Extortion group FulcrumSec claims they stole 86GB of Manchester Airports Group data after finding API credentials exposed in client-side JavaScript. Manchester Airports Group (MAG) disclosed a data breach on August 27 affecting customers of Manchester, London Stansted, and East Midlands airports. Two days later, BleepingComputer reports the extortion group FulcrumSec claimed responsibility, saying it stole roughly 86GB of data, considerably more detailed than what MAG’s original disclosure suggested. MAG’s own statement describes a relatively limited set of exposed data. It says the breach affected car park, lounge, Fast Track bookings, and airport WiFi registrations, exposing email addresses, phone numbers, vehicle registrations, and postcodes. MAG disclosed that the data breach impacted 8.7 million customers, however, the company says most of those customers had only their email addresses exposed. FulcrumSec tells a different story. The group shared samples with BleepingComputer that included a 21.5GB export of Manchester customer data, with personal identifiers, historical booking details, and marketing information. BleepingComputer checked one record against a real traveler’s purchase history and found matching Fast Track bookings, arrival times, terminal information, and payment amounts. The alleged way into the system is particularly concerning. FulcrumSec says it found airport-specific Iterable API credentials inside client-side JavaScript. That code runs in users’ browsers, so anyone inspecting the website with developer tools could potentially see those credentials. “The group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.” states the report. These records allegedly contain dates, times and booking information linked to personally identifiable information. FulcrumSec says it intends to publish the stolen data and a technical account of the intrusion. If the claim is accurate, attackers did not need a highly sophisticated technique. They simply found sensitive API credentials exposed in code that the website sent directly to customers’ browsers.” The most concerning specific claim is nearly 200,000 records tied to upcoming travel through the rest of 2026, complete with dates, times, and booking details linked to identifiable individuals. BleepingComputer couldn’t independently verify that number or the full scope of what was actually taken, and MAG declined to directly address FulcrumSec’s specific claims when asked, instead pointing to its existing statement that affected customers with upcoming bookings had already been contacted. MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, a spokesperson said, without engaging with the 86GB figure or the exposed-credentials claim directly. FulcrumSec plans to publish the stolen data but may redact upcoming travel records because of the risk of real-world harm. UK postcodes can identify very small groups of addresses, and combined with vehicle registrations, parking dates and booking details, the data could enable highly convincing phishing messages targeting people with upcoming trips. UK postcodes make this exposure sharper than the equivalent breach might be in the US. Unlike American ZIP codes covering broad delivery areas, a full UK postcode typically identifies a small cluster of neighboring addresses, sometimes a single property, according to the Office for National Statistics. Combined with vehicle registrations, parking dates, and specific booking references, that’s more than enough raw material for a phishing message referencing a real upcoming trip that would be very hard to distinguish from a genuine MAG communication. Security researchers commenting on the broader incident have flagged a supply-chain angle worth watching. Airport operations increasingly run through third-party platforms for booking, parking, and loyalty services rather than systems the airport itself directly controls, and Iterable, the marketing platform whose API credentials FulcrumSec claims to have abused, is exactly that kind of outsourced dependency. This also isn’t aviation’s first bad year: a September 2025 ransomware attack on Collins Aerospace‘s check-in software had already grounded systems at Heathrow, Brussels, and Berlin, meaning UK and European aviation infrastructure has now taken two significant hits inside twelve months. MAG says no payment card or banking data was exposed, however, travelers who recently booked parking, lounge access or Fast Track should assume more travel data may be exposed and treat messages citing real booking details with caution. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Manchester Airports Group (MAG))
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor FTP Banners: The New Dead Drop Resolver Delivering Novel RATs The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads SLEEPWALKER: A Passive Backdoor With Its Own Command Language Tortoiseshell: New Toolset and Operational Infrastructure Exposed Dark Caracal Reloaded: New Malware, Same Hunting Grounds Cambodia-focused cluster uses multistage infection chain with localized lures BlueDelta Targets Defense and Diplomacy with HOOKEDGE XAI-Guided Graph-Based Feature Engineering and Heterogeneous Ensemble Learning for Android Malware Detection BotScan: An adaptive active probing approach for identifying live IoT Botnet C2 servers at scale EGAMA-RC: Risk-Calibrated Evidence-Gated Adaptive Malware Analysis for Robust and Interpretable Memory-Forensic Triage Survival of~the~Stealthiest: Evolving Low-Entropy Ransomware via~Genetic Algorithms Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
