A developer launched ResolveHQ, an open helpdesk application built entirely on Cloudflare's Workers, D1, R2, and Queues infrastructure.
A Hacker News Show HN post presents ResolveHQ, a helpdesk application running serverlessly on Cloudflare Workers with D1 as the database, R2 for storage, and Queues for async work. The post earned 40 points and 14 comments. It has no direct cybersecurity or AI relevance for defenders.
India's STPI government website serves a spoofed Cloudflare verification page that preloads malicious commands into visitors' clipboards for execution in Windows Terminal, matching TerminalFix-style attacks.
A malicious external JavaScript on the ananta.stpi[.]in subdomain of India's Software Technology Parks of India displays a fake Cloudflare 'Verify you are human' prompt and silently writes a URL into the visitor's clipboard, instructing the user to paste and execute it in Windows Terminal. Researcher Vibhum Dubey reported the behavior to STPI and CERT-In; the script loads from the recently registered cdn[.]quickdelivr[.]com and assigns each visitor a unique session identifier. The malicious script remained embedded after the overlay briefly disappeared, and the destination URL was flagged as malicious by 17 VirusTotal engines. No attribution has been established, though the pattern matches Microsoft's TerminalFix, a variant of ClickFix.
Cloudflare CASB now offers automatic remediation policies that revoke risky SaaS file shares or trigger webhooks within five minutes of detection.
Cloudflare introduced automatic remediation policies for its CASB product, letting security teams define event-driven logic that revokes risky file shares, dispatches custom webhooks, or forwards findings to SOAR platforms without manual intervention. Native remediation actions currently support Microsoft and Google Workspace file and folder findings, with a target of completing remediation within five minutes of detection. The engine is built on the Cloudflare developer platform, using Cloudflare Queues, Workers and Workflows for durable execution with automatic retries and rate-limit backoff.
OpenAI released its Agents API in public beta, exposing the infrastructure behind Codex and ChatGPT for building long-running cloud agents.
OpenAI launched the Agents API as a public beta, letting developers build cloud-based agents that can run for hours, execute code, and process files on the same infrastructure that powers Codex and ChatGPT. Features include automatic context management, parallel tool use, and task delegation to sub-agents, with a choice of OpenAI-hosted sandboxes or partner environments from Cloudflare, Vercel, and Oracle. The API builds on the open-source Codex harness and supports MCP, custom functions, and built-in tools such as web search, with no extra fees beyond token-based billing.
A 2026 market overview ranks ten remote browser isolation tools, with Menlo Security as the pure-play reference as SSE vendors bundle isolation.
The article compares ten remote browser isolation (RBI) options, including Menlo Security, Zscaler, Cloudflare, Palo Alto Networks, Broadcom (Symantec), Forcepoint, Skyhigh Security, Ericom (Cradlepoint), Authentic8, and Garrison. It argues that RBI has become a bundled policy action inside SSE platforms from Zscaler, Cloudflare, Palo Alto, Broadcom, Forcepoint, and Skyhigh, compressing standalone pricing and driving consolidation such as Ericom's isolation moving under Cradlepoint (Ericsson). Enterprise browsers like Island and Chrome Enterprise Premium are reshaping the RBI-versus-browser decision for managed users, while selective policy-driven isolation of risky categories is described as the prevailing 2026 architecture. The piece is a buyer's guide with vendor positioning, not an incident or vulnerability report.
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
GreyNoise tracked a campaign in which an unknown, likely Russian-speaking criminal used hundreds of AI agents running on OpenAI's Codex harness and a DeepSeek model to exploit PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078, which PaperCut emergency-patched on August 28. At least 440 instances across 395 organizations in 48 countries were compromised, with 204 victims in the education sector and one US high school reaching domain admin in seven minutes. Some agents deviated from instructions to avoid 28 do-not-target countries including Russia, China, and Iran, and PaperCut has since issued maintenance releases replacing the emergency fixes.
Cloudflare's 1.1.1.1 resolver now validates post-quantum DNSSEC signatures using ML-DSA-44, a 2,420-byte NIST algorithm, preparing DNS for post-quantum migration by 2029.
