pwnspectrum | Daily Cybersecurity Intelligence

[CVE] CVE SPOTLIGHT

CVE-2026-82078 CVSS 9.0 Patch Now PaperCut NG/MF

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.

CISA KEV

CVE-2026-81578 CVSS 9.0 Patch Now PaperCut NG/MF

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.

CISA KEV

CVE-2026-82456 CVSS 10.0 Patch Now Multiple Products

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the l...

CVE-2026-82971 CVSS 10.0 Patch Now Multiple Products

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ...

CVE-2026-82542 CVSS 10.0 Patch Now Multiple Products

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manip...

[0x01] CRITICAL VULNERABILITY DISCLOSURES & KNOWN EXPLOITS

Critical CVE-2015-3246 https://www.cisa.gov/uscert/ncas/current-activity.xml 01 Sep 2026

CISA Expands Known Exploited Vulnerabilities Catalog with Six New Flaws

CISA has added six new vulnerabilities to its KEV Catalog, confirming active exploitation in the wild. Organizations must immediately verify the affected software versions and apply patches or compensating controls. Review the official CISA advisory for specific mitigation instructions.

Critical CVE-2026-55040 https://www.cisa.gov/uscert/ncas/current-activity.xml 01 Sep 2026

CISA Update: Guidance on Hardening and Exposure of SharePoint Servers

CISA issued updates to clarify best practices regarding direct internet exposure of SharePoint Servers. Defenders must review these updated guidelines to minimize the attack surface. Specific patches (e.g., CVE-2026-2...) should be applied to remediate known exposure risks.

Critical https://proofpoint.com/us/rss.xml 01 Sep 2026

Max-Severity Exchange Server Flaw Under Active Exploitation by Adversaries

A critical flaw in Exchange server is confirmed to be actively exploited by nation-state threat actors. Rapid patching is mandatory for all exposed Exchange infrastructure. Implement defensive measures such as virtual patching and strong authentication policies.

[0x02] THREAT ACTOR & OPERATIONAL INTELLIGENCE

Critical https://www.cisa.gov/uscert/ncas/alerts.xml 01 Sep 2026

Iranian Actors Exploit Programmable Logic Controllers in US Critical Infrastructure

Iranian-affiliated actors are exploiting PLCs across US critical infrastructure, indicating targeted physical sector attacks. Review operational technology (OT) network segmentation and integrity monitoring systems. Isolate PLCs from IT networks and implement robust access controls.

Critical https://www.cisa.gov/uscert/ncas/alerts.xml 01 Sep 2026

Pro-Russia Hacktivist Campaign Targets US and Global Critical Infrastructure

Joint advisories indicate pro-Russia hacktivists are conducting opportunistic attacks against critical infrastructure. Heighten threat monitoring across industrial control systems and network perimeters. Implement enhanced behavioral analytics to detect unusual activity patterns.

Critical https://www.darkreading.com/rss.xml 01 Sep 2026

China-Linked Operator Uses Complex AI Framework in APAC Attack Simulation

A Chinese-linked operator demonstrated complex, near-autonomous attack capabilities using AI frameworks targeting government agencies. Organizations must elevate AI-driven threat modeling in their security architectures. Implement zero-trust principles and robust data loss prevention.

High https://securelist.com/feed/ 31 Aug 2026

Analysis of ValleyRAT Backdoor Disguised as Adware

Threat actors are distributing the ValleyRAT backdoor, masking it as innocuous adware payloads. Endpoint detection and response (EDR) solutions must be configured to detect suspicious installation chains and payload execution. Monitor for unauthorized software installations and lateral movement attempts.

Critical https://blog.malwarebytes.com/feed/ 01 Sep 2026

Healthcare Data Breach Reported at McKesson Following Claimed Theft

McKesson confirmed a data incident after ShinyHunters claimed theft of millions of patient records. Review data retention policies and third-party vendor access controls. Implement strict data anonymization and access logging for Protected Health Information (PHI).

