MAG’s 27 August 2026 statement said an unauthorised third party obtained customer data from car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands airports (emails, phones, vehicle registrations, postcodes; no bank details; operations unaffected). The BBC (2 September 2026) reports that criminal hackers posted the personal data of nearly nine million people online after breaching the three airports, and that they extorted MAG for an undisclosed amount but failed to get their ransom paid; it quotes MAG saying it has contacted all those affected, including everyone with upcoming bookings. (source: BBC News) A group calling itself FulcrumSec claimed responsibility, according to Computer Weekly. (source: Computer Weekly) Have I Been Pwned, which added the data on 2 September 2026, lists about 8.8 million affected email addresses and phone numbers, with names, browser user agent details, IP addresses, purchases and vehicle registration plates also present. (source: Have I Been Pwned) MAG’s original mediacentre statement remains the operator notice. Correction (22 Oct 2026): the headline previously stated the leak came 'after ransom refusal' as fact; MAG has not said so, and the BBC reports only that the hackers failed to get their ransom paid. (source: BBC News) Correction (29 Oct 2026): removed claims made by FulcrumSec that no confirmed source supports, and a SecurityWeek link.
Socket Threat Research (published 27 August 2026) identified 18 Chrome Web Store extensions and one Microsoft Edge add-on that deliver an extensible malware framework Socket tracks as Superior. Five of the extensions had been acquired from original creators and later pushed malicious updates to existing users; one right-click utility had around 70,000 Chrome users (and about 10,000 on Edge) when malicious functionality appeared. Modules establish encrypted WebSocket C2, strip Content Security Policy headers, and inject payloads that drain crypto wallets, steal credentials and browser history, harvest social accounts, and show ClickFix-style fake update prompts. Google removed the Chrome listings; Socket reported the Edge variant was still live when it published (Edge C2 rotated on 14 August 2026). Users who installed any listed extension should treat credentials as compromised and move crypto to a fresh wallet. (sources: Socket; BleepingComputer)
ServiceNow's 27 August 2026 CVE record (CNA title: Sandbox Escape in ServiceNow AI Platform) says it remediated a sandbox-escape issue that could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform and gain more access than intended. ServiceNow scores it 10.0 (CVSS 4.0, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Hosted instances received a vendor-deployed security update; partners and self-hosted customers were given the update. ServiceNow says it is not currently aware of malicious exploitation against ServiceNow instances. Self-hosted operators should apply the August 2026 CVE advisory updates (KB3152242). CNA-listed affected rows span Xanadu, Yokohama, Zurich and Australia patch families (including builds before Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b / Patch 13 Hot Fix 4, Zurich Patch 7b–12 hotfixes as listed, and Australia Patch 2–5 hotfixes as listed). Same-day cards cover the three CVSS 4.0 10.0 AI Platform issues (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820). Correction (23 Oct 2026): this card said ServiceNow scored CVE-2026-6876 at 8.7 (CVSS 4.0) with a vector requiring low privileges and named the product Now Platform. ServiceNow's CVE record (last updated 1 September 2026) scores it 10.0 (CVSS 4.0) with no privileges required (PR:N) and names the product ServiceNow AI Platform. Updated 24 Oct 2026: the facts box now also shows the CVE record's product name and CVSS 4.0 vector. (source: CVE-2026-6876 record (cve.org))
Hachette Australia told ABC News that unauthorised activity on the computer systems of its distribution subsidiary Alliance Distribution Services (ADS) was believed to have occurred on 18 July 2026. As of the 27 August 2026 ABC report, Hachette said it was still restoring systems and services, could not yet confirm a timeline for a full return to normal operations, and that restoring full operations securely remained its top priority. The disruption has hit book supply to Australian bookshops and authors ahead of the busy trading period. Hachette has not publicly confirmed whether the incident involved ransomware, data theft, or another form of attack. Secondary commentary that labels the event ransomware remains unverified by the company.
ServiceNow's 27 August 2026 CVE record (CNA title: Unauthenticated Privilege Escalation via System Configuration Image Upload Processor) says it remediated an improper access control flaw in the ServiceNow AI Platform that could, in certain circumstances, let an unauthenticated user create or modify instance data beyond what was intended, resulting in privilege escalation. ServiceNow scored it 10.0 (CVSS 4.0). Hosted instances received a vendor-deployed security update; partners and self-hosted customers were given the update. ServiceNow says it is not currently aware of exploitation against ServiceNow instances. Self-hosted operators should apply the August 2026 CVE advisory updates (KB3152242). Affected CNA rows include Xanadu, Yokohama, Zurich and Australia patch families listed on the CVE record.