Cloudflare enabled 1.1.1.1 to validate DNSSEC signatures using ML-DSA-44 (algorithm 18), a NIST-standardized post-quantum signature with 1,312-byte public keys and 2,420-byte signatures, roughly 38x larger than ECDSA P-256. The large signatures exceed common DNS-over-UDP limits, forcing fallback to TCP and creating downgrade risks while conventional algorithms must be published alongside. Cloudflare cites the risk of a quantum computer breaking RSA/ECDSA signatures by 2030 and plans full post-quantum security by 2029.
terms.txt specifies a robots.txt-style protocol for per-path, per-purpose AI crawler consent and compensation, with enforcement adding 0.20-0.65 ms per request.
The paper documents that automated clients now make up most web requests, that training dominates Cloudflare-classified crawling, and that the largest AI platforms fetch thousands of pages per returned visitor while robots.txt cannot express identity, purpose, terms, or price. It specifies terms.txt plus an origin-enforced exchange using Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation, and signed receipts. A dependency-free implementation adds 0.20 to 0.65 ms per request on one vCPU.
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
GreyNoise tracked a likely Russian-speaking actor that used AI agents (OpenAI Codex, a DeepSeek model) to exploit an authentication bypass (CVE-2026-81578) and unsafe-reflection RCE (CVE-2026-82078) in PaperCut NG/MF starting August 31, 2026. At least 440 servers across 395 organizations in 48 countries were compromised, with one US high school going from initial access to Domain Admin in seven minutes. Escalation relied on LSASS and registry credential harvesting, pass-the-hash, the noPac technique (CVE-2021-42278/CVE-2021-42287), new Domain Admin accounts, and DCSync to steal NTDS.DIT data. Operators staged registry hives, used Ligolo tunneling and certutil Base64 encoding for exfiltration, and one attempt was blocked by Cloudflare WAF.
OpenAI launched the Agents API in public beta, exposing the Codex agent harness, managed sandboxes, and multi-agent orchestration to developers.
OpenAI introduced the Agents API in public beta, giving developers the same agent harness and infrastructure that powers Codex through a single API call specifying task, model, tools, and environment. It supports OpenAI-managed sandboxes, customer infrastructure, or partner environments from providers including Cloudflare, Modal, E2B, Vercel, Oracle, DigitalOcean, Blaxel, Daytona and Runloop. Features include automatic context compaction for long sessions, tool search and programmatic tool calling to reduce token usage, and multi-agent support for parallel subagents. The harness is open-source Codex code; there are no extra API fees during beta, with developers paying only for tokens and tools used.
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
GreyNoise's Global Observation Grid observed a Russian-speaking threat actor operating from IP 45.142.193.132 deploy hundreds of autonomous AI agents, built on OpenAI's Codex harness with a DeepSeek model, to exploit PaperCut NG/MF flaws CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection RCE). At least 440 servers across 395 organizations in 48 countries were compromised; the US had 98 victims and educational institutions accounted for 204. The agents paired with Mimikatz, Certipy, Rubeus, and Impacket, escalated to domain admin in 12 of 440 cases, and executed DCSync to exfiltrate the full NTDS.DIT credential database.
Cloudflare rewrote the Workers (workerd) module registry for Node.js-compatible URL-based module resolution, shipped behind the new_module_registry flag with a 64 MiB bundle limit.
Cloudflare rebuilt the module registry in workerd, the open-source Workers runtime, so module specifiers are resolved as URLs and ESM, CommonJS, and WebAssembly modules follow Node.js semantics. The change is enabled with the new_module_registry compatibility flag and adds import.meta.resolve(), require(esm), import attributes validation, lazy compilation, and cross-isolate cache sharing. It also lifts the compressed bundle size limit to 64 MiB on all plans; the legacy registry implementation remains available.
AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.
GreyNoise tracked a likely Russian-speaking actor using AI (OpenAI Codex harness plus a DeepSeek model) to develop, test, and deploy exploits for PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) starting 31 August 2026. The actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, achieving domain admin at 12 victims — fastest time to domain admin was five minutes and a US high school was fully compromised in seven minutes. Attack paths involved LSASS memory and registry secret harvesting, pass-the-hash to domain controllers, noPac attacks, account additions to Domain Admins, and DCSync to exfiltrate full NTDS.DIT credential dumps. Impact scope suggests access development potentially for handoff, with prior PaperCut intrusions historically leading to extortion.
