Vulnerabilities & CVEs

A suspected Russian-speaking threat actor has been observed leveraging artificial intelligence to develop exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF, resulting in the compromise of 440+ exposed instances. Independent research from Blackpoint Cyber and GreyNoise attributes the campaign to the IP address 45.142.193[.]132. According to the reports, the attacker used hundreds of AI agents as part of the exploitation effort, which is notable for the scale and automation involved rather than any novel vulnerability class. Key facts from the reporting: Targeted product: PaperCut NG/MF Compromised instances: 440+ Attributed source IP: 45.142.193[.]132 Attributed actor: suspected Russian-speaking cyber actor Tooling: hundreds of AI agents used to devise exploits for the two flaws The two PaperCut vulnerabilities referenced were recently disclosed and are actively being exploited in the wild. Organizations running internet-exposed PaperCut NG/MF servers should treat this as an active threat and prioritize patching and exposure reduction. Recommended actions: Apply the latest PaperCut security updates as soon as possible Audit internet-facing PaperCut NG/MF instances and remove unnecessary exposure Monitor logs and network traffic for activity involving 45.142.193[.]132 Review authentication and application logs for signs of exploitation or post-compromise access Source: The Hacker News Has your organization already patched its PaperCut NG/MF instances, or are any still exposed while you work through remediation?

Cisco has disclosed that three separate threat clusters are exploiting two recently patched vulnerabilities in Secure Firewall Management Center (FMC). The activity spans both ransomware operations and state-sponsored intrusions, making this a broad and active campaign rather than an isolated incident. The primary issue is CVE-2026-20079, an authentication bypass in the FMC web interface rated CVSS 10.0. According to Cisco, the flaw could let an unauthenticated, remote attacker bypass authentication protections. Microsoft has attributed exploitation of the FMC flaws to a threat actor tracked as Storm-1175, which used a Qilin ransomware affiliate to move from initial access to credential theft and ransomware deployment. Microsoft's breakdown of the intrusion chain: Storm-1175 exploited the FMC vulnerabilities to gain initial access The actor then stole credentials from the compromised environment A Qilin ransomware affiliate was engaged to deploy ransomware and pressure victims The campaign highlights how quickly authentication bypass flaws in management infrastructure can be converted into full domain compromise. FMC sits at the center of firewall policy and device management, so access to it is a high-value foothold. Mitigation priorities for defenders: Patch FMC immediately if you have not already applied the vendor fixes Audit FMC management interfaces for exposure to untrusted networks Check for signs of credential theft and anomalous access tied to FMC administrators Review environments for Qilin ransomware indicators and lateral movement from management infrastructure Admins running FMC should treat this as urgent, particularly where the management plane is internet-adjacent or reachable from less-trusted segments. If you have not confirmed your patch status, do so before anything else. Source: The Hacker News Has your organization already patched FMC, and have you seen any signs of Storm-1175 or Qilin activity in your logs?

PaperCut has released a new security maintenance update that supersedes all previously issued emergency patches for two vulnerabilities that have been exploited in the wild. The affected product line is PaperCut NG/MF, and the following versions are now available for download: 26.0.5 25.0.13 24.1.10 According to the vendor, these are Regular Maintenance Releases (MR), meaning they roll up the earlier emergency fixes into the standard update channel rather than standing as one-off hotfixes. Administrators who applied the prior emergency patches should plan to move to these builds to stay on a supported release path. Source: The Hacker News Has your organization already migrated to these maintenance releases, or are you still running on the earlier emergency patches?