PaperCut servers are under active attack, while 47% of tracked installations still run unpatched versions vulnerable to remote code execution. PaperCut, the print management software running in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers. Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install. “Observed activity focused on system discovery. We have not observed secondary malware, further command-and-control traffic, or additional persistence or post-exploitation from the recovered payload.” reads the report published by Hutress. “Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG 25.0.11.75758 server. We have reached out to PaperCut to coordinate with them on continued vulnerability analysis.” The vulnerability starts with a simple authorization mistake in PaperCut. An attacker can send a specially crafted request that makes the server display one page while actually running an action from another page. PaperCut checks the permissions for the page it displays instead of the action it actually performs. This flaw, tracked as CVE-2026-81578, can let an attacker change the server’s configuration without logging in. That access can then be combined with a second flaw, CVE-2026-82078. The issue in PaperCut’s database utilities can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server. The real-world attacks Huntress observed were almost quaint compared to the severity of the bug itself. One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver, basic commands to identify the compromised account and Windows version. A second incident added tasklist to the mix, checking what processes were running, but neither case showed evidence of deeper persistence, secondary malware, or follow-up command-and-control traffic. The activities observed by Huntress read like reconnaissance rather than a finished operation, the kind of activity that usually precedes something worse. The forensic trail attackers left behind is genuinely useful for defenders, and it’s worth understanding exactly what it looks like. Investigators found a malicious Java class file dropped directly into PaperCut’s own installation directory, capable of running commands, writing results to a temporary file, and then deleting both the output and the server’s own log file to cover its tracks. One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn, an oddly named database directory that PaperCut’s own investigation guidance now flags as a high-confidence indicator of compromise. “After exploitation, the .class file deletes its own Udydn.out file, as well as the server’s server.log file. The server.log file recorded the execution of this code in a log line that contains the string DB URL: jdbc:derby:memory:pwn that immediately followed the large encoded data blob’s appearance in the log.” continues the report. “We observed /data/internal/derby.log was not deleted, and it contains one insightful breadcrumb” PaperCut’s patching process is more complicated than simply installing an update. The company released an emergency patch first, then issued another update less than 24 hours later after additional testing. Fixes for version 24 were still being developed when the report was published. The timing is important because the second confirmed attack targeted a server running version 24, before the fix for that version was available. Huntress successfully recreated the exploit chain in a test environment. From a remote system, the researchers were able to trigger code execution without authentication. The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level. The bigger concern involves older versions. Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions. Huntress is working with PaperCut to analyze the vulnerability and coordinate the response. If your organization runs one of these older versions, the safest option for now is to remove the PaperCut Application Server from the public internet. Restrict access through a VPN or a trusted internal network until a proper fix becomes available. If your PaperCut server has been publicly accessible recently, installing the patch should not be the end of your response. It should be the start of an investigation. Before restarting the server, save its logs and configuration files so you don’t lose important evidence. Check whether pc-app.exe has launched a command shell or tools such as tasklist, and look for unexpected .class files in the server’s lib directory. Even a short two-minute reconnaissance attempt could be an early sign of a more serious attack. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Philippine nuclear and naval targets)