ServiceNow's 27 August 2026 CVE record (CNA title: Unauthenticated Remote Code Execution in GraphQL Composite Data API) says it remediated a code-injection flaw in the ServiceNow AI Platform that could, in certain circumstances, let an unauthenticated user run arbitrary code and gain access to or change instance data beyond what was intended. ServiceNow scored it 10.0 (CVSS 4.0). Hosted instances received a vendor-deployed security update; partners and self-hosted customers were given the update. ServiceNow says it is not currently aware of malicious exploitation. Self-hosted operators should apply the August 2026 CVE advisory updates (KB3152242). Affected CNA rows include Xanadu, Yokohama, Zurich and Australia patch families listed on the CVE record.
PaperCut Software's 27 August 2026 (AEST) security bulletin, last updated 10 September 2026, published Security Maintenance Releases on 10 Sep 2:00pm AEST: NG/MF 26.0.5, 25.0.13 and 24.1.10 are Regular Maintenance Releases that completed full QA, include all fixes from Emergency Patch Releases 1–3 plus extra hardening, and replace the emergency patches as the recommended builds. Earlier context: PaperCut says its response team is investigating active exploitation of PaperCut NG and PaperCut MF, with confirmed customer incidents. The advisory applies to all versions of both products. Immediate action: if the Application Server is reachable from the public internet, restrict web access to trusted addresses now. Emergency Patch Release 2 went out for NG/MF v24, v25 and v26 (Windows, Linux and macOS) with extra hardening after work with Huntress and watchTowr. Versions before v24 should upgrade to the latest. The bulletin lists CVE-2026-82078 (unsafe dynamic class loading in the database connector, CVSS 4.0 9.4 Critical) and CVE-2026-81578 (authentication bypass that can let an unauthenticated remote attacker modify certain system configurations, CVSS 4.0 8.8 High). Site Servers and secondary/print servers should be updated, not only the primary Application Server. Print Deploy and Mobility Print are not affected. Vendor-listed possible indicators include suspicious post-exploitation from pc-app.exe; missing, truncated or deleted server.log files; and server.log lines "ERROR No suitable driver found for jdbc:no:x" or "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST". Absence of those lines is not proof the server is clean. On 29 August 4:35pm AEST PaperCut added that some sites report the external-database Card/ID number lookup feature and SAML are not working as expected after the patch. Card/ID lookup from an external database is off by default after Release 2; sites that still need it must set security.card-number-lookup.enabled=Y in server/security.properties and restart the Application Server. On 30 August 10:34am AEST the vendor said customers using SQL Server for external card lookups with the legacy SourceForge jTDS driver should move to the latest supported Microsoft SQL JDBC driver; engineering is still working toward an official release and support remains available. On 30 August 3:35pm AEST PaperCut added further indicators of compromise: server.log strings such as DB URL jdbc:derby:memory:pwn;create=true, Database error looking up cardID: VALUES CAST(X'cafebabe, Database error looking up cardID: VALUES CAST(', and DB URL jdbc:no:x with a 5-character random DB Driver name; files under install/server/lib/<5-char-name>.class and install/server/data/content/<5-char-name>.cmd or .out (attackers may remove those files). Observed post-compromise behaviour includes pc-app.exe or pc-app spawning cmd.exe for whoami and ver, then reconnaissance and downloads of remote-access tooling (including a Windows service named Remote Access Service running SimpleService.exe from a JWrapper-Remote Access path, and unexpected AnyDesk under C:/ProgramData). Absence of those indicators is not proof a server is clean. On 31 August 2026 4:21pm AEST PaperCut posted a status update with no new technical information. On 1 September 2026 11:18am AEST it added FAQ clarifications, and at 2:10pm AEST it added build numbers to download links. PaperCut published Emergency Patch (Release 3) on 1 September 2026 at 6:22pm AEST. It supersedes Release 2, is an accumulation of all emergency releases, addresses two known regressions (broken SAML login flows; restored support for legacy Microsoft SQL Server drivers for external card lookup), and adds additional hardening and mitigation against potential attack chains. Customers with internet-facing Application Servers should install Release 3 even if they already applied Release 2 or an earlier emergency release. Download tables now show R3 builds (MF v26 76531, v25 76532, v24 76534; NG v26 76530, v25 76533, v24 76535). BleepingComputer (1 September) reported that Defused observed CVE-2026-81578 / CVE-2026-82078 honeypot activity since late 29 August UTC; an actor abused the auth