A China-linked threat actor tracked as UNC3569 exploited a vulnerability in Sogou Input Method — a widely used tool for typing Chinese characters on Windows — to plant a backdoor on targeted systems, according to research published by Gen Digital. The intrusion chain began with a crafted link and ultimately granted the attacker the same level of access as the logged-in user, meaning they could perform any action that user was permitted to carry out. The campaign resulted in the deployment of a backdoor identified as GRAYRABBIT. Key points from the research: The targeted software is Sogou Input Method on Windows, one of the most commonly used Chinese input tools. Initial access was achieved through a crafted link. Post-exploitation access was limited only by the privileges of the compromised user account. The final payload observed was the GRAYRABBIT backdoor. The activity is attributed to UNC3569, a group linked to China. Tencent, which owns Sogou, was referenced in the report. No specific CVE identifier was provided in the source material, so none is cited here. Organizations and users relying on Sogou Input Method should watch for vendor guidance and updates, and should treat unusual link-driven execution on Windows endpoints as a potential indicator of this activity. Source: The Hacker News Does your organization allow third-party input method software on Windows endpoints, and if so, how are you handling the risk?

Attackers chained two vulnerabilities in JFrog Artifactory, the repository that many software build pipelines pull from, to seize administrator control of self-hosted servers and plant backdoors, according to a report from cloud security company Wiz. Wiz observed the attacks between August 15 and September 8. JFrog had already fixed both flaws before that window, meaning only servers that had not been updated remained exposed to exploitation. Key points: Target: self-hosted JFrog Artifactory instances Outcome: administrator control of the server and backdoor installation Attack window observed by Wiz: August 15 to September 8 Both vulnerabilities were patched by JFrog prior to the observed attacks Risk is limited to instances that were left unpatched Mitigation: Update self-hosted JFrog Artifactory deployments to a version containing the fixes for both flaws Treat any instance that was unpatched during the attack window as potentially compromised and review it for signs of unauthorized administrative access or backdoors Source: The Hacker News Has your organization already patched its self-hosted Artifactory instances, or are you still working through the update?

CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with five security flaws affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The additions follow reports that these vulnerabilities are being actively exploited in the wild, prompting the agency to flag them for urgent remediation by federal agencies and security teams. The most severe of the group is CVE-2026-42016, an incorrect authorization flaw in JFrog Artifactory that carries a CVSS score of 8.1. This type of vulnerability typically allows an attacker to bypass intended access controls and perform actions they should not be permitted to, making it particularly dangerous in environments where Artifactory serves as a central repository for build artifacts and dependencies. Affected products: JFrog Artifactory, ConnectWise ScreenConnect, MikroTik RouterOS Notable identifier: CVE-2026-42016 (CVSS 8.1) — incorrect authorization in Artifactory Status: Actively exploited; added to CISA's KEV catalog Organizations running any of these products should treat the KEV listing as a signal to prioritize patching and review their exposure. Given that all three products are widely deployed in enterprise environments, attackers have strong incentives to weaponize these flaws quickly. Source: The Hacker News Does your organization run any of these products, and if so, have you already started patching?

Security teams have gotten very good at finding vulnerabilities. The harder problem now is determining which of those findings actually create a path to compromise, rather than simply ranking everything by scanner severity. A vulnerability that shows up as critical can look alarming on a report, but its real-world risk depends heavily on context. If the affected system sits behind strong segmentation, identity controls, and other defenses that block an attacker from reaching or exploiting it, the practical exposure is very different from what the raw severity score suggests. The takeaway is that prioritization should be driven by exploitability and reachability within your environment, not by severity ratings alone. Security teams are being encouraged to shift focus toward optimizing how they assess which vulnerabilities genuinely open a path for an attacker, instead of treating every critical-rated finding as an automatic top priority. Severity scores alone do not reflect actual business risk Defenses such as network segmentation and identity controls can significantly reduce exploitability Effective prioritization should account for whether an attacker can realistically reach and exploit the flaw Source: The Hacker News How does your organization weigh exploitability and reachability against raw severity scores when prioritizing vulnerability remediation?

