Security Community

❓What:

• Arctic Wolf is tracking an active cluster (PREY-0058) using voice phishing to compromise Microsoft 365 and connected SaaS platforms — no software vulnerability involved

• Actors impersonate IT/Helpdesk staff via phone calls or texts, directing victims — primarily Directors, VPs, and executives — to Adversary-in-the-Middle (AiTM) phishing pages

• AiTM pages capture credentials and MFA tokens in real time, defeating standard MFA

• Static residential proxy infrastructure (NodeMaven, seen in the majority of cases) is used to mimic legitimate login behavior and evade detection

❓What:

• CISA added two PaperCut NG/MF vulnerabilities — CVE-2026-81578 (missing authentication, CWE-306) and CVE-2026-82078 (unsafe reflection, CWE-470) — to its Known Exploited Vulnerabilities catalog on August 31, 2026

• CVE-2026-81578 lets an unauthenticated attacker modify system configuration settings

• CVE-2026-82078 allows execution of arbitrary Java bytecode already on the application classpath, under the PaperCut server process's security context

• The two can be chained: unauthenticated config change → reflection-based code execution, enabling remote compromise of vulnerable deployments

❓What:

• DOJ and FBI executed court-authorized seizures of domains hard-coded into two hacking platforms, "QScan" and "QTRouter," disabling both tools since the domains were essential for their communication and authentication functions as described in court documents unsealed in the Southern District of California U.S. Department of Justice

• The platforms were created and operated by a PRC state-sponsored group known as "QTFY," employed by China-based Nanjing Xinjiuwei Network Technology Company — this attribution comes directly from unsealed court documents, not inference U.S. Department of Justice

• QTFY allegedly sold hacking services to customers including China's Ministry of State Security and the People's Liberation Army Bitcoin News

• The two platforms performed different functions within an integrated reconnaissance, exploitation, and traffic-obfuscation system Bitcoin News

❓What:

• Boston Scientific detected a cybersecurity incident on Aug. 25, 2026, disclosed in an SEC filing Aug. 26

• The incident caused a global disruption to IT systems and business applications

• Company has activated incident-response procedures and engaged third-party cybersecurity specialists to investigate and contain the threat

• No timeline yet for full system restoration

❓What:

• Joint FBI/CISA/MS-ISAC advisory (AA25-071A, originally published March 2025) detailing Medusa ransomware-as-a-service (RaaS) TTPs from FBI investigations through February 2025

• Medusa has operated since June 2021, evolving from a closed operation to an affiliate model, and has impacted over 300 victims across critical infrastructure sectors including medical, education, legal, insurance, technology, and manufacturing

• CISA explicitly notes Medusa is unrelated to the MedusaLocker ransomware variant or the Medusa mobile malware — a common naming mix-up worth correcting when this comes up

• Initial access comes via recruited initial access brokers using phishing and exploitation of unpatched CVEs, specifically the ScreenConnect authentication bypass (CVE-2024-1709) and the Fortinet EMS SQL injection flaw (CVE-2023-48788)

❓What:

• ShinyHunters (tracked by Mandiant as UNC6240) exploited an unpatched RCE flaw in Oracle PeopleSoft PeopleTools, CVE-2026-35273 (CVSS 9.8), between May 27 and June 9, 2026 — before Oracle's advisory landed on June 10, making it a true zero-day for the entire window

• The flaw sits in the Environment Management Hub (PSEMHUB) component and requires no authentication or user interaction — just HTTP network access to the exposed endpoint

• Affects PeopleTools 8.61 and 8.62; Oracle says older, unsupported versions are likely vulnerable too

• The intrusion came to light because attackers left their own staging servers exposed — open directories running Python SimpleHTTP on port 8888, discovered by researcher @nahamike01 and triaged by Mandiant

❓What:

• A firmware integration error from March 2021 in Coinkite's Coldcard hardware wallet caused seed generation to route through a deterministic software PRNG instead of the device's STM32 hardware RNG, on five affected models/tracks.

• Block traced the root cause to a production config flag (MICROPY_HW_ENABLE_RNG) that checked whether a macro existed rather than whether it was enabled, silently binding builds to MicroPython's weak Yasmarang fallback, seeded only from chip UID and timer state at init with no further entropy collected.

• Galaxy Research mapped an initial sweep of 1,196 addresses in 41 minutes on July 30, draining 1,082.65 BTC (~$70.2M at the time); two additional suspected waves have since raised the total to 1,367.05 BTC (~$88.6M) across 4,585 addresses.

• Coinkite shipped emergency firmware on July 31 for all affected models, but patching does not repair seeds already generated on vulnerable firmware.

❓What:

• A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a statewide cybersecurity response. thehackernews

• Braham's water plant went offline, prompting the city to ask residents to minimize water use, while Plymouth reported cellular communications problems at two water towers and multiple wastewater lift stations but continued operating manually.

• South St. Paul and Maple Plain kept services running after automated utility controls were affected, with Maple Plain declaring a local state of emergency.

• Officials have not publicly named the attacker, initial access method, affected products, exploited vulnerability, or whether data was stolen. The 30+ figure reflects systems targeted, not confirmed compromised or disrupted.

❓What:

• Zafran Labs researchers disclosed three flaws (collectively named FaceHugger) in Hugging Face's Diffusers library that bypass trust_remote_code, the safeguard meant to block unreviewed code from running during custom pipeline loading.

• CVE-2026-44827 (CVSS 8.8) and CVE-2026-44513 (CVSS 8.8): code injection via the custom_pipeline flow that loads arbitrary code despite trust_remote_code=False or the parameter being omitted.

• CVE-2026-45804 (CVSS 7.5): a race condition allowing an attacker to swap in malicious config between the hf_hub_download and snapshot_download calls.

• Root cause: a TOCTOU flaw — the model download happens as two separate, non-atomic HTTP requests, but the trust check only runs against the first.