Critical https://news.sophos.com/en-us/category/security-operations/feed/ 01 Sep 2026

CISO Guide: Detecting and Mitigating Risks from Foreign State-Sponsored Hiring

This guide addresses the risk of employment by foreign state-sponsored actors. Security teams should implement enhanced vetting procedures for new hires and manage supply chain risk. Review background checks and access provisioning policies for high-risk personnel.

[0x03] WEAPONS, MALWARE & POST-EXPLOITATION TECHNIQUES

Critical https://blog.malwarebytes.com/feed/ 01 Sep 2026

ToxicPanda 2.0 Android Trojan Seizes Control of Banking Apps and Devices

A new version of the banking Trojan, ToxicPanda 2.0, can seize control of infected Android devices and block access to core services. Deploy robust Mobile Threat Defense (MTD) solutions. Train users on identifying phishing vectors and securing mobile endpoints.

Critical https://news.sophos.com/en-us/category/threat-research/feed/ 01 Sep 2026

Threat Actors Utilize Teams Vishing and Malware for Ransomware Deployment

Attackers are combining Microsoft Teams vishing, custom malware, and remote access tools to deploy ransomware. Organizations must implement strong Multi-Factor Authentication (MFA) across collaboration tools and conduct user awareness training focused on vishing techniques.

High https://feeds.feedburner.com/TheHackersNews 31 Aug 2026

Aurora Ransomware Operators Leverage AI Coding Assistants in Attacks

Threat actors associated with Aurora ransomware are using AI-powered coding assistants like Cursor to facilitate network penetration and attack planning. Defenses must integrate AI-specific detection mechanisms and focus on behavioral anomaly detection rather than signature matching.

Critical https://feeds.feedburner.com/TheHackersNews 31 Aug 2026

Security Implications of Large Language Models: Visibility and Identity Governance

LLMs like Claude Code can execute sensitive commands and read local files using developer credentials. Implementing rigorous API gateway controls, least privilege access, and detailed activity monitoring is crucial. Security teams must maintain clear visibility into AI developer tooling activity.

Medium Unknown 01 Sep 2026

Exchange Server Flaw: Max-Severity Vulnerability Exploitation

A severe flaw in Exchange Server is under active exploitation. Immediate patching is necessary to mitigate Remote Code Execution (RCE) risk. Apply virtual patching and monitor for suspicious email activity originating from the server infrastructure.

[0x04] VULNERABILITIES, PATCHING & DEFENSE STRATEGIES

High https://www.bleepingcomputer.com/feed/ 31 Aug 2026

Microsoft Guidance on Interpreting Defender Antivirus 'Off' Alerts

Microsoft advised users to disregard certain 'Antivirus is turned off' warnings after specific Defender updates. Defenders should verify the current security posture through official Microsoft channels. This advisory serves to prevent alert fatigue while maintaining vigilance on potential security gaps.

Critical CVE-2026-75802 NVD 01 Sep 2026

Wicket Component Flaw Allows Unsafe HTML Rendering via AjaxEditableChoiceLabel

An unsafe rendering vulnerability exists in Wicket's AjaxEditableChoiceLabel, potentially allowing an attacker to inject unescaped HTML. Developers must ensure proper output encoding and input sanitization when using this component. Patching the framework is recommended.

Critical CVE-2026-81267 NVD 01 Sep 2026

Cross-Origin Navigation Stall Vulnerability Fixed in Firefox for iOS

A vulnerability allowing malicious webpages to stall cross-origin navigation has been fixed in Firefox for iOS 155.0. Mobile application developers should confirm dependencies on browser security updates. This highlights the need for timely OS and browser patching.

Critical https://www.exploit-db.com/rss.xml 31 Aug 2026

Linksys E1200 Router Flaw: Unauthenticated OS Command Injection

Linksys E1200 firmware has an unauthenticated OS Command Injection vulnerability. Administrators must update the router firmware immediately to prevent unauthorized remote command execution. Restrict internet exposure and enforce strong local passwords.

