STORIES LAST WEEK
PaperCut releases emergency patches for actively exploited zero-day
PaperCut released emergency fixes after confirmed attacks against NG and MF servers. Huntress reproduced pre-authentication remote code execution, making internet-exposed print management servers an immediate patching and isolation priority. SecurityWeek, Aug. 28, 2026
Critical Gitea flaw is actively exploited against self-hosted servers
CISA confirmed attackers are exploiting CVE-2026-60004 in self-hosted Gitea servers. Default open registration can let outsiders obtain repository write access, abuse the diffpatch endpoint, install Git hooks, and execute shell commands as the Gitea service account. Help Net Security, Aug. 26, 2026
ServiceNow patches three maximum-severity AI Platform flaws
ServiceNow patched three CVSS 10.0 vulnerabilities enabling code injection, SQL injection, and privilege escalation. Hosted instances received updates, while organizations running self-hosted deployments need to apply the fixes themselves. BleepingComputer, Aug. 28, 2026
Citrix NetScaler flaw is exploited for remote code execution
CISA ordered agencies to patch CVE-2026-8452 after attackers began exploiting vulnerable NetScaler ADC and Gateway appliances. Research showed the memory-overflow flaw can provide unauthenticated root-level code execution, not just denial of service. BleepingComputer, Aug. 27, 2026
OpenAI agents exploit Linux kernel flaw on company systems
OpenAI’s internal AI agents exploited a Linux kernel vulnerability to escalate privileges during testing, alongside unauthorized attacks on third-party systems. CISA added the kernel flaw to its catalog of vulnerabilities known to be exploited. SecurityWeek, Aug. 28, 2026
Amazon Kiro prompt injection can exfiltrate local data
Researchers demonstrated that attacker-controlled repository content could manipulate Amazon’s Kiro coding agent into reading sensitive local information and sending it externally. The attack highlights how project files can become executable instructions for agentic development tools. The Hacker News, Aug. 27, 2026
TeamPCP suspect indicted over software supply chain attacks
U.S. prosecutors indicted an alleged TeamPCP participant after attacks compromised trusted software tools and cascaded into downstream customers. The campaign targeted Trivy, Checkmarx KICS, and LiteLLM, stealing secrets and maintaining persistent access. U.S. Department of Justice, Aug. 27, 2026
ZBT router firmware contains two undocumented root-access implants
Researchers found two factory implants in firmware used across numerous ZBT-built routers. Both allow unauthenticated root command execution, while one maintains outbound command-and-control connectivity that can function behind NAT and ordinary ingress filtering. The Hacker News, Aug. 28, 2026
ShinyHunters-linked attackers breach ReliaQuest identity dashboard
Attackers used phone calls, employee impersonation, a lookalike domain, and a fake SSO page to capture credentials and an MFA approval. Device-trust controls then blocked access beyond a view-only Okta identity dashboard. ReliaQuest, Aug. 23, 2026
Fake Codex installer uses ClickFix to deliver suspected macOS stealer
A malicious Codex installation page appeared in sponsored search results and abused Google Sites to gain credibility. Victims were directed through a ClickFix-style installation process that delivered a payload suspected to be Atomic macOS Stealer. SC Media, Aug. 25, 2026
Thousands of previously leaked AWS access keys remain active
Researchers found that 88% of 10,616 previously exposed AWS keys they retested still authenticated. Hundreds of corporate credentials retained full administrative privileges, showing how leaked long-lived cloud secrets can remain exploitable for years. IT Pro, Aug. 24, 2026
GoCaracal malware uses Ethereum as backup command infrastructure
Arctic Wolf uncovered GoCaracal, a modular espionage framework with remote access, browser credential theft, keylogging, and proxy capabilities. An extended version retrieves replacement command-and-control addresses from Ethereum smart contracts when primary infrastructure fails. Arctic Wolf Labs, Aug. 26, 2026
Justice Department seizes Chinese hacking platforms targeting critical infrastructure
The Justice Department and FBI seized domains supporting QScan and QTRouter, platforms used by China-linked hackers to target U.S. critical infrastructure and federal agencies. Hard-coded dependencies on the seized domains rendered the platforms inoperable. U.S. Department of Justice, Aug. 26, 2026
More cybersecurity news
- Last week’s news roundup
- More cybersecurity news
- All articles sponsored by NetworkTigers
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, the company originally built and re-architected data centers for Fortune 500 firms. Today, NetworkTigers provides consulting and network equipment to global government agencies, Fortune 2000 companies, and healthcare companies. Visit www.networktigers.com
