more than 14,500 compromised Dahua cameras, and a Windows flaw now marked as used by ransomware campaigns. We also have a reusable-rocket milestone, higher advanced-chip prices, and a new “free” AI coding mode that still requires a paid Replit plan.
Editor’s note: This is the recovery edition for the reporting window that closed August 19, 2026 at 5:04 p.m. EDT (21:04 UTC). It was prepared for publication on August 20 after the original automated run stopped before media creation. Historical claims below are tied to that cutoff; live security guidance was rechecked on August 20 at 10:16 a.m. EDT.
Listen to the recap
This narration was synthesized locally from the same fact-checked script as the article.
The five-minute rundown
- Microsoft Copilot: CVE-2026-24301, nicknamed CoSnitch, chained prompt execution, connected-account access and Copilot’s own URL-fetching feature. Microsoft patched it August 18; the checked reporting said no known exploitation before the fix.
- CameraSwarm: Hunt.io reconstructed a campaign compromising more than 14,530 Dahua devices between June 17 and July 22, using credential attacks, old authentication-bypass flaws and a peer-to-peer relay route.
- Windows: CISA’s current Known Exploited Vulnerabilities feed marks CVE-2025-60710 as associated with known ransomware campaigns. It is a local privilege-escalation issue, not an internet worm.
- Space: LandSpace recovered Zhuque-3’s first stage on land after an August 19 launch—China’s first land recovery of a rocket stage, according to AP/Xinhua reporting.
- AI and chips: Samsung reportedly raised pricing on some new advanced-node foundry orders by as much as 15%, while Replit introduced a lower-cost “Free Mode” for paying Core and Pro subscribers.
1. Microsoft patched the one-click Copilot “CoSnitch” chain
Varonis Threat Labs’ research, as described by Cybersecurity News, identified a three-part chain in Microsoft Copilot Personal. An attacker-crafted URL could cause a prompt to run automatically; Copilot could then use permissions granted to connected services such as email, storage and calendars; finally, data could be carried out through Copilot’s own URL-fetching behavior. The issue is tracked as CVE-2026-24301 and was patched on August 18.
The practical lesson is bigger than one bug: an AI assistant connected to Gmail, Outlook, Drive or Calendar becomes a high-value permissions broker. A user may see one harmless-looking link while the agent sees multiple authenticated data sources.
The good
Microsoft issued a fix, and the checked reporting said Microsoft had not found evidence of exploitation before the patch.
The caution
Password resets alone may not undo every AI-agent abuse path. Review connected apps, OAuth grants and Copilot memory or personalization settings as part of incident response.
What to do: Confirm Microsoft 365 and Copilot updates are current, remove unused third-party connectors, apply least privilege, and investigate unusual outbound URL fetches alongside ordinary sign-in logs.
2. Operation CameraSwarm exposed the cost of old camera firmware
October 26 update: CERT-UA confirms unauthorized-access cases
Update verified at 2:55 p.m. EDT (18:55 UTC) on October 26, 2026: Ukraine’s CERT-UA says it identified cases in which Dahua cameras and video recorders were accessed without authorization, exposing video feeds, changing device settings and creating unauthorized accounts.[8][9]
The agency did not disclose how many devices were involved, when the intrusions occurred or who was responsible. Hunt.io told Recorded Future News that the techniques resemble the earlier CameraSwarm campaign, but there is no evidence tying the two sets of activity to the same operator.[9]
Why P2P matters: CERT-UA says Easy4IP can connect a device to Dahua’s cloud by serial number even when a firewall blocks direct internet access. Predictable serial-number patterns can help attackers locate cloud-connected devices; weak or default passwords and outdated firmware then create additional access paths.[9]
CISA’s live Known Exploited Vulnerabilities catalog still lists CVE-2021-33044 and CVE-2021-33045 and directs organizations to apply vendor mitigations or discontinue affected products when mitigations are unavailable.[10] Dahua’s advisory presents separate “Affected Model,” “Affected Version” and “Fix Software” columns and tells users to install the corresponding fix software or a newer release.[11]
Risk-based practical guidance: identify the exact model and build, then use Dahua’s table to install the corresponding fix software or a newer release.[11] Disabling P2P when remote access is not needed is a risk-reduction inference from CERT-UA’s reported Easy4IP path, not a vendor guarantee.[9] Unknown accounts or configuration changes are reasons to seek incident-response help before resetting: Hunt.io reported that CameraSwarm’s persistent accounts could survive password changes and, on most firmware, factory resets.[2]
Hunt.io says one operator compromised more than 14,530 Dahua IP cameras between June 17 and July 22. The research was reconstructed from a 407 MB exposed working directory containing tools, logs and campaign records. The Hacker News reported three paths: credential attacks, authentication-bypass flaws, and a peer-to-peer relay technique capable of reaching some devices behind NAT.[2][3]
The underlying bypasses—CVE-2021-33044 and CVE-2021-33045—are years old. That makes this less a story about a brand-new zero-day and more a story about forgotten appliances, reused credentials and convenience features left enabled.[2][11]
The good
The campaign’s tooling and workflow became visible, and researchers notified relevant CERTs and Dahua before publication.[2]
What to do: Inventory every camera and recorder, compare firmware against the vendor’s current downloads, disable P2P/Easy4IP when it is not required, use unique credentials, block direct internet administration and place cameras on a restricted VLAN.
3. CISA now marks a patched Windows flaw as used by ransomware
CISA’s live Known Exploited Vulnerabilities feed lists CVE-2025-60710 as a Microsoft Windows link-following vulnerability that allows privilege escalation, with knownRansomwareCampaignUse set to Known. Microsoft patched the issue in November 2025; CISA added it to KEV in April 2026.