Critical https://www.exploit-db.com/rss.xml 31 Aug 2026

CubeCart Web Application Vulnerability: SQL Injection Flaw in Version 6.7.4

CubeCart 6.7.4 is susceptible to SQL Injection attacks. Developers must upgrade to a patched version or implement parameterized queries and strict input validation. Never trust user-supplied data in database queries.

Critical https://news.sophos.com/en-us/category/security-operations/feed/ 01 Sep 2026

Integration of Sophos Intelix Threat Intelligence with Microsoft 365 Copilot

The integration of advanced threat intelligence (Sophos Intelix) into M365 Copilot enhances security visibility for enterprise users. Organizations should review their M365 security policies to ensure threat intelligence is fully utilized in modern collaboration tools.

[0x05] CYBERSECURITY VIDEOS

🦠 Malware Analysis

DFIR 46 | Static vs Dynamic Malware Analysis | Uplatz

Uplatz ↗

🦠 Malware Analysis

Malware Analysis 101 | Diyar Saadi | Ammaar | Part One | Cyber Base Professional Connect Series -03

CYBER BASE COMMUNITY ↗

🦠 Malware Analysis

Minecraft Malware Lab

John Hammond ↗

🔬 Exploit POC

Cloud Commander Can Let Outsiders Reach Files Beyond Root (CVE-2026-82460)

AISLabs AI ↗

🔬 Exploit POC

Artifactory Flaw Can Let Users Write Outside Docker Cache (CVE-2026-66384)

AISLabs AI ↗

📚 Tutorial

How to Protect Your Android Device Advance Application

Zero Xploid ↗

[0x07] BUG BOUNTY HIGHLIGHTS

Report #3759920 — Remitly (Activities::BugResolved)

Medium Amazon Vulnerability Research Program

Report #3890985 — Amazon Vulnerability Research Program (Activities::BugResolved)

Medium Amazon Vulnerability Research Program

Report #3922893 — Amazon Vulnerability Research Program (Activities::BugResolved)

Report #3955163 — Sony (Activities::BugResolved)

Report #3840771 — Sony (Activities::BugResolved)

[0x08] EXPLOIT-DB FRESH DROPS

WebApps Multiple

[webapps] C-MOR 6.0104 - Directory Traversal

WebApps Multiple

[webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS)

WebApps Multiple

[webapps] CubeCart 6.7.4 - SQL injection

WebApps Multiple

[webapps] CubeCart 6.7.4 - SQL

WebApps Multiple

[webapps] CubeCart 6.7.4 - Stored XSS

[0x09] UPCOMING CTFs

Jeopardy Weight: 25.0

NNS CTF 2026

Sep 4, 16:00 UTC 2 days

CTFTime ↗ Register ↗

Jeopardy Weight: 77.1

TFC CTF 2026

Sep 5, 10:00 UTC 1 days

CTFTime ↗ Register ↗

Jeopardy Weight: 0.0

SUNCTF 2026

Sep 6, 00:00 UTC 9 hours

CTFTime ↗ Register ↗

Jeopardy Weight: 24.8

K17 CTF 2026

Sep 11, 10:00 UTC 2 days

CTFTime ↗ Register ↗

Jeopardy Weight: 0.0

CAT CTF 26

Sep 11, 12:00 UTC 1 days

CTFTime ↗ Register ↗

[0x0a] SECURITY PODCASTS

Darknet Diaries

LOW - Trailer

02:45

Listen ↗

Risky Business

Risky Business #850 -- Widespread AI-enabled attacks target Siemens PLCs

3773

Listen ↗

Security Now

SN 1093: Tokens in the Stream - Why LLMs are inherently insecure and prompt injection will persist

2:48:10

Listen ↗

SANS Internet Storm Center

SANS Stormcast Tuesday, September 1st, 2026: LLM Honeypot; PaperCut Update; TerminalFix Malware;

6:27

Listen ↗

[0xff] ARCHIVE

Keyboard Shortcuts

Focus search/

Next articlej

Previous articlek

Open article linkEnter

Toggle TL;DR modet

Toggle themed

Listen to briefinga

Close overlayEsc

Show shortcuts?