60
57
PaperCut Zero-Day Under Active Attack: Emergency Patch Released
PaperCut warns that a zero-day in NG and MF print management products is being actively exploited, shipping emergency patches with no CVE assigned yet.
PaperCut Software confirmed active exploitation of a zero-day affecting PaperCut NG and MF, with confirmed customer incidents, and released emergency patches on Friday ahead of technical details or a CVE assignment. The company urges customers to restrict web access to trusted IP addresses, disconnect application servers from the internet, and watch for indicators including tampered or truncated server.log files, database error strings, and suspicious activity involving pc-app.exe. The article recalls the May 2023 exploitation of CVE-2023-27350 and CVE-2023-27351 by the financially motivated Lace Tempest group, a Clop ransomware RaaS affiliate, though no attacker attribution has been given for the current campaign.
76
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.
Cisco Talos identified three threat clusters (UAT-12197, UAT-11823, UAT-11988) exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass, and CVE-2026-20316, a CVSS 5.3 static-credential flaw, in Cisco Secure Firewall Management Center. Qilin affiliates used static credentials for reconnaissance and deployed Qilin ransomware; a Sandworm-linked cluster deployed a Cyclops Blink backdoor via a malicious license.tmp file; a third cluster stole credentials through a JSP web shell. Cisco has released hotfixes and urges immediate installation, with broader patches expected next week.
82
60
60
60
57
Cisco SD-WAN Has a New Root-Level Problem, and There's No Fix Yet
60
Print management outfit PaperCut is under 0-day attack, and it’s drawing customers’ blood
PaperCut print management software is under active zero-day attack, with only an unofficial emergency patch or server shutdown available as mitigation.
Attackers are actively exploiting an unpatched zero-day vulnerability in PaperCut print management software. The only available fix is an unvalidated, unofficial emergency patch, or taking affected servers offline. PaperCut is widely deployed in enterprise environments, giving exposed instances a broad and consequential attack surface.
74
Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)
Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.
Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.
82
60
N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577
N-able shipped a second N-central hotfix as attackers actively exploit authentication bypass CVE-2026-18577, attributed to ransomware group Storm-1175.
N-able released Hotfix 2 (N-central 2026.3.1.10) to counter ongoing exploitation of CVE-2026-18577, an authentication bypass that evades the patch for the earlier CVE-2026-18556; exploitation was first detected on August 1, 2026. Post-exploitation includes using the Take Control feature to reach managed endpoints, registering a Cloudflare tunnel service for persistence, creating a 'veeam' domain account, resetting admin passwords, and disabling Microsoft and Sophos security tooling. Microsoft analysts link the activity to Storm-1175, which now deploys a new StormEncryptor ransomware strain instead of Medusa, often reaching data exfiltration and ransomware within days. Sophos and Huntress expanded the IOCs and warned that partners who patched late should treat environments as potentially compromised.
78
60
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
GitLab patched CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal enabling arbitrary file reads, already probed in the wild.
GitLab released patches for a maximum-severity path traversal flaw (CVE-2026-85706, CVSS 10.0) in the repository commits API, caused by improper path confinement and missing authentication enforcement, allowing unauthenticated arbitrary file reads. watchTowr observed active in-the-wild probes starting 06:00 UTC on September 11, 2026; exploitation requires at least one public project and enables theft of credentials, secrets, and configuration data. GitLab also patched CVE-2026-87719 (CVSS 9.9), an insecure deserialization bug in Enterprise Edition allowing authenticated Duo Chat users to access Advanced Search configurations and sensitive credentials via crafted GraphQL subscription arguments. Affected versions include 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and the flaw follows the recently exploited GraphQL code injection bug CVE-2026-19478.
80
CVE-2026-16232: Check Point SmartConsole Auth Bypass
Check Point SmartConsole authentication bypass CVE-2026-16232 grants unauthenticated attackers full admin access; actively exploited and added to CISA KEV.
CVE-2026-16232 is an improper authentication flaw (CWE-287) in the Check Point SmartConsole login process that lets an unauthenticated remote attacker obtain an application token and authenticate with full administrative privileges. Exploitation requires the Management Server to be internet-reachable and the Trusted Clients list not restricted to specific administrator addresses. Check Point confirmed active exploitation affecting a small number of customers, and the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. A hotfix is available via Check Point advisory sk185169.
75
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.
Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.
