Cybersecurity briefing — August 28, 2026.

PaperCut has confirmed active exploitation of a zero-day affecting PaperCut NG and PaperCut MF across versions, including reports of confirmed customer incidents. The company has released emergency patches for v25 and v26 and is urging organizations to install updates and apply mitigations immediately. For defenders, this is another reminder that print-management stacks remain an attractive initial access path—and that “unpatched” can quickly become “actively weaponized.”

Source: SecurityWeek

CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a previously patched Citrix NetScaler ADC/Gateway flaw (CVE-2026-8452) now being exploited in the wild. The update signals that organizations may still face exploitation risk from bugs they believed were “done” after initial patching. The takeaway for CISOs and patch managers: prioritize KEV items first, verify versions and configurations, and assume attackers will re-target “fixed” systems that were not properly updated or remain exposed.

Source: Help Net Security

Authorities in Australia arrested two men alleged to be behind TeamPCP, a supply-chain and data-extortion group linked to long-running attacks that reportedly involved malicious open-source software. The arrests underscore how threat actors continue to weaponize software ecosystems where developers assume provenance and integrity. For defenders, the practical lesson remains: strengthen SBOM/attestation, tighten dependency and build pipelines, and monitor for tampered packages even when they originate from reputable repositories.

Source: KrebsOnSecurity

Manchester Airports Group (MAG) confirmed an intrusion affecting customer data across multiple UK airports, with reporting indicating 8.7 million customers potentially impacted. While the scope of data accessed appears limited in many cases (e.g., email addresses), even “small” datasets can power high-conversion phishing and account takeover attempts. Expect threat actors to convert breach-derived contact data into targeted social engineering campaigns—so incident response should include rapid email/identity monitoring and user communications.

Source: The Record

Rapid7 analyzed underground marketplaces selling Social Security numbers tied to corporate executives, describing how stolen SSNs remain valuable for years and can enable downstream fraud and impersonation. The research highlights mature services (including search and enrichment mechanics) and shows that leadership targets dominate exposure patterns. Rapid7 also outlines response options such as monitoring, validation of listings, and removal/takedown approaches where possible—important because SSNs can’t be “rotated away” like passwords.

Source: Rapid7

Recent guidance and commentary emphasize that guardrails written for models are often advisory rather than enforceable, especially when agents can act rapidly across systems. Instead, governance must be executable—implemented where data access and changes are enforced, with auditable controls tied to agent identity, purpose, and logging. The core risk shift: as agents gain autonomy, organizations need “digital leashes” enforced by the systems that actually process and authorize actions.

Source: VentureBeat

The US seized domains associated with QScan and QTRouter, hacking tools tied by court documents to QTFY, which investigators say sold services to customers including state-linked actors. By cutting off access to common tooling, the disruption can reduce attackers’ operational readiness—especially when tools are integrated into repeatable campaigns. For defenders, it’s a reminder to monitor tooling patterns and attacker infrastructure, because takedowns can create short windows of reduced risk and intelligence opportunities.

Source: Help Net Security