The Dutch Nationaal Cyber Security Centrum (NCSC) is warning that exploitation of two critical vulnerabilities in Check Point VPN is imminent. The flaws are tracked as CVE-2026-85102 and CVE-2026-85103. According to the NCSC, attackers are expected to move quickly to weaponize these issues, making prompt patching essential for any organization exposing Check Point VPN gateways to the internet. Apply the latest vendor-supplied updates for Check Point VPN as soon as possible Prioritize internet-facing VPN gateways in your patching schedule Monitor for unusual authentication or connection activity against VPN endpoints Organizations relying on Check Point VPN for remote access should treat this as a high-priority action item rather than a routine update. Source: BleepingComputer Has your organization already patched its Check Point VPN gateways, or are you still assessing exposure?

Anthropic has issued a warning about the misuse of its Claude models by both cybercriminals and state-sponsored hackers, according to a report covering activity observed between December 2025 and August 2026. The company says these actors have leveraged Claude for a range of malicious purposes, including cyber attacks, weapons design, propaganda, and mass surveillance. Anthropic refers to these adversaries as Generative Threat Groups (GTGs), a category that includes state-sponsored groups, financially motivated criminals, and commercial entities. The disclosed activity spans multiple victims, with the models used to automate exploitation and data theft. Threat actors involved: state-sponsored groups, financially motivated criminals, and commercial actors Observed period: December 2025 to August 2026 Misuse categories cited: cyber attacks, weapons design, propaganda, and mass surveillance The report does not specify particular vulnerabilities or CVE identifiers tied to these campaigns, so defenders should focus on broader detection and response rather than signature-based indicators alone. Source: The Hacker News Has your organization adjusted its threat model to account for AI-assisted exploitation and data theft?

GitLab has shipped patches for multiple security issues, including a maximum-severity flaw that attackers began probing in the wild within hours of public disclosure. The most serious issue is CVE-2026-85706, which carries a CVSS score of 10.0. It is a path traversal vulnerability in the repository commits API that could let an unauthenticated user read arbitrary files from the GitLab server. Details on affected versions and official remediation guidance were not included in the source report, so administrators should consult GitLab's own advisory and apply the available patches as soon as possible. Given the maximum severity rating and evidence of active probing, treating this as an urgent patch is advisable. Source: The Hacker News Has anyone seen probe attempts against their GitLab instance yet, and how quickly are you planning to roll out the fix?

Threat actors are chaining together multiple JFrog Artifactory vulnerabilities to compromise self-hosted servers, bypass authentication, escalate to administrative privileges, and ultimately deploy a Rust backdoor on victim systems, according to new research. The attacks target self-hosted Artifactory instances that remain unpatched against known critical and high-severity flaws. By combining these issues, attackers can move from initial unauthenticated access all the way to full administrative control, which they then leverage to plant persistent malware. Key points from the report: The campaign exploits both critical and high-severity flaws in JFrog Artifactory Attackers bypass authentication as part of the chain They escalate privileges to gain administrative access A Rust backdoor is deployed on successfully compromised self-hosted servers Only self-hosted instances are affected — the flaws are not present in cloud-hosted deployments If your organization runs a self-hosted JFrog Artifactory instance, review your current patch level against the vendor's latest advisories and confirm that the instance is not reachable from the public internet unless absolutely necessary. Source: BleepingComputer Has anyone here audited their self-hosted Artifactory deployment since this campaign came to light, and what steps are you taking to lock it down?

GitLab is warning administrators to patch their servers immediately following the disclosure of a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. Path traversal flaws of this kind can allow an attacker to reach files and directories outside the intended scope, which is why GitLab is treating this one as urgent. Given the maximum severity rating, administrators should prioritize patching over routine maintenance windows. Details on affected versions, exploitation status, and any indicators of compromise were not included in the available reporting, so check GitLab's official security advisory for the authoritative version list and fixed releases before upgrading. Apply the available GitLab security update as soon as possible. Verify your deployed version against the official advisory rather than relying on secondary coverage. Monitor GitLab's channels for any follow-up guidance or revised severity information. Source: BleepingComputer Has your organization already applied this update, or are you still waiting on a maintenance window?