bypass to hijack PaperCut's external user-lookup and dump database tables via Derby (a data-theft path, distinct from the public RCE writeups). CISA added CVE-2026-81578 and CVE-2026-82078 to the Known Exploited Vulnerabilities catalog on 31 August 2026. WA SOC advisory 20260901001 (1 September, TLP:CLEAR) points operators at the same vendor bulletin, lists the two CVEs (CVSS 9.4 and 8.8), and says it has not received reports of exploitation on Western Australian Government networks at the time of writing. On 2 September 2026 at 4:38pm AEST PaperCut added an 'Updates from the field' note to Current Status: it says a second wave of attacks is hitting servers that are not fully patched and remain publicly available, and that this wave appears to involve more sophisticated post-compromise behaviour than the first days of the incident. The vendor again stresses installing Emergency Patch Release 3 or keeping the Application Server off the public internet. Bulletin page header last-updated date moved to 5 September 2026; Current Status at 5 September 2026 10:30am AEST reported no new vendor technical information (work continues toward the official release); EPR3 remains the current emergency build (no EPR4 in this update). The Hacker News (5 September 2026) summarises Arctic Wolf Adversary Research Team observations: attackers exploiting CVE-2026-81578 and CVE-2026-82078 against education-sector PaperCut servers in the United States and Europe (K-12 through universities) for command execution, reconnaissance and privileged-account creation, with post-exploitation including Windows registry hive collection tools (including lsa_collect.exe used to reconstruct BootKey/SAM access paths), Metasploit/Meterpreter-related Java payloads, and host/user/process enumeration. Arctic Wolf published related pack alerts at github.com/rtkwlf/wolf-tools (202609-papercut-cve-exploitation). Still: keep Application Servers off the public internet or on EPR3; monitor pc-app.exe spawning cmd.exe/powershell and the vendor IoCs already on this card. NEW 10 September 2026 (BleepingComputer citing GreyNoise; The Hacker News also citing Blackpoint Cyber): a likely Russian-speaking actor used hundreds of AI agents (OpenAI Codex and DeepSeek plus commodity tools) to build and refine exploits for CVE-2026-81578 and CVE-2026-82078, generating target lists via Netlas. GreyNoise reports at least 440 PaperCut instances at 395 organisations across 48 countries compromised; credentials from 280 victims, OS/domain secrets from 147, and administrator privileges at 12 organisations; roughly half of victims in education; top countries US, UK, France, Spain, Canada. First RCE under four hours from an empty workspace; domain admin about two hours later. Still: EPR3 or take Application Servers off the public internet; monitor the vendor IoCs already on this card. UPDATE 15 October 2026 (Hunt.io): Hunt.io found three open directories on the campaign's orchestration host 45.142.193[.]132 (ports 8000, 18080 and 18081) holding the operator's working files, including a 3.9 GB AI-agent workbench whose AGENTS.md instructions (in Russian and English) describe OpenAI's Codex harness paired with a DeepSeek model. The files reveal a second remote-code-execution path that does not need the CVE-2026-81578 bypass: the XML-RPC Web Services API (/rpc/api/xmlrpc), using api.setConfigValue to change user-lookup settings and api.lookUpUserNameByCardNo to trigger the database execution path. It needs valid API authentication, but where no explicit API token is configured the built-in administrator password is accepted as a fallback token. Post-exploitation tooling collected Windows SECURITY and SYSTEM hives, machine-account and service credentials (lsa_read.exe, save_hives.exe, collect_custom.exe, lsa_collect_small.exe), and built reverse SOCKS5 tunnels with chisel and cron persistence on Linux (working directory /var/tmp/.rs_live46_v5/). The actor's files list 1,005 hosts in its reconnaissance pool across at least 45 countries, 2,165 logged exploitation attempts, 46 Active Directory domains in packaged victim kits and 45 targets with live reverse SOCKS5 pivots at capture (none listed in Australia). Australian angle: the recon pool includes 30 Australian hosts (23 confirmed vulnerable, 7 flagged from version checks). Hunt.io says it shared the victim data with national CERTs, which are notifying affected organisations. A second build server, 45.158.196[.]75, was also identified. Hunt.io advises anyone who ran an internet-facing PaperCut server between 15 August and 11 September to hunt for compromise rather than rely on patching: look for user-lookup.* configuration changes, .class files under the PaperCut server directory, files written under server/custom/web/ (pcp_<random>.txt output files), unexpected child processes, chisel tunnels and cron entries, and the account name Administrator17 (a GreyNoise campaign indicator).