80
60
60
Three JFrog Artifactory Flaws Exploited for Backdoor Deployment
Wiz reports multiple actors chaining three JFrog Artifactory auth flaws to gain admin and deploy backdoors; CISA added all three CVEs to KEV.
Wz reports threat actors exploiting CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 in self-hosted JFrog Artifactory instances to bypass authentication and gain administrative privileges. Between August 15 and September 8, 2026, multiple actors chained CVE-2026-42018 and CVE-2026-42016 to mint anonymous-user tokens, escalate privileges, create persistent admin accounts, install malicious plugins for code execution, and drop second-stage payloads. From early September, CVE-2026-82329 was exploited for configuration exfiltration, cluster key theft, token minting, and SSH key attachment to attacker-created accounts. CISA added all three CVEs to its KEV catalog, giving federal agencies two weeks under BOD 26-04 to patch to versions 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21.
75
PaperCut warns of hackers using printer management software flaw in attacks
PaperCut warns of active exploitation of CVE-2026-82078 and CVE-2026-81578 in NG/MF print management software used by universities, corporations, and governments.
PaperCut issued an emergency advisory saying vulnerabilities in PaperCut NG and MF, tracked as CVE-2026-82078 and CVE-2026-81578 with severity scores above 8.8, are under active exploitation with confirmed customer incidents. Huntress reported at least two customers impacted, and an initial patch was revised with input from Huntress and watchTowr researchers. PaperCut software is widely deployed at universities, corporations, and governments managing printers from Canon, Epson, Xerox, and Brother, and the vendor urged removing server web interfaces from the public internet. Previous PaperCut flaws were used by ransomware gangs like Bl00dy and Clop, and CISA has warned the education sector is particularly exposed.
78
Australia Alerts Organizations to Ongoing CMS Exploitation Attacks
60
DirtyDecrypt: PoC Released for yet another Linux flaw
60
60
60
Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)
Acronis warns CVE-2026-87886, an authenticated Linux privilege escalation flaw in its cPanel, WHM, and Plesk backup plugins, is under limited targeted exploitation; patches released.
Acronis disclosed CVE-2026-87886, a privilege escalation vulnerability caused by insecure file permissions in its backup plugins for cPanel, WHM, and Plesk, platforms popular among hosting providers and MSPs. Exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM deployments, with no exploitation observed on Plesk so far, and the low-complexity attack requires no user interaction. Fixes shipped last week: backup plugin version 1.9.3 HF3 for cPanel & WHM and extension version 1.8.11 for Plesk.
72
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
PaperCut warns of actively exploited zero-day RCE chain CVE-2026-81578 and CVE-2026-82078 affecting all PaperCut NG and MF versions.
PaperCut alerted customers that attackers are actively exploiting a zero-day affecting all versions of PaperCut NG and MF print management software, with confirmed customer incidents and an ongoing investigation. Emergency patches were released for v25 and v26, and the flaw was later identified as an exploitation chain of CVE-2026-81578 and CVE-2026-82078 enabling remote code execution. Shared IoCs include suspicious post-exploitation activity from pc-app.exe and missing, truncated or deleted server.log files with specific database errors. Users with internet-exposed PaperCut Application Servers are urged to immediately restrict access to trusted IPs; in 2023, CVE-2023-27350 (CVSS 9.8) in the same products was exploited by Lace Tempest to deliver Cl0p and LockBit ransomware.
78
60
Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.
78
Hackers drain $320M in Bitcoin from Liquid Network, claim they're the good guys
Attackers withdrew about 4,000 BTC (~$320M) from Liquid Network's federation wallet via a SideSwap peg-out, claiming whitehat status.
Hackers drained roughly $320 million in Bitcoin — about 4,000 BTC, 95% of holdings — from the federation wallet backing Blockstream's Liquid Network sidechain. The withdrawal occurred through SideSwap using its Peg-out Authorization Key (PAK), yet no PAK appears to have been compromised, and the exact mechanism remains under investigation. The actors embedded an on-chain message identifying themselves as whitehats, asked Blockstream to patch federation nodes first, and promised to return most of the funds after fixes are confirmed. Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals; other Liquid assets and the Bitcoin network were unaffected.
78
CISA adds Ruckus bug and another six flaws to its Known Exploited Vulnerabilities catalog
60
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA added three actively exploited vulnerabilities — two JFrog Artifactory and one ConnectWise ScreenConnect — to its KEV Catalog.