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Hack One Robot, Reach the Next: Unitree G1 Security FlawsRhysida Ransomware Group Targets Berlin Government Ahead of VotePhilippine Nuclear and Naval Targets Hit by Suspected Chinese OperatorLove Electric Breach: 877,000 Driver Records Offered for $600Trump Targets Foreign Technology in New U.S. Power Grid Security OrderU.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalogRussian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic OrganizationsPaperCut Zero-Day Under Active Attack: Emergency Patch ReleasedU.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalogCyberattack on UK Airport Operator MAG Exposes Data of 8.7 Million Customers Across Three AirportsDark Caracal Deploys New Go Malware With Ethereum-Based C2 FallbackAustralian Police Charge Two Over TeamPCP Credential TheftMeta to Pay Up to $18B Over Teen Social Media UseCISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers DoOpenAI banned Russian ChatGPT accounts backing covert influence operationCISA Red Team Fully Compromised Two Critical Infrastructure OrgsFBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical InfrastructureU.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog88 ID Verification Breaches Show the Cost of Collecting Identity DataWhatsApp Adds Stronger Security as Passkeys Hit 1 BillionOperation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global ScamsNorway ’s Digital Government Infrastructure Hit by a new DDoS AttackWhen the Algorithm Fires You: Uber Faces €825M FineTwo CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as VulnerableU.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalogFake Minecraft Sites Are Still Spreading WeedHack After C2 TakedownCybercriminals Turn GTA VI Leaks Into Malware BaitSlovakia Warns of Cyber Risks in Road Speed CamerasTikTok Settles U.S. Child Privacy Case for $400 MillioniAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password ResetUK Power Plant Disabled for Four Days by Iran-Linked Hackers, Concurrent with US Water AttacksZero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection International Press – Newsletter Cybercrime iAuthFlow v2 Enrolls Google Passkeys That Survive Password Resets Fake GTA VI ISO circulates on the internet a few days after leak, internet sleuths claim 113GB download is padded malware Taiwan charges 9 over illegal AI server exports to China, including Nvidia and Super Micro staff Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly 58 arrests in global effort to dismantle West African organized crime groups Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain RTM Locker interview: a ransomware actor on the RaaS market Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate Love Electric driver data for sale: NI, licence numbers Ransomware group says it stole Berlin data, offers it for auction Malware FTP Banners: The New Dead Drop Resolver Delivering Novel RATs The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads SLEEPWALKER: A Passive Backdoor With Its Own Command Language Hacking One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin A Tale of Two SOCs: Insights From Two Red Team Assessments Three UK airports hit by cyber-attack with data of 8.7m customers accessed New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access PaperCut Releases Emergency Patch for Exploited Zero-Day Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities The Hugging Face incident and the road ahead Power Leak: Amazon Kiro IDE Prompt Injection Enables Data Exfiltration Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users’ Reservations in Tests UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range PaperCut Actively Exploited: A Pre-Auth RCE Chain Intelligence and Information Warfare Iranian hackers shut down UK power plant Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor Digdir stabilizes solutions after cyberattack Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure The infrastructure quartermaster: inside a China-nexus state enablement model Disrupting a new covert influence campaign from Russia Tortoiseshell: New Toolset and Operational Infrastructure Exposed Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day Dark Caracal Reloaded: New Malware, Same Hunting Grounds Cambodia-focused cluster uses multistage infection chain with localized lures BlueDelta Targets Defense and Diplomacy with HOOKEDGE Cybersecurity Warning about the risks of road meters One billion people are now protected with passkeys on WhatsApp, plus more account security features An ID Check Breach Timeline: 2011–2026 Internet Exposure Reduction Guidance Meta agrees to pay $18 billion to settle US lawsuits over children’s social media addiction DECLARING A NATIONAL EMERGENCY TO SECURE THE UNITED STATES BULK-POWER SYSTEM Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex
Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds. If you use Claude, you're actually getting a 17% reduction compared to what you have today. Claude Code currently has a temporary 50% increase in weekly limits, which Anthropic says will remain in place until September 14. "Starting September 14, we're permanently raising standard weekly limits in Claude Code by 25% for Pro, Max, Team, and seat-based Enterprise plans," Anthropic wrote on X. "Until then, the current 50% increase will be in place." It's a clever way to frame words, as it almost sounds like you're winning as a customer, but you're not, and it's a downgrade. If Claude Code's original weekly allowance was 100, the temporary boost gives you 150 today. On September 14, that drops to 125.
Berlin ‘s government faces a Rhysida ransomware attack weeks before elections, with officials refusing to pay despite a claimed 5.79 TB data theft. Berlin’s state government confirmed this week it’s dealing with an extortion attempt following an August cyberattack on the city-state’s administrative network, and officials have already refused the requested ransom. The ransomware group Rhysida claimed responsibility on its leak site August 28, posting an entry titled simply “Berlin, Germany” and claiming 5.79 terabytes of data across roughly 1.44 million files, with personal information on 12,076 individuals allegedly included. Rhysida claims it stole 5.79 TB of data, covering around 1.44 million files. The alleged dataset includes: Personal data: 12,076 individuals, 16,389 email addresses, 11,963 phone numbers and 148 IBANs. Sensitive records: more than 5,000 personnel files, more than 5,000 administrative-offence files, payroll data and leadership information. Credentials: plaintext passwords and credentials for systems including GebäudAtlas, the ePayment PAYONE database and Z_ADMIN accounts. Government and legal material: disciplinary proceedings, court cases, supervisory documents, NDA records and Bundesrat committee protocols. Classified information: data related to classified-material handling and documents allegedly containing state secrets. Critical infrastructure: vulnerability analyses concerning Berlin’s water supply. Identity documents: passports and ID cards from personnel records. Other material: contracts, financial documents, HR records, infrastructure files, health data, password stores and SQL/PST archives. The group also claims that the material could involve violations of GDPR, German classified-information rules, criminal law and KRITIS/BSIG requirements. These are Rhysida’s claims and have not been independently verified. The timing makes this attack especially sensitive. Berlin will elect its state parliament on September 20, less than a month after the breach, so an attack on government systems just before the vote was bound to raise questions. Interior Senator Iris Spranger said the election remains secure and that, so far, the attackers haven’t taken any election-related data. Security officials support that assessment. Broadcaster RBB first reported on Thursday that Berlin had received ransom demands. “The state of Berlin will not submit to extortion,” Berlin Mayor Kai Wegner and Berlin’s interior senator, Iris Spranger, said in a joint statement on Friday, before the ransomware group claimed the attack on their Tor data leak site. That position follows long-standing advice from US federal agencies, which warn that paying a ransom doesn’t guarantee data recovery and can encourage more attacks. Saying no to the ransom is one thing; dealing with the consequences if the attackers publish the stolen data is another. Berlin first disclosed the compromise on August 17, isolating the Senate Department for Mobility, Transport, Climate Protection and Environment along with a second department from the network. Forensic investigators later found the actual data exfiltration happened earlier than the public disclosure, sometime between August 7 and August 12, with the affected department having flagged an initial outflow internally on August 7, a full week before the network got cut off. That gap between first internal detection and actual network isolation is the kind of detail that tends to get scrutinized hardest once the immediate crisis passes. Rhysida isn’t a new name to anyone tracking ransomware against government targets. The group has claimed roughly 280 victims since emerging in 2023, according to tracking services cited by Reuters, including nine in Germany alone and headline targets like the British Library and Chile’s army. Roughly half its victims sit in the US, with the UK, Canada, and Italy rounding out the next tier, a spread that suggests Rhysida isn’t picking targets based on geography so much as opportunity. A joint advisory from CISA, the FBI, and the Multi-State Information Sharing and Analysis Center, first published in November 2023, lays out exactly how Rhysida typically gets in: compromised VPN credentials at organizations without multi-factor authentication, exploitation of the Zerologon vulnerability that Microsoft patched back in 2020, and old-fashioned phishing. None of those entry points are exotic or new, which is precisely the point; Rhysida doesn’t need novel techniques when so many organizations still haven’t closed gaps that have been publicly known for years. Berlin reconnected all Senate departments to the network on August 23, but forensic teams are still checking the systems. The state’s data protection commissioner and Germany’s federal cybersecurity agency, the BSI, are following the investigation. As of publication, neither Berlin’s data protection office nor the Senate Chancellery had given specific advice to the roughly 12,000 people whose data Rhysida claims to have stolen. If you’re among them and haven’t received any official message yet, don’t assume that means you’re safe. Investigators are still working to establish exactly what the attackers accessed and took. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Rhysida Ransomware)
Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS score: 9.8) - An authentication bypass flaw in
Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.
New research reveals that AI safety refusal lives in a thin neural layer, highlighting the critical need for external, multi-layered security. The post Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety appeared first on Unit 42.
Confirm this action.
Leaving now will discard your changes.