PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes. As BleepingComputer reported yesterday, PaperCut warned that hackers were exploiting a vulnerability in zero-day attacks against customer servers and released an initial emergency patch for PaperCut NG/MF versions 25 and 26. At the time, however, the company had not disclosed CVE identifiers or technical details about the vulnerabilities, saying it was withholding information while it investigated the attacks and gave customers time to apply emergency fixes. PaperCut has now shared technical details and CVE identifiers for the two vulnerabilities, tracked as CVE-2026-82078 and CVE-2026-81578. These vulnerabilities can be chained to bypass authentication and execute code on vulnerable servers.
A maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server. The security issue is identified as CVE-2026-82222 and affects GiveWP through version 4.16.7.1. It was reported by bug researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform. The GiveWP plugin has more than 100,000 installs and allows collecting donations and managing fundraising campaigns. Patchstack researchers explain that exploiting the vulnerability is possible by chaining three distinct issues: Successful exploitation depends on the attacker having an account on the target site. However, Patchstack says that an exposed unauthenticated registration action allows creating an account even if registration is disabled.
Trump targets foreign-made power grid equipment, citing cyber, sabotage and supply-chain risks to U.S. national security. Executive Order 14420, signed on August 26, targets equipment and technologies that could expose the power grid to sabotage, unauthorized access, malicious remote activity or supply-chain disruption. The timing matters. The White House points to the rapid expansion of data centers, artificial intelligence, advanced manufacturing and defense production as reasons why the United States now depends even more heavily on reliable electricity. A disruption that might once have been treated primarily as an energy problem can now affect defense operations, critical infrastructure, emergency services and large parts of the economy. The order frames the problem in two ways. Foreign-made equipment can introduce a direct cybersecurity risk, including the possibility of hidden digital access mechanisms, while dependence on overseas suppliers can create a second vulnerability if geopolitical tensions or trade disruptions suddenly cut off critical components. The White House’s language is unusually broad when describing the scope of the concern. “NOW, THEREFORE, I, DONALD J. TRUMP, President of the United States of America, find that the situation with respect to the foreign supply of bulk-power system electric equipment constitutes an unusual and extraordinary threat, which has its source in whole or substantial part outside the United States, to the national security, foreign policy, and economy of the United States and hereby declare a national emergency with respect to that threat.” reads the Executive Order 14420. “This threat exists both in the case of individual transactions and when transactions are considered as a class. To deal with this threat, additional steps are required to protect the security, integrity, and reliability of bulk-power system electric equipment used in the United States.” That definition matters because the order isn’t aimed only at a specific piece of hardware from a specific country. It creates a framework under which the Energy Secretary can determine whether particular foreign entities, suppliers, countries or equipment present an unacceptable risk and then restrict transactions involving them. The restrictions apply to the acquisition, importation, transfer or installation of foreign-produced bulk-power equipment when the relevant transaction involves a designated Covered Foreign Entity and meets one of the risk conditions set out in the order. Those conditions include the possibility of sabotage, subversion, unauthorized access, malicious remote action or disruption of the power system and its supply chain. The order also reaches beyond the physical equipment itself. Its scope includes critical components, software, firmware, digital services, maintenance services and remote-access capabilities associated with covered equipment. “the transaction involves bulk-power system electric equipment — or any critical component, software, firmware, digital service, maintenance service, or remote-access capability associated with such equipment — designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a Covered Foreign Entity; and” continues the order. In practical terms, the government isn’t treating a transformer, an industrial controller and the software that manages it as completely separate security questions. That is particularly relevant to industrial control systems. The definition of covered equipment includes remote terminal units, programmable logic controllers, intelligent electronic devices, distributed control systems and safety instrumented systems, alongside transformers, generators, inverters, battery storage systems, protective relays, metering equipment and high-voltage circuit breakers. The order also allows agencies to consider software, firmware, remote access, update mechanisms and other supply-chain dependencies when deciding whether equipment falls within its security concerns. The geographical scope is also worth noting. The order defines the bulk-power system around interconnected transmission infrastructure and generation resources needed for grid reliability, including transmission lines rated at 69 kV or higher. Local electricity distribution facilities fall outside that definition. This isn’t only about equipment that companies might buy tomorrow. The Energy Secretary can also impose conditions on foreign-manufactured or foreign-operated equipment already installed before the order took effect. Depending on the risk, those measures could require operators to identify, isolate, monitor, secure, disconnect, replace or remove equipment. The order specifically requires officials to consider reliability, safety, the availability of secure replacements and continuity of essential services before demanding isolation or replacement. That last point is important because securing a power grid isn’t as simple as unplugging a suspicious device. Removing a component without a suitable replacement can itself create an operational problem. The order therefore leaves room for phased compliance and negotiated mitigation measures rather than assuming that every risky component can disappear overnight. The government also wants to avoid turning security screening into a permanent procurement bottleneck. The Energy Secretary can establish criteria for pre-qualified equipment and vendors, creating a list of products and suppliers that can receive exemptions from the baseline restrictions. At the same time, the order makes clear that pre-qualification doesn’t prevent the government from scrutinizing or restricting a transaction later if circumstances warrant it. The order doesn’t name a specific country as the target. Instead, it defines a Covered Foreign Entity broadly enough to include governments under certain U.S. arms embargoes or sanctions regimes, as well as entities that the relevant U.S. authorities determine are engaged in conduct detrimental to national security or foreign policy. SecurityWeek also noted that the structure resembles earlier Trump-era restrictions on foreign bulk-power equipment, including measures that previously focused on entities associated with China. The order does not mention any country by name. However, its structure is very similar to a 2020 Trump-era order on the U.S. power grid, which later led the Department of Energy to ban companies linked to China. The next phase will be regulatory rather than rhetorical. Within 120 days, the Energy Secretary is expected to issue rules or regulations needed to implement the order, including procedures for identifying covered entities, equipment and countries and for licensing transactions that would otherwise be prohibited. The administration also wants recommendations for changes to federal procurement rules that would give greater weight to national security risks and favor U.S.-manufactured energy infrastructure. Those procurement changes have their own timetable. The Energy Secretary has 180 days to develop recommendations for revisions to the Federal Acquisition Regulation, while the FAR Council would then have 90 days to consider proposing corresponding amendments for public comment. The policy fits into a wider push by the administration to reduce dependence on foreign supply chains for strategically important infrastructure. The Department of Energy said earlier this month that it is working to increase domestic production and availability of critical grid components, pointing to rapid growth in electricity demand and the need to strengthen the grid supply chain. For cybersecurity professionals, however, the most interesting part of the order isn’t the preference for domestic manufacturing. It’s the decision to treat supply-chain exposure, remote access and embedded technology as part of the attack surface of the power grid. That changes the question organizations need to ask about critical equipment. It’s no longer enough to know whether a device has a vulnerability today; operators also need to understand who made it, who controls the supplier, where critical software and firmware come from, who can remotely access the equipment, how updates reach it and what happens if that supply chain suddenly becomes unavailable. The uncomfortable reality is that a power grid compromise doesn’t necessarily begin with someone breaking through the perimeter of a utility network. It can begin much earlier, when an organization buys a component it can’t fully inspect, relies on a remote maintenance channel it doesn’t control, or becomes dependent on a supplier it can’t replace quickly. That’s the security problem Executive Order 14420 is trying to address. The White House has effectively moved part of the grid’s cyber defense line back into procurement, manufacturing and supply-chain decisions. And for critical infrastructure operators, that’s a much harder problem to solve than simply finding another firewall. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, power grid)
A 68-year-old has been sentenced in the U.K. to more than six years in prison for operating an illegal IPTV (Internet Protocol Television) service that generated £980,812 ($1.3 million) over three years. An investigation by the Police Intellectual Property Crime Unit (PIPCU) at the City of London Police found that Milan Ibrahim ran a "sophisticated operation" that provided illegal IPTV services to users in the UK and abroad. According to PIPCU, Ibrahim sold illegal broadcasts from major rights holders such as the BBC, ITV, Sky, the Premier League and the Motion Picture Association. The police seized and shut down all servers they found during the operation, disrupting the illegal streams that users of the IPTV service received. “The investigation revealed that the business operated on 80 servers from premises in Chorley and generated £980,812 over a three-year period,” announced the City of London Police.
AI is accelerating vulnerability discovery, putting pressure on systems built to enrich, prioritize, and remediate flaws at a slower pace. Action1 explains why defenders increasingly need to correlate multiple intelligence sources and turn vulnerability data into faster remediation.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2023-49105 ownCloud Improper Authentication Vulnerability CVE-2026-53362 Linux Kernel Unspecified Vulnerability CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability CVE-2023-49105 (CVSS score of 9.8) is an improper-authentication flaw in ownCloud Server’s WebDAV functionality. An unauthenticated attacker who knows a victim’s username can read, alter, or delete that user’s files when no signing key is configured, because the application can accept pre-signed URLs without properly validating that condition. The issue affects ownCloud core versions 10.6.0 through 10.13.0, before version 10.13.1. Organisations running affected ownCloud instances should treat remediation as urgent, review exposed WebDAV services, and investigate unusual file access, deletion, modification, or downloads. CVE-2026-53362 (CVSS score of 7.8) is an out-of-bounds memory-write vulnerability in the Linux kernel’s IPv6 networking subsystem. A local attacker who can create UDP sockets could exploit an incorrect parameter-length calculation during fragmented IPv6 packet handling to overwrite kernel memory, potentially causing a system crash, corrupting data, or escalating privileges.access. Shortly after the Hugging Face incident became public, OpenAI said its models had identified and exploited a zero-day vulnerability in JFrog’s Artifactory package registry manager. The report also describes a separate incident on July 19. In that case, some AI agents exploited the Linux kernel vulnerability, CVE-2026-53362, to gain higher privileges inside an OpenAI environment. The agents detected that the Linux kernel on their machine was vulnerable, found a public exploit, modified it to work in their environment, and used it to gain root access to the underlying worker node. This allowed them to escape the Artifactory container and move laterally to other parts of the connected environment. CVE-2026-66384 (CVSS score of 5.3) is a path-traversal vulnerability in JFrog Artifactory’s Docker cache handling. Under specific remote-repository conditions, an authenticated user can manipulate a file path and write data outside the intended cache directory, potentially affecting other locations on the Artifactory host. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw CVE-2026-66384 by September 10, while the remaining must be addressed by August, 30, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Hasbro, one of the world's largest toy and game companies, has disclosed that attackers have accessed the personal and financial information of an undisclosed number of employees. Founded in 1923, Hasbro is a publicly traded American multinational entertainment conglomerate on the NASDAQ and owns many brands, including Monopoly, Clue, Nerf, Transformers, Play-Doh, Peppa Pig, Scrabble, Magic: The Gathering, Dungeons & Dragons, and many others. The company has filed data breach notification letters with the Massachusetts Attorney General's Office, but didn't disclose the total number of affected individuals or when the incident was detected. "The information involved varied by individual but may have included your name and one or more additional personal information elements such as email, address, phone number, national ID number, or financial information," Hasbro said.
BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments. Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as its command-and-control backbone. The campaign ran from late September 2025 through early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye. “The campaigns delivered a lightweight Windows batch-script backdoor, dubbed “HOOKEDGE,” via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials.” states the report by Insikt Group. “Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).” The attackers used a fairly old-school trick: macro-enabled Word documents. One of them looked like a real meeting agenda from Spain’s Ministry of the Presidency and appeared shortly after an actual meeting between Spanish and Moldovan officials. The timing was interesting because it came just before Moldova’s September 2025 parliamentary elections. The document looked credible enough to make the phishing attempt believable. The backdoor, called HOOKEDGE, is surprisingly simple. It uses a Windows batch script and relies on two webhooks. One receives commands, while the other sends the stolen data back to the attackers. Every 30 minutes, a scheduled task downloads a command file through Microsoft Edge, runs it and sends the results to another endpoint. The malware uses Edge to make the traffic look like normal web activity, making it harder for security tools to spot. That reliance on a real browser for both tasking and exfiltration is the cleverest part of the whole design. “A notable aspect of HOOKEDGE is its use of msedge.exe for both tasking and exfiltration. By generating network traffic through a legitimate web browser rather than a commonly abused LotL binary (LOLBin) or a custom binary, the malware blends its communications with normal enterprise browsing activity.” continues the report. Recorded Future explains, and that’s really the entire evasion strategy in one sentence: don’t build something exotic, just make your traffic look exactly like an employee checking a website. BlueDelta didn’t build HOOKEDGE from scratch either. It shares deep code and structural overlap with HEADLACE, a backdoor the same group used years earlier, right down to identical JavaScript variable names and the same base64 encoding scheme for automated downloads. “HOOKEDGE’s code and structural design have significant overlap with HEADLACE, a backdoor used by BlueDelta in previous campaigns.” states the report. Recorded Future assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor, maintained by the same operators rather than a fresh tool built by a different team, which fits BlueDelta’s long-documented habit of refining working tradecraft instead of reinventing it. The operation also included a triage mechanism worth understanding on its own. Once a victim showed signs of being worth deeper attention, active communication with the initial webhook endpoints, BlueDelta deployed a second HOOKEDGE payload configured to check in every five minutes instead of thirty, giving operators much faster interactive control over higher-value targets. That two-tier setup also solved a practical infrastructure problem: webhook.site’s free tier caps out at 100 requests per endpoint, so spreading routine and high-priority tasking across separate endpoints kept any single one from getting exhausted mid-operation. BlueDelta kept tuning the operation continuously rather than treating it as a finished product. Beaconing intervals stretched from 30 minutes to 61, deliberately timed to slip past sandbox environments that typically only watch a sample’s behavior for an hour. The group added canary tracking pixels named things like mailopened.jpg and docopened.jpg to monitor exactly when a phishing email got opened versus when the document itself got opened versus when macros actually executed, essentially building analytics for their own phishing funnel. “The malicious document also contains a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. This serves as a document-open “canary,” alerting BlueDelta operators when a victim opens the lure. Later variants used the filename doc.jpg in place of docopened.jpg.” states Insik. “Insikt Group also identified webhooks using the filename mailopened.jpg, indicating that BlueDelta likely used a similar canary mechanism to monitor when recipients opened phishing emails, providing operators with visibility into campaign delivery success before any payload execution.” That kind of detailed tracking of what victims do would look very familiar to a marketing team. The difference is that here the targets are victims, not customers. For defenders, the useful indicators are quite clear. Block macros in documents downloaded from the internet, monitor scheduled tasks that launch scripts from user-writable folders, and flag Microsoft Edge running in headless mode or making automated connections to file-sharing and webhook services that the organization does not normally use. You don’t need sophisticated tools to spot these behaviors. Even a well-configured monitoring system should be able to detect them early. The worrying part is that a persistent, state-backed group can still rely on a small set of behaviors that defenders can identify and block. For defenders, the actionable pieces here are concrete rather than abstract. Block macro execution from documents that arrived over the internet, watch for scheduled tasks spawning script interpreters from user-writable folders, and specifically flag Microsoft Edge running in headless mode or making automated requests to file-hosting and webhook services your organization doesn’t actually use for anything legitimate. None of this requires exotic tooling to catch, which is oddly reassuring: a threat group this persistent and state-backed is still, at its core, relying on the same handful of detectable behaviors that a properly configured monitoring setup would catch on day one. “BlueDelta is likely to continue conducting initial access campaigns against European government and diplomatic organizations in support of Russian intelligence collection. Given the enduring strategic importance of European governance, NATO-related affairs, and diplomatic engagement with former Soviet republics, the intelligence requirements driving this activity are unlikely to diminish in the near term.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BlueDelta)
ServiceNow released security patches for three new maximum-severity AI Platform vulnerabilities that can be exploited in code injection, SQL injection, and privilege escalation attacks. The ServiceNow AI Platform (formerly known as the Now Platform) is an enterprise-grade Platform-as-a-Service (PaaS) that helps integrate AI into core enterprise workflows and powers more than 100,000 enterprise AI apps at 85% of all Fortune 500 companies. In a Thursday advisory, the company said it patched its cloud-based platform against the three critical security flaws (CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820) and advised customers to secure their self-hosted instances. The first is a code injection vulnerability that can allow attackers to execute arbitrary code, the second stems from a code injection weakness that enables them to escalate privileges, and the third allows threat actors to access or modify instance data through SQL injection attacks.
Microsoft released the KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2, which comes with 35 changes, including improvements to the Start menu, taskbar, and Windows search. KB5120998 is a preview update that lets IT administrators test Windows bug fixes, improvements, and new features before they roll out to all users during next month's Patch Tuesday release. However, unlike cumulative updates, monthly optional updates do not include security fixes and provide only quality improvements. After installing the August 2026 preview update, users can move the taskbar to the bottom, top, left, or right side of their screen in Settings > Personalization > Taskbar > Taskbar behaviors > Taskbar position, with most customization settings, like never combining taskbar icons, working in every position.
Confirm this action.
Leaving now will discard your changes.