-
Zbtlink routers run root commands from an unauthenticated UDP port, and VulnCheck’s own count is 203 internet-facing devices
VulnCheck published two new implants in Zbtlink router firmware on August 27, 2026 — one of them a listening service that runs commands as root with no authentication…
-
CISA’s own assessment of both PaperCut CVEs says exploitation “none,” written a day after PaperCut said customers were under attack
CISA’s own machine-readable assessments of both PaperCut CVEs, timestamped August 28, 2026, record the exploitation status as “none” — a day after PaperCut told customers they were under…
-
Manchester Airports Group says 8.7 million customers’ details were taken from a third-party-hosted database, and the ICO asked it not to name the attacker
MAG confirmed the breach on August 27, 2026 and put the figure at roughly 8.7 million customers; the data came from car park, lounge and Fast Track bookings…
-
Cosmos Labs confirmed every EVM chain was exposed on August 13 and notified operators on August 21, after exploitation had begun
Cosmos Labs’ own post-mortem, published August 28, says a bug reported in April was quietly patched in May under a mistaken conclusion about which chains it touched —…
-
Hasbro is notifying employees of exposed personal data, and its own public account of the March breach has not moved since April
Breach notification letters from Hasbro to its employees became public on August 28, 2026, filed with the Massachusetts attorney general’s office and reported by SecurityWeek and BleepingComputer. The…
-
GiveWP patched an unauthenticated CVSS 10.0 remote code execution flaw and called it additional hardening
GiveWP, a donation plugin installed on more than 100,000 WordPress sites, released version 4.16.7.2 on August 27, 2026. The plugin’s own changelog describes the release in one line:…
-
A Log4j deserialization report was deleted and its author erased. Apache says it is a known non-finding; the exploit lab is still up.
On August 24, 2026 a researcher posting as U-Sec opened issue #4255 on the Apache Logging Services repository, describing a way to defeat Log4j’s allowlist-based deserialization filter. By…
-
ATF confirms a breach of a standalone system, and the Justice Department has already called it a major incident
The Bureau of Alcohol, Tobacco, Firearms and Explosives published a statement on August 26, 2026 confirming a cybersecurity incident, and in the same three-sentence paragraph confirmed something considerably…
-
Berlin confirms it is being extorted, eleven days after announcing a network compromise without mentioning it
The State of Berlin acknowledged a compromise of its administrative network on August 17 without mentioning extortion. On August 28 it confirmed the extortion and rejected the ultimatum…
-
Gitea’s federal deadline expired with 8,393 servers still vulnerable, and the exploitation record is one CPU alert
CISA gave federal agencies three days to fix a critical Gitea remote code execution flaw. The clock ran out on August 28; the day before, Shadowserver counted 8,393…
-
ServiceNow scored three of its own AI Platform flaws at a flat 10.0, and a fourth record contradicts itself on authentication
ServiceNow’s PSIRT published four CVEs on August 27 and scored three of them at a flat CVSS v4.0 10.0 with byte-identical vectors — while the fourth record describes…
-
PaperCut’s zero-day is now two chained CVEs, and the first emergency patch does not stop the chain
PaperCut’s unnamed zero-day now has two CVE numbers, a confirmed chain, and a second emergency patch — because researchers bypassed the first one. Anyone who patched on August…
-
The vendor record understated the day, and a federal clock runs out tomorrow
Citrix still calls CVE-2026-8452 a denial of service. It is a pre-auth root shell with a federal deadline of Saturday, and it outranks the two breaches that sound…
-
UI-TARS-desktop’s MCP servers listened on every interface with no authentication, and the fix is a commit, not a release
CVE-2026-81735 scores 10.0 because the MCP command server had no authentication and listened on every interface — and the remediation is identified by a commit hash, not a…
-
Langflow 1.11.2 fixes three code-execution flaws, one of them unauthenticated, with no workaround offered
Update, September 4, 2026: 1.11.2 remains the fix for the three CVEs in this story, but it is no longer a sufficient version to be on. IBM published…