CISA added CVE-2026-42016 (JFrog Artifactory incorrect authorization), CVE-2026-42018 (JFrog Artifactory improper authentication), and CVE-2026-84869 (ConnectWise ScreenConnect improper privilege management and missing authorization) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of such high-risk vulnerabilities on publicly exposed assets and to check for prior compromise. CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
78
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two actively exploited MikroTik RouterOS vulnerabilities, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog, mandating federal remediation.
CISA added CVE-2026-67277 (missing authentication for a critical function) and CVE-2026-86060 (improper neutralization of argument delimiters in a command), both in MikroTik RouterOS, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under BOD 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of these flaws on publicly exposed assets that grant total control post-exploitation. Agencies are also required to check whether systems were compromised before patches were applied.
72
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited vulnerabilities—Fortinet buffer overflow, Citrix NetScaler and Cisco auth bypasses, and a Chromium V8 write—to the KEV Catalog.
CISA added CVE-2025-25249 (Fortinet heap-based buffer overflow), CVE-2026-19490 (Citrix NetScaler authentication bypass), CVE-2026-87491 (Google Chromium V8 out-of-bounds write), and CVE-2026-20079 (Cisco Firewall Management Center authentication bypass) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of these high-risk vulnerabilities on exposed assets and verify whether systems were compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.
75
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited vulnerabilities to its KEV catalog, covering Adobe Commerce/Magento, Microsoft Windows, and N-able N-central.
CISA added CVE-2026-75650 (Adobe Commerce and Magento, improper neutralization in a template engine), CVE-2026-81963 (Microsoft Windows link following), CVE-2026-85880 (Microsoft Windows heap-based buffer overflow), and CVE-2026-86218 (N-able N-central static code injection) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on exposed assets that grant total control post-exploitation and check for pre-patch compromise. All organizations are encouraged to prioritize these flaws in risk-based patching.
72
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-85046, a Google Chromium V8 type confusion vulnerability with evidence of active exploitation, to its KEV Catalog.
On September 4, 2026, CISA added one vulnerability to the Known Exploited Vulnerabilities Catalog: CVE-2026-85046, a type confusion flaw in Google Chromium's V8 engine, added based on evidence of active exploitation. CISA notes type confusion is a frequent attack vector and poses significant risk to the federal enterprise. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize remediation of KEV vulnerabilities on exposed assets and check for pre-patch compromise; all organizations are urged to prioritize the patch.
80
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
CISA added seven vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities catalog on September 2, 2026. The additions cover Sangoma Switchvox SQL injection (CVE-2026-9586), Kludex Starlette request smuggling (CVE-2026-48710), Kestra OS command injection (CVE-2026-49869), BerriAI LiteLLM (CVE-2026-59822) and JFrog Artifactory (CVE-2026-82329) authentication flaws, and SonicWall SMA1000 SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) vulnerabilities. Under BOD 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets.
72
PaperCut NG/MF vulnerabilities exploited in zero-day attacks
PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.
PaperCut Software confirmed attackers are chaining two vulnerabilities in PaperCut NG and MF: CVE-2026-81578, an improper access control flaw in the web management interface allowing unauthenticated configuration changes, and CVE-2026-82078, unsafe dynamic class loading in database connection utilities enabling arbitrary Java bytecode execution. Huntress reproduced a pre-authentication remote configuration takeover and full RCE chain against PaperCut NG 25.0.11.75758 and observed limited exploitation at two customers, including post-exploitation whoami and ver commands. The vendor released Emergency Patch Release 2 with additional hardening and urged restricting Application Server web access to trusted IPs. In 2023, Clop and LockBit affiliates abused CVE-2023-27350 and CVE-2023-27351 in the same software.
75
Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild
Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.
Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.
82
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33824 (Windows IKE remote code execution, CVSS 9.8), CVE-2026-55040 (SharePoint JWT authentication bypass, CVSS 9.1), CVE-2026-59310 (VMware vCenter Syslog path traversal, CVSS 9.8), and CVE-2026-65400 (macOS Screen Sharing improper authentication). The SharePoint flaw combines four weaknesses including alg:none JWT forging to impersonate any user, with Defused researchers observing attackers using Rapid7's PoC against honeypots. The Dutch NCSC confirmed active exploitation of the macOS Screen Sharing flaw on August 15, 2026. Federal agencies must patch by August 21, 2026.
80