Cloudflare's Automatic Key Exchange probes origins to lead with preferred key exchange, cutting HelloRetryRequests from 52% to 3.7% and enabling automatic post-quantum origin connections.
Cloudflare announced Automatic Key Exchange, an extension of Automatic SSL/TLS that probes each origin's supported key agreement algorithms and leads with the preferred one, favoring the post-quantum hybrid X25519MLKEM768. Rollover across roughly 45 billion daily origin connections cut HelloRetryRequests from about 52% to 3.7%, saving more than 150 ms of p90 handshake latency. Hundreds of thousands of domains now receive post-quantum origin connections without manual configuration, supporting Cloudflare's goal of quantum-safe encryption by 2029 to counter harvest-now-decrypt-later attacks.
Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.
Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.
NovaCookies AitM phishing kit, a Sneaky 2FA variant, uses genuine Docusign lures to steal Microsoft 365 sessions at hundreds of organizations.
Island disclosed NovaCookies, a $320/month adversary-in-the-middle phishing-as-a-service platform that relays Microsoft 365 sign-ins through attacker infrastructure to capture credentials, MFA codes, and authenticated sessions. Campaigns abuse genuine Docusign envelopes and Microsoft/Google redirect hops so each step looks legitimate, with lure domains on .vu and alternating-case labels such as PwPt-sHaRe. Proofpoint assesses NovaCookies as a Sneaky 2FA variant with added flows for Okta and Entra domains federated to GoDaddy, and a fully managed PhaaS model. It has targeted hundreds of organizations in the U.S., U.K., Canada, Germany, Israel, and the U.A.E., and is advertised via Telegram with anti-analysis checks like a Cloudflare gate.
Cloudflare prototyped Zstandard compression inside its Pingora-based cache, estimating petabytes of storage could be saved on existing hardware.
Cloudflare engineers explored whether the same hardware could yield more cache space by adding compression to its cache infrastructure. They prototyped compression using Zstandard inside the Pingora-based stack and estimated potential savings of petabytes of cache storage.
Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.
Kaspersky attributes the campaign to Iran-linked Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm and Nimbus Manticore), which targeted developers and specialists in Egypt, Ethiopia and Afghanistan via fake recruiter contacts on LinkedIn and job platforms. Victims were lured into running malicious coding assessments that deployed two previously unknown families: NodeRabbit, a cross-platform RAT for Windows, Linux and macOS, and PollCat, which provides persistence and delivers additional payloads. The group masks activity behind legitimate Microsoft Azure and Cloudflare infrastructure, sometimes embedding victim organization names in Azure subdomains. The group has been active since at least 2022, focusing on aviation, aerospace and financial technology sectors in Africa and the Middle East.
Op-ed argues the 200-company Collective Cyber Defense letter's three endorsed metrics should become standard vendor procurement questions.
More than 200 companies including Microsoft, Google, AWS, CrowdStrike, Anthropic and Okta signed an August 27 open letter calling for faster cyber defenses against AI-enabled attacks. The letter endorses three measurable metrics: coverage, containment speed, and verified remediation. The author turns those into five concrete procurement questions buyers should pose at vendor renewals, while noting the letter contains no deadlines, dollar figures or measurable targets.
White House launches Watershed 250, a six-month Texas pilot using volunteer vendor cyber and AI tools to harden water utility defenses.
The Office of the National Cyber Director and Texas Cyber Command will oversee the six-month Project Watershed 250 pilot to improve water sector cybersecurity through industry-donated red teaming, system hardening and AI tooling. Twelve companies including Microsoft, Fortinet, Google Cloud, Palo Alto Networks, AWS, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos participated in the rollout. Officials cited recent attacks including an Iranian-backed campaign against 30 water systems in 12 states and a 2024 incident in Muleshoe, Texas. Some water-security professionals criticized the program as lacking dedicated funding.
Cloudflare launches Adaptive Intelligence, an engine that autonomously learns live-traffic meta-signals and deploys disposable rules to raise bot attack costs.
Cloudflare introduced Adaptive Intelligence, a bot-management engine that autonomously learns meta-signals from live traffic and deploys disposable detection rules. The company says static, deterministic rules historically let bot operators keep attacks cheap by using cheap proxies and rapid retooling. The new approach aims to make automated bot attacks economically unsustainable to sustain.
Microsoft details TerminalFix, a ClickFix variant using fake Cloudflare CAPTCHAs to make users run PowerShell payloads with reverse-tunnel implants.
Microsoft disclosed TerminalFix campaigns that direct users to run commands in Windows Terminal or PowerShell instead of the Run dialog, increasing the chance multi-line scripts execute. Compromised websites serve fake Cloudflare CAPTCHA verifications; the resulting PowerShell command downloads a ZIP with legitimate LockScreenContentServer.exe and rogue dui70.dll for DLL sideloading, retrieves payloads hidden in PNG images from attacker domains, persists via Registry Run keys and scheduled tasks, and performs domain trust and Active Directory reconnaissance. A Python-based reverse-tunnel implant (client.py) tunnels arbitrary TCP traffic over an encrypted WebSocket to gitnow[.]dev:443, giving attackers network-level proxy access that could enable privilege escalation, security-tool tampering, data theft or ransomware. Microsoft recommends AppLocker restrictions, PowerShell script block logging and ClickFix awareness training.
Cloudflare launched BotBase for Operators, a dashboard for bot and agent operators to manage directory submissions, track status, and declare content usage.
Cloudflare rolled out BotBase for Operators, giving bot operators a dashboard to manage their listings in Cloudflare's directory of bots and agents. The update adds submission status tracking, submission editing, and a behavior model for declaring how bots use site content. It is aimed at operators of crawlers and automated agents seeking placement in the directory.
US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.
The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.
Cloudflare cut per-entry memory 56% in 1.1.1.1's DNS cache via five Rust optimizations, freeing about 100 TB across its fleet.
Cloudflare engineers applied five Rust-level memory optimizations to the Big Pineapple DNS cache layout behind the 1.1.1.1 resolver. The changes cut per-entry memory usage by 56%, freeing approximately 100 terabytes of memory across the fleet.
Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.
Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.
Cloudflare migrated its blog to the EmDash CMS, stress-testing performance and routing production traffic to validate the platform at scale.
Cloudflare's engineering team describes migrating the Cloudflare Blog to EmDash to prove the stack at massive scale. The effort included stress-testing performance, safely routing production traffic, and redesigning the frontend experience. The post is an infrastructure engineering write-up rather than a security incident, vulnerability disclosure, or AI development.
Cloudflare launched Bot Preference Sync, which automatically syncs robots.txt files with AI bot policies covering search, agent, and training crawlers.
Cloudflare's new Bot Preference Sync feature automatically aligns a site's robots.txt with its configured AI bot policies for Search, Agent, and Training bot categories. The goal is to let site owners manage which automated and AI crawlers access their content without manually maintaining static robots.txt files.
Cloudflare OAuth adds optional scopes and task-based consent, letting users limit what apps can access per task.
Cloudflare announced that its OAuth support now includes optional scopes, moving away from all-or-nothing consent models. Users gain finer-grained control over what an application can access, and developers can build secure consent flows scoped to the specific task being authorized.
Researchers disclosed two DoS attacks exploiting CDNs' HTTP/3-to-HTTP/1.1 translation to amplify low-bandwidth requests up to 350x against origin servers.
Researchers named the two techniques HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA), exploiting the gap where CDNs speak HTTP/3 to browsers but only HTTP/1.1 to origins. All six tested CDNs (Alibaba, Baidu, Cloudflare, CloudFront, Fastly, Tencent) were susceptible to HBA, and five to HCA, with Cloudflare immune to HCA because it buffers full requests before opening backend connections. Attackers using under 5 Mbps forced over 100 Mbps at origins, and the 350x factor applies only to Alibaba, Baidu, and Tencent, which support the QPACK dynamic table. Testing identified 42,330 potentially vulnerable subdomains out of 151,685 hosted on the six providers across the Tranco Top 1M.
Researchers demonstrated a remote Spectre attack leaking a JWT between co-located Cloudflare Workers at 12 bits per second, 360x the 2021 rate.
Security researchers showed a remote Spectre attack against Cloudflare Workers that leaked a JWT from a co-located Worker at up to 12 bits per second with 99.16% accuracy, 360 times the 2021 demonstration rate. The attack exploited weaknesses in DyPrIs dynamic process isolation, where long-lived Durable Object invocations could run before isolation and WebSocket-heavy I/O suppressed the branch-misprediction signal. Cloudflare deployed improved DyPrIs, the V8 Sandbox, and MPK-based in-process isolation, and found no indicators of active exploitation over three years.
Cloudflare details its 2024-2025 reassessment of remote Spectre attacks on Workers, covering new attack primitives and hardened defenses.
Cloudflare reassessed the feasibility of remote Spectre attacks against its Workers serverless infrastructure across 2024 and 2025. The write-up describes new attack primitives including Spectre gadgets, remote timers, and techniques for achieving co-location with victim workloads. It also explains new defenses that further harden Cloudflare Workers against speculative-execution side channels.
Cloudflare measured RFC 9234 adoption, finding BGP Role deployment growing but two Tier 1 networks unexpectedly stripping the Only to Customer attribute.
Cloudflare analyzed adoption of RFC 9234, which introduces BGP Roles and the Only to Customer (OTC) attribute allowing routers to reject route leaks on their own. The measurement study assessed who has deployed the mechanism in the global routing table. It found two Tier 1 networks unexpectedly stripping OTC attributes, which could undermine leak protection.
CTM360's RecruitTrap report documents 3,000+ recruitment phishing URLs using BitB windows to steal credentials and relay MFA.
CTM360 identified over 3,000 phishing URLs impersonating recruiters from more than 50 organizations across 14 sectors in the RecruitTrap campaign. Attacks use Browser-in-the-Browser popups with spoofed address bars to harvest Google and Facebook credentials and relay MFA prompts in real time. About 96% of pages used a Calendly theme, with infrastructure concentrated on AWS EC2 and hidden behind Cloudflare.
Cloudflare Gateway now detects Model Context Protocol traffic via protocol-level heuristics to expose shadow MCP usage and enforce approved-server access.
Cloudflare Gateway identifies Model Context Protocol (MCP) requests using protocol-level heuristics. Security teams can use the signal to discover shadow MCP traffic on managed networks, enforce Portal-only access for approved MCP servers, and block direct connections. The updates extend standard gateway and zero-trust controls to AI agent traffic.
Cloudflare launched Access for Workers, letting admins attach one zero-trust policy to a Worker across all routes, domains, and previews automatically.
Cloudflare announced Access for Workers, a feature that binds an Access (zero-trust) policy directly to a Worker rather than to individual routes. The policy then applies automatically everywhere the Worker runs, including custom domains, workers.dev subdomains, routes, and preview URLs. Cloudflare positions it as one-click protection for internal, quickly built (vibe-coded) applications.
Cloudflare traffic data shows clear dips in Iceland, Spain, and Portugal along the path of the August 12, 2026 total solar eclipse.
Cloudflare's aggregated traffic data recorded a visible impact on Internet usage from Iceland through Spain and Portugal during the total solar eclipse of August 12, 2026. The post is a traffic-trend observation rather than a security or AI story.
Cloudflare's Certificate Transparency Monitoring is now generally available, and it no longer alerts on certificates Cloudflare issued for your own domains.
Cloudflare announced general availability of its Certificate Transparency Monitoring service. The key behavioral change is that alerts are no longer generated for certificates that Cloudflare itself issued for a customer's domains, so any alert received now indicates a certificate issued by another certificate authority. Defenders can use the service to detect mis-issued or unauthorized TLS certificates for their domains.
Cloudflare's H1 2026 report shows record DDoS scale, with more 1 Tbps+ attacks, multi-vector campaigns, and hacktivist surges against governments.
Cloudflare's H1 2026 DDoS Threat Report documents record-scale attacks, with a significant increase in campaigns exceeding 1 Tbps and April 2026 peaking at 6.46 trillion requests and 165 PB. Most network-layer attacks stayed small and short — 96.62% under 500 Mbps and 90.60% under 10 minutes — but multi-vector campaigns combining HTTP floods with DNS and CLDAP amplification grew. Operation Epic Fury drove 149 hacktivist DDoS claims against 110 organizations in 16 countries, hitting the government sector hardest, and Brazil overtook the US as the leading attack source country.
Signal adds automatic key verification, a key-transparency system audited by Cloudflare and Trail of Bits that detects key-directory tampering in E2EE chats.
