Microsoft released the KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2, which comes with 35 changes, including improvements to the Start menu, taskbar, and Windows search. KB5120998 is a preview update that lets IT administrators test Windows bug fixes, improvements, and new features before they roll out to all users during next month's Patch Tuesday release. However, unlike cumulative updates, monthly optional updates do not include security fixes and provide only quality improvements. After installing the August 2026 preview update, users can move the taskbar to the bottom, top, left, or right side of their screen in Settings > Personalization > Taskbar > Taskbar behaviors > Taskbar position, with most customization settings, like never combining taskbar icons, working in every position.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2015-3246 is a race condition in Red Hat libuser that could let an authenticated local user corrupt /etc/passwd to cause denial of service or escalate privileges. CVE-2015-5287 is a privilege escalation bug in Red Hat Automatic Bug Reporting Tool that could allow local users with certain permissions to gain higher privileges via a symlink attack on a predictable file. CVE-2019-1068 is a remote code execution flaw in Microsoft SQL Server that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. CVE-2021-23758 (CVSS score not specified in the KEV notice) is a deserialization of untrusted data vulnerability in Ajax.NET Professional that could allow for remote code execution via arbitrary .NET classes. CVE-2022-0995 (CVSS score not specified in the KEV notice) is an out-of-bounds memory write vulnerability in Linux Kernel that could allow a local user to gain privileged access or cause a denial of service on the system. CVE-2026-8452 (CVSS score not specified in the KEV notice) is an improper restriction of operations within the bounds of a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway that could lead to denial-of-service and has been observed under active exploitation in the wild. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, while the remaining must be addressed by September 9, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
A cyberattack on Manchester Airports Group exposed data of 8.7 million customers across Manchester, Stansted, and East Midlands airports. Manchester Airports Group disclosed that an unauthorised third party accessed customer data belonging to approximately 8.7 million people across three of England’s busiest airports: Manchester, London Stansted, and East Midlands. “Manchester, London Stansted and East Midlands airports have been hit by a cyber-attack in which hackers accessed the data of about 8.7 million customers.” reads the report published by The Guardian. “The incident involved data related to “car park, lounge and fast-track bookings and in-airport wifi sign-ups”, and the hackers obtained email addresses, phone numbers, vehicle registration numbers and postcodes, said Manchester Airports Group (MAG), which operates the three hubs.” MAG says it learned about the incident on Tuesday, August 25, after attackers breached the system over the weekend. The affected data included car park bookings, lounge and fast-track security reservations, and airport Wi-Fi sign-ups. Attackers accessed email addresses, phone numbers, vehicle registration numbers, and postcodes. The system did not store bank or payment details. According to MAG, most of the 8.7 million affected customers only lost their email addresses, while the impact varies depending on which services they used. The attack did not disrupt airport operations or flights. As a precaution, MAG temporarily suspended its Manage My Booking service, but all existing reservations remain valid. Customers who need to change a booking within the next 72 hours can use a dedicated phone line. “We would urge you to be particularly cautious of unexpected emails, calls or text messages claiming to be from us. We will never contact you unexpectedly to ask for payment or banking information. We apologise for any inconvenience or concern this may cause.” reads the email sent by Stansted to affected customers. That warning is relevant because the combination of an email address, a phone number, and the knowledge that someone recently made a parking or lounge booking gives a convincing starting point for a targeted phishing message. Attackers don’t need payment data if they can impersonate the airport convincingly enough to obtain it themselves. The timing adds pressure. The attack landed during the peak summer travel season, with millions of families flying back into the UK before the school year begins. The three airports combined handled around 54 million passengers last year, and MAG recently reported a record 66 million passengers across its network. The scale of the data exposure reflects the sheer volume of ancillary services these airports sell, and how much personal data those services routinely collect. The wifi registration system is the detail worth noting: signing into airport wifi typically requires a name, email, and phone number at minimum, and that information now belongs to whoever executed this breach. MAG says it quickly contained the incident, brought in external cybersecurity experts and notified the relevant authorities. No group has claimed responsibility, and investigators have not publicly linked the attack to any specific actor. The incident adds to a growing list of cyberattacks against UK infrastructure. Earlier in August, Iran-linked hackers took a British power plant offline for four days, marking the first confirmed case of Iranian actors shutting down a UK generator. Last year, attacks disrupted production at Jaguar Land Rover and targeted Marks & Spencer, Harrods and the Co-op. Heathrow also faced flight delays and cancellations after attackers disrupted check-in and boarding systems used by several European airports. MAG’s breach adds further pressure on UK infrastructure operators to strengthen their cyber defenses. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, UK Airport Operator MAG)
cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM. cPanel described the issue as a critical security vulnerability and said that an
PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company has released an emergency patch for v25 and v26 to address the issue. It said it's "aware of confirmed customer incidents and is treating this matter with the highest priority." An
Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. These campaigns, per Recorded Future Insikt Group, have led to the deployment of a previously undocumented backdoor dubbed HOOKEDGE, a lightweight Windows batch script that's distributed via
New details about the July attack on Hugging Face reveal that hundreds of AI agents driven by OpenAI’s internal IM1 model coordinated the compromise through an unauthorized message board. Last month, Hugging Face disclosed that autonomous AI agents exploited two vulnerabilities in its dataset-processing pipeline to execute code, steal cloud and cluster credentials, and move laterally across its production infrastructure. OpenAI later confirmed that its models escaped an ExploitGym evaluation environment through a zero-day vulnerability in a locally hosted instance of JFrog's Artifactory package manager that was connected to the internet. The agents searched online for benchmark solutions and breached the Hugging Face platform using exposed credentials and additional vulnerabilities. OpenAI's investigation, validated by CrowdStrike and an independent assessment by METR and Redwood Research, found that rogue activity started in May.
Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications. Dark Caracal is back with new malware and the same hunting grounds. Arctic Wolf Labs researchers link a June 2026 intrusion against a communications organisation in Venezuela to the Lebanon‑linked espionage group, and says it deployed a previously undocumented Go‑based framework called GoCaracal alongside an updated Bandook backdoor. Dark Caracal is an APT group associated with the Lebanese General Directorate of General. In past campaigns, it targeted entities in Singapore, Cyprus, Chile, Italy, the USA, Turkey, Switzerland, Indonesia, and Germany. “In June 2026, Arctic Wolf Labs investigated a targeted intrusion affecting a communications organization in Venezuela. We assess with medium confidence that this activity is linked to Dark Caracal, a cyberespionage group associated with Lebanon’s General Directorate of General Security (GDGS) that has historically targeted governments, businesses, journalists, and activists.” reads the report published by Arctic Wolf. “GoCaracal supports separate lightweight and extended build profiles derived from a shared architecture. Both were observed in the same intrusion.” The delivery method will feel familiar to anyone who has followed the group’s recent campaigns. Phishing emails with financial or tax lures drop weaponised SVG attachments, which redirect victims through URL shorteners to attacker‑controlled sites that serve the real payload. When a recipient opens one of these SVG files, the embedded content directs the browser to a shortened URL that resolves through a redirector to getpdfdigital[.]cloud, a known attacker site used to stage malicious payloads. The site then delivers a 7‑Zip archive containing a lightweight Go implant that Arctic Wolf identifies as part of the GoCaracal framework. “While Arctic Wolf did not recover the original phishing email or SVG attachment associated with the intrusion, the artifact’s financial and tax-themed filename, the campaign’s established delivery pattern, and more than 100 related SVG files found communicating with the same malicious hosting site support our assessment that the file was delivered through phishing.” continues the report. That initial implant is not the endgame. It establishes a foothold and then pulls in a Delphi loader carrying Bandook and a more capable, extended GoCaracal build with broader post‑compromise features. The two profiles split the work. The lightweight build handles host profiling, encrypted C2, remote shell, payload download and execution, and shellcode injection. The extended build adds file management, browser credential and cookie theft, keylogging, targeted file search, WebRTC remote desktop, hidden browser sessions, a SOCKS5 proxy and persistence mechanisms. Arctic Wolf traced 249 related samples from January to July 2026 and sees a clear development arc. GoCaracal started as a focused access implant, then became modular, then gained broad post‑compromise capabilities, and finally added an Ethereum‑based C2 fallback while keeping both profiles in play. “Analysis of 249 related samples revