Summary: Sygnia reports that the China-nexus actor Fire Ant, which overlaps with UNC3886, has moved beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts. Operators hid GRE tunnels, captured traffic to external FTP servers, harvested credentials with a TacTap injector, and suppressed syslog, SNMP, and authentication telemetry. A previously undocumented BridgeAgent backdoor was disguised as a Zabbix agent, and implants impersonated monitoring and security tools while the actor probed connected high-value networks.
Key takeaway / Actionable note: Treat routers, TACACS servers, and jump hosts as first-class forensic assets and validate device logs against memory, disk, and network evidence.
Summary: ServiceNow released patches for multiple code-injection defects, including CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, each scored CVSS 10.0, plus CVE-2026-6876 scored 8.7. The critical issues can allow arbitrary code execution, privilege escalation, or arbitrary SQL against instance data. Hosted instances were patched by ServiceNow; hotfixes are available for self-hosted Xanadu, Yokohama, Zurich, and Australia releases.
Key takeaway / Actionable note: Confirm hosted instances received the vendor rollout and apply the self-hosted hotfixes for Xanadu, Yokohama, Zurich, and Australia immediately.
Summary: McKesson Corporation confirmed a cybersecurity incident discovered on August 25 involving unauthorized access to third-party applications and data theft. ShinyHunters claims it stole 284 million records and is demanding about $55 million, with a September 1 negotiation deadline. The company said services were not affected and is offering credit monitoring; it has not independently confirmed the record count or attacker identity.
Key takeaway / Actionable note: Healthcare and pharma supply-chain partners should review third-party application access and watch for follow-on phishing that cites McKesson billing or clinic data.
Summary: Berlin’s city administration confirmed extortion after Rhysida listed the city on its leak site, claiming 5.79 TB and about 1.44 million files from the administrative network. Affected Senate departments were disconnected from the state network on August 14 after a mid-August discovery. The mayor said the city will not pay; investigators have not found evidence that election systems for the upcoming House of Representatives vote were compromised.
Key takeaway / Actionable note: Government network operators should assume leaked administrative credentials and contract files will be reused quickly for spear-phishing and follow-on access.
Summary: Two exploited PaperCut NG/MF flaws are now tracked as CVE-2026-81578 (unauthenticated configuration-changing auth bypass) and CVE-2026-82078 (unsafe dynamic class loading leading to arbitrary Java bytecode execution). Huntress saw exploitation attempts beginning August 26. WatchTowr’s report of patch bypasses and an additional authentication bypass prompted a second emergency patch that also covers version 24.
Key takeaway / Actionable note: Patch every internet-facing PaperCut NG/MF instance, including version 24, and inspect servers for unauthenticated configuration changes and unexpected remote-access software.
Summary: Kaspersky says Silver Fox is distributing the ValleyRAT (Winos 4.0) backdoor inside a modified copy of the signed Chinese adware QN Wallpaper. The installer sideloads a malicious libcef.dll via QnWallpaper.exe, can disable Windows Defender through the DisableAntiSpyware registry key, and adds autorun persistence. ValleyRAT gives operators full control, including keylogging, clipboard theft, screenshots, extra modules, and a critical-process flag that can blue-screen the host if killed.
Key takeaway / Actionable note: Treat signed adware and user-created Defender exclusions as high-risk, and hunt for QnWallpaper.exe loading an unexpected libcef.dll.
Summary: CloudSEK and Gambit Security found Aurora (Aur0ra) operators using the Cursor agentic coding assistant in attacks. Exposed infrastructure showed activity against more than 20 organizations in nine countries from April to July 2026, including hands-on work against 10 targets. Chat and shell history included AD CS attack plans, Nmap/NetExec scanning, NTLM relay, and Certipy certificate attacks.
Key takeaway / Actionable note: Monitor developer AI assistants for unexpected recon and exploitation commands, and assume ransomware crews will use them as junior operators.
Summary: Researcher Nightmare Eclipse (also known as Chaotic Eclipse) released a privilege-escalation exploit dubbed HardBreacher against Kaspersky Endpoint Security. Kaspersky told SecurityWeek it has patched the vulnerability. The fix is delivered through an automatic update, or administrators can trigger a database update manually.
Key takeaway / Actionable note: Force a Kaspersky Endpoint Security database update and verify endpoints are no longer on the pre-patch signature set.
Summary: Anthropic is warning some Claude users that infostealers including Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic/AMOS have stolen active login sessions from infected machines. Stolen sessions let attackers use accounts without passwords or 2FA and burn usage quotas. Anthropic is signing affected users out, removing saved payment methods, and refunding unauthorized charges.
Key takeaway / Actionable note: Revoke Claude sessions, remove saved payment methods if prompted, and treat unexpected quota drain as an endpoint-compromise signal.
Summary: A Rails arbitrary file-read issue nicknamed KindaRails2Shell can expose secrets and lead to remote code execution on applications that use libvips for Active Storage image processing and accept untrusted uploads. Rails shipped patches in late July and published forensic tools; VulnCheck identified around 7,000 exposed instances, and exploitation began last week.
Key takeaway / Actionable note: Patch Rails image-processing stacks that accept untrusted uploads and use the vendor forensic tools to check for exploitation.
Also Noted
Bottom line
The last day mixed classic extortion (McKesson, Berlin, Manchester airports) with infrastructure-level espionage on Cisco IOS XR and TACACS. The patch queue is unforgiving: ServiceNow CVSS 10 issues, exploited PaperCut zero-days, a GiveWP command-execution chain, and an actively targeted Rails file-read bug all need action this week. Assume AI coding agents and stolen SaaS sessions are now part of both crimeware and ransomware playbooks.