Signal launched automatic key verification, a key-transparency system that confirms a phone number or username remains bound to a consistent encryption key across Signal's key directory. Cloudflare and Trail of Bits independently audit the system, with cryptographic protection preventing auditors from seeing users' identifiers in plaintext. The feature mitigates key substitution by a compromised directory or privileged insider, though it currently requires the contact's phone number and users can fall back to manual Safety Number verification.
Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile).
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
CVE-2026-81578 is an improper access control flaw (CWE-305) in the web management interface of PaperCut MF and PaperCut NG in which administrative requests from unauthenticated remote users trigger backend actions before access validation completes. An attacker can invoke administrative functions without logging in, allowing modification of certain system configurations. When chained with CVE-2026-82078 (unsafe dynamic class loading), the flaw has been used to achieve unauthenticated code execution. Any organization running PaperCut NG/MF, particularly servers whose web management interface is reachable from the internet or untrusted networks, is affected. The vulnerability was added to CISA KEV on 2026-08-31 and is being exploited in the wild as part of an AI-orchestrated campaign that compromised roughly 395–440 organizations.
Privilege Escalation in Microsoft Active Directory Domain Services
CVE-2021-42287 is an elevation-of-privilege vulnerability in Microsoft Active Directory Domain Services (AD DS) affecting multiple supported Windows Server releases. An attacker with any low-privileged domain account can trigger it — commonly in combination with the related sAMAccountName spoofing flaw CVE-2021-42278 — by manipulating account name attributes so the Kerberos Key Distribution Center issues tickets that grant rights normally reserved for domain controllers. The result is escalation from a standard user to domain administrator, giving the attacker full control over the Windows domain, a capability that is directly useful for ransomware deployment and data theft. Any organization running Active Directory on the affected Windows Server versions is exposed, which amounts to essentially every enterprise Windows network. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 with known ransomware use, and EPSS assigns it a 77.2% probability of exploitation within 30 days.
· microsoft windows server 2004 windows server 2004 · microsoft windows server 2008 windows server 2008 KEV ransomwaremass
Privilege Escalation via sAMAccountName Spoofing in Microsoft Active Directory
CVE-2021-42278 is an elevation of privilege flaw in Microsoft Active Directory Domain Services (AD DS) caused by improper handling of changes to a computer account's sAMAccountName, allowing an attacker to 'spoof' a domain controller's name. A low-privileged authenticated user who can create or rename computer accounts (possible by default for ordinary domain users under MachineAccountQuota) renames a machine account to match a domain controller, obtains a Kerberos ticket for that name, and — typically chained with the related flaw CVE-2021-42287 — impersonates the domain controller to gain domain administrator rights. Successful exploitation yields full control of the Active Directory domain, which attackers, including ransomware operators, use to move laterally and deploy ransomware. Any organization running Active Directory on the affected Windows Server releases is exposed, though only servers with the AD DS role (domain controllers) reachable by an attacker with valid domain credentials are directly exploitable. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 with known ransomware use, and EPSS assigns a 73.3% probability of exploitation within 30 days.
· microsoft Windows Server 2004 (AD DS) Affected AD DS builds per Microsoft advisory; source data lists no specific version ranges · microsoft Windows Server 2008 (AD DS) Affected AD DS builds per Microsoft advisory; source data lists no specific version ranges KEV ransomwaremass
Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering
GitLab has patched a critical (CVSS 9.1) code injection flaw (CWE-94) in how GitLab Community Edition (CE) and Enterprise Edition (EE) process GraphQL directives. Under certain conditions, an unauthenticated remote attacker can abuse a GraphQL directive to modify or delete public projects and user data on affected instances, requiring no privileges or user interaction; the impact is to integrity and availability, not confidentiality. Affected versions span all GitLab CE/EE releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4, which covers self-managed installations as well as the same codebase that powers the GitLab.com SaaS. News reports indicate the flaw came under active exploitation within days of disclosure, and EPSS assigns a 5.8% probability of exploitation within 30 days (93rd percentile). It is not yet listed in CISA's KEV catalog and no public proof-of-concept is known, but defenders should treat it as an actively exploited, unauthenticated, high-impact issue.
· GitLab CE all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 · GitLab EE all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4mass
Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H
Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.