This distinction matters: it is a local privilege-escalation path. An attacker generally needs an initial foothold before using it to gain higher privileges. Do not describe it as a self-spreading internet exploit—but do not dismiss it, either, because ransomware crews specialize in chaining a foothold with privilege escalation.
What to do: Check update compliance rather than assuming automatic updates succeeded. Prioritize exposed remote-access systems, administrator workstations and devices that missed late-2025 cumulative updates. For more context, see our August 18 recap and our guide to Windows 11 23H2 support planning.
4. China completed its first rocket-stage recovery on land
AP and Xinhua reporting carried by Phys.org says LandSpace launched its Zhuque-3 Y2 rocket on August 19 and recovered the first stage on land using deployable landing legs. It was China’s first successful land recovery of a rocket stage and its second recovery overall, following a sea-platform recovery in July.
The upside: Recovering hardware is a prerequisite for lowering launch costs and increasing cadence. The caution: one landing does not prove routine reuse. The next meaningful checkpoints are refurbishment time, inspection results, reflight and repeated recovery reliability.
5. AI demand is reshaping chip pricing
Wccftech, citing Reuters, reported that Samsung raised prices by as much as 15% on some new advanced-node foundry orders amid strong demand. The report described the largest increases for some Chinese customers and smaller—but still material—ranges for others.
“Up to 15%” is a ceiling, not an average. Foundry contracts vary by node, volume, packaging, customer and delivery priority. Consumers should not expect a neat 15% increase on every phone or PC; the more immediate pressure may appear in constrained enterprise accelerators, specialized hardware and project lead times.
Business takeaway: Budget with ranges, get written lead-time commitments, and avoid tying a deployment to one exact accelerator when the workload can be validated on alternatives.
6. Replit’s “Free Mode” is lower-cost AI inside a paid plan
Dataconomy reported that Replit made “Free Mode” the default for Core and Pro subscribers, powered by OpenAI’s GPT-5.6 Luna for chat, ideation and simpler tasks. The report lists Core at $20 per month and Pro at $100 per month, so “free” means the mode does not consume the main AI budget in the same way—not that Replit no longer charges for access.
The good: Routing ordinary work to a faster, less expensive model can make AI coding tools more predictable to operate. The caution: automatic model escalation can complicate cost forecasting, and generated code still requires tests, review, dependency checks and secret scanning.
What Florida homes and small businesses should do next
- Patch, then verify: Check Windows build and update state on every machine, especially laptops that sleep through maintenance windows.
- Audit connected AI: Remove unused OAuth grants and third-party connectors from Copilot and other assistants.
- Segment cameras: Keep cameras and recorders away from business PCs, accounting systems and file servers.
- Disable convenience exposure: Turn off camera P2P/relay access unless there is a documented need and a current firmware baseline.
- Review AI-generated code: Treat it as untrusted input until a human reviews it and automated tests pass.
- Plan hardware purchases: Ask vendors about availability, substitutions and written lead times before committing a project schedule.
Need help checking a Windows PC, camera network or small-business update plan?
The IT Guys serves Port Saint Lucie, Jensen Beach, Fort Pierce and Vero Beach. Schedule an appointment before a missed patch or exposed device becomes a cleanup job.
Frequently asked questions
Was the Copilot flaw actively exploited?
The checked August 19 reporting said Microsoft had found no evidence of exploitation before the August 18 patch. That is not proof that exploitation was impossible; it is the vendor’s observed status at the reporting cutoff.
Does a factory reset fix an affected Dahua camera?
Do not rely on a reset alone. Install corrected firmware, change credentials, review accounts, disable unnecessary P2P access and isolate the device from sensitive systems.
Can CVE-2025-60710 attack a Windows PC directly from the internet?
The CISA description classifies it as privilege escalation. It is most useful after an attacker already has local access or a foothold. Patch it because ransomware operators combine multiple stages.
Will Samsung’s reported price increase make every device 15% more expensive?
No. “Up to 15%” applies to reported foundry-order pricing, not every finished product. Device prices also reflect memory, packaging, displays, tariffs, inventory and vendor margins.
Is Replit Free Mode actually free?
Not as a standalone service in the checked report. It is a mode available to paying Core and Pro subscribers.
Sources
- Cybersecurity News — Critical Microsoft Copilot CoSnitch Vulnerability Lets Attackers Steal Sensitive Data With One Click (published August 19, 2026; checked August 20)
- Hunt.io — Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia (published August 18, 2026; checked August 20)
- The Hacker News — Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P (published August 19, 2026; checked August 20)
- CISA — Known Exploited Vulnerabilities catalog JSON feed (CVE-2025-60710 rechecked August 20)
- Phys.org / AP — China successfully recovers rocket stage on land for the first time (published August 19, 2026; checked August 20)
- Wccftech — Samsung raises advanced chipmaking prices by up to 15% (published August 19, 2026; cites Reuters; checked August 20)
- Dataconomy — Replit launches Free Mode with OpenAI’s GPT-5.6 Luna (published August 19, 2026; checked August 20)
- CERT-UA / Ukraine SSSCIP — Hackers can gain control of cameras and video recorders through cloud access (published October 23, 2026; checked October 26)
- Recorded Future News — Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras (published October 26, 2026; checked October 26)
- CISA — Known Exploited Vulnerabilities catalog JSON feed (CVE-2021-33044 and CVE-2021-33045 rechecked October 26)
- Dahua — Identity authentication bypass vulnerability found in some Dahua products (advisory last published November 15, 2021; fix table rechecked October 26, 2026)