Check Point has patched two critical vulnerabilities in how its firewall and management products handle VPN certificates. Both flaws carry a CVSS score of 9.8, and according to the company, they could allow an unauthenticated remote attacker to execute code — though only "under specific conditions" that Check Point has not disclosed. The two issues are distinct in scope: One flaw affects Check Point Security Gateways, the company's firewall appliances. The second affects those same gateways as well as the Security Management side of the product line. The article does not provide specific CVE identifiers for either vulnerability, so no advisory numbers are cited here. Administrators should refer to Check Point's official guidance for exact patch details and affected builds. Because exploitation requires conditions Check Point has chosen not to describe, the practical risk is difficult to assess from the public disclosure alone. Even so, a 9.8 rating and unauthenticated RCE potential make prompt patching the sensible default for anyone running the affected gateway or management components. Mitigation steps: Apply the vendor's patches for Security Gateways and Security Management as soon as possible. Verify which of your deployments fall into the affected product sets before assuming you are in the clear. Monitor vendor advisories for updated technical detail, since the triggering conditions remain undisclosed. Source: The Hacker News Are your Check Point gateways or management servers already patched against these two flaws?

This week's security roundup keeps circling back to one uncomfortable question: how did any of this get through? An extension asks for more access than it needs and gets it. A trusted service quietly becomes a link in a phishing chain. An old bug still delivers results. An exposed system stays exposed. A package looks legitimate right up until it isn't. The common thread across these stories is that the way in rarely required anything sophisticated. 200 Android flaws headline the week's collection, alongside phishing campaigns assembled entirely inside the browser and a sprawling network of 119,000 scam shops. The roundup also bundles in 23 additional stories covering the broader threat landscape. A few patterns worth noting from the collection: Extensions and packages that appear useful until they turn malicious Trusted services being abused as part of phishing infrastructure Long-patched vulnerabilities that remain effective because systems were never updated Exposed systems that simply stay exposed The recurring lesson is that exposure often persists not because attackers are clever, but because basic hygiene gets skipped. Source: The Hacker News Which of these exposure patterns does your organization struggle with most, and how are you addressing it?

Cisco Talos has reported that two recently patched vulnerabilities in Secure Firewall Management Center (FMC) have been exploited in the wild by three distinct threat clusters. These clusters have been linked to both ransomware operations and state-sponsored cyber espionage activity, indicating the flaws are being actively weaponized by a range of adversaries. The exploitation activity targets Cisco's Secure Firewall Management Center, a centralized management platform for Cisco firewall deployments. Organizations running affected FMC versions should prioritize patching, as the vulnerabilities have moved beyond theoretical risk into active exploitation by multiple groups with different motivations. Details remain limited in the initial disclosure, but the involvement of three separate clusters suggests broad interest in the flaws across both criminal and nation-state actors. Administrators are advised to review Cisco's security advisories and apply the available fixes without delay. Apply the latest patches for Secure Firewall Management Center Review Cisco Talos guidance and advisories for affected versions Monitor for signs of exploitation in firewall management infrastructure Source: BleepingComputer Has your organization already patched its FMC deployments, or are you still assessing exposure?

A threat actor, described as likely Russian-speaking, leveraged hundreds of AI agents to build and run a global exploitation campaign against vulnerable PaperCut NG/MF servers, ultimately compromising 395 organizations. The operation stands out less for any single novel flaw and more for how automation was used to scale reconnaissance, vulnerability discovery, and exploitation across a large number of targets. Rather than manually probing each victim, the actor reportedly relied on fleets of AI agents to handle repetitive tasks and accelerate the attack lifecycle. Key points from the reporting: Target: internet-exposed PaperCut NG/MF print management servers Method: exploitation of known PaperCut vulnerabilities at scale Scale: 395 organizations impacted worldwide Attribution: likely Russian-speaking threat actor Notable element: use of hundreds of AI agents to develop and conduct the campaign For defenders, the familiar fundamentals still apply: inventory any PaperCut NG/MF instances reachable from the internet, confirm they are patched against known vulnerabilities, and restrict exposure where printing infrastructure does not need to be publicly accessible. Given the automated nature of this campaign, delays in patching and asset tracking are exactly the gaps such tooling is designed to find. Source: BleepingComputer Does your organization run PaperCut NG/MF, and if so, is it exposed to the internet or kept internal-only?

Multiple cyber-espionage groups have been observed deploying an exploit kit tracked as BlueMoon, which chained zero-day vulnerabilities in Microsoft Windows and Google Chrome. According to reporting, the kit was used in targeted campaigns, with the zero-days giving attackers a way into victim environments before patches were available. The activity has been attributed to more than one espionage-focused threat group, suggesting the tooling was shared or reused across operations. Key points: The exploit kit is named BlueMoon. It leveraged zero-day flaws in Windows and Chrome. Multiple cyber-espionage groups were involved in deploying it. The campaign relied on previously unknown vulnerabilities, meaning no fix was available at the time of exploitation. Details on specific affected versions, indicators of compromise, and mitigation guidance were not provided in the source material. Source: BleepingComputer Has your organization reviewed its Windows and Chrome patch cadence in light of shared exploit kits like this one?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited flaws to its Known Exploited Vulnerabilities (KEV) catalog, each affecting a different vendor: Cisco, Citrix, and Fortinet. Federal Civilian Executive Branch (FCEB) agencies are required to apply the corresponding patches by September 12, 2026. The vulnerabilities flagged are: CVE-2026-20079 (CVSS score: 10.0) — an authentication issue in a Cisco product. The article notes that this Cisco flaw carries the maximum severity rating, underscoring the urgency of remediation for exposed systems. CISA's KEV designation means the vulnerability is confirmed to be exploited in the wild, not merely theoretical, which is why the binding patch deadline applies to federal agencies. Details on the Citrix and Fortinet vulnerabilities, including their specific identifiers, were not provided in the source material. Organizations running any of the three vendors' affected products should track vendor advisories directly and prioritize patching ahead of the federal deadline. Source: The Hacker News Does your organization run any Cisco, Citrix, or Fortinet products that could be affected by these KEV additions?

CISA has confirmed that ransomware operators are now exploiting a critical remote code execution vulnerability in WatchGuard Firebox firewalls. The flaw was already flagged by the agency as actively exploited back in December, and this new confirmation shows the situation has escalated beyond initial access attempts into full ransomware deployment. The vulnerability affects the firewall's management interface and allows unauthenticated attackers to execute arbitrary code remotely. Because these devices typically sit at the network edge, successful exploitation can give threat actors a direct foothold into internal environments, which they then use to move laterally and deploy ransomware. Key points to note: CISA has confirmed active exploitation by ransomware gangs. The flaw was previously added to the agency's list of known exploited vulnerabilities in December. WatchGuard Firebox appliances are the affected product line. Exploitation can lead to remote code execution without authentication. Organizations running exposed management interfaces are at the highest risk. If you manage WatchGuard Firebox devices, prioritize patching and restrict management interface access to trusted networks only. Review logs for unusual activity on the management port and consider isolating affected appliances until they are fully updated. Given that this is now tied to ransomware operations, treating it as an emergency remediation item rather than a routine patch is the safer approach. Source: BleepingComputer Has your organization already patched its WatchGuard appliances, or are you still working through exposure checks?

A major vulnerability is disclosed, the alert lands immediately, and then the harder question follows: are we actually exposed? For many security teams, answering that question means jumping between vulnerability scanners, endpoint tools, cloud inventories, SBOMs, repositories, and application data to build enough context to act. As AI accelerates vulnerability discovery and research, that delay matters more than ever, which is the focus of an upcoming webinar on answering "Are we exposed?" faster after a new CVE is disclosed. Key points covered: The gap between receiving a vulnerability alert and determining actual exposure The many data sources teams must correlate, including scanners, endpoint tools, cloud inventories, SBOMs, repositories, and application data How AI-accelerated vulnerability discovery and research increases the pressure to respond quickly Source: The Hacker News How does your team currently triage a new CVE to determine real exposure?