ServiceNow's 27 August 2026 CVE record says it remediated an unauthenticated SQL injection in the ServiceNow AI Platform that could, in certain circumstances, let an unauthenticated user run arbitrary SQL against the instance database and read or change data beyond what was intended. ServiceNow scored it 10.0 (CVSS 4.0). Hosted instances received a vendor-deployed security update; partners and self-hosted customers were given the update. ServiceNow says it is not currently aware of malicious exploitation. The same 27 August CNA batch includes CVE-2026-18885 (unauthenticated code injection in the GraphQL Composite Data API, CVSS 4.0 10.0; own card on Cyberstack), CVE-2026-18886 (unauthenticated privilege escalation via image-upload processor, CVSS 4.0 10.0; own card on Cyberstack) and CVE-2026-6876 (ServiceNow AI Platform sandbox escape, CVSS 4.0 10.0; own card on Cyberstack). Self-hosted operators should apply the August 2026 CVE advisory updates. Affected CNA rows include Xanadu, Yokohama, Zurich and Australia patch families listed on the CVE record. Correction (24 Oct 2026): this card described CVE-2026-6876 as a Now Platform flaw scored 8.7; ServiceNow's CVE record (updated 1 September 2026) names the ServiceNow AI Platform and scores it 10.0 (CVSS 4.0). (source: CVE.org record for CVE-2026-6876)
Authenticated path-limitation flaw in JFrog Artifactory: under specific remote-repository conditions a user may write outside the intended Docker cache path. NVD affected builds end before 7.146.35, and 7.161.0 through builds before 7.161.16. CVSS 5.3. Patch to 7.146.35 or 7.161.16 (or later). Treat artifact caches as part of the software supply chain, not a side appliance. UPDATE (26 Oct 2026): CISA added CVE-2026-66384 to its Known Exploited Vulnerabilities catalog on 27 August 2026, with a 10 September due date for US federal agencies, which means CISA has evidence it is being exploited. JFrog's advisory rates it Medium and its CVE record scores it 5.3 (CVSS 3.1). (source: CISA KEV catalog)
Out-of-bounds write in the Linux IPv6 send path (__ip6_append_data) when the paged-allocation branch undersizes the linear skb by fraggap bytes. An unprivileged local user can trigger it with a UDPv6 socket using MSG_MORE and MSG_SPLICE_PAGES. kernel.org rates CVSS 7.8. Red Hat describes the same flaw as a privilege-escalation and container-escape path on affected kernels. Patch to 6.1.177, 6.6.144, 6.12.95, 6.18.38 or 7.1.3, or the distro kernel that carries those stable commits. Red Hat documents a temporary workaround of user.max_user_namespaces=0; that setting breaks some container workflows. UPDATE (26 Oct 2026): CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 27 August 2026, with a 30 August due date for US federal agencies, which means CISA has evidence it is being exploited. (source: CISA KEV catalog)
ownCloud core before 10.13.1 accepts pre-signed WebDAV URLs even when the file owner has no signing-key configured (the default). If the victim username is known, an unauthenticated attacker can access, modify, or delete any of that user's files. ownCloud rates CVSS 9.8. Fixed in 10.13.1 by denying pre-signed URLs when no signing-key is set. Patch, then review access logs for unexpected WebDAV activity. UPDATE (25 Oct 2026): CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalog on 27 August 2026, with a 30 August due date for US federal agencies, which means CISA has evidence it is being exploited. (source: CISA KEV catalog)
OpenAI published an open letter, "A call for collective action on cyber defense," signed on that page by OpenAI, Anthropic, Google, Microsoft, AWS and a long listed set of other firms. The letter says there is a limited window to strengthen cyber defences; that in the coming months AI-enabled cyber attacks will become far more widespread and sophisticated as models become more capable; and that hospitals, water treatment plants and internet infrastructure are at risk. It argues status-quo security will not be enough, and calls on organisations, cybersecurity companies and governments to put cyber-capable AI in defenders' hands, starting with essential services. Dated 27 August 2026 in contemporaneous reporting; the letter page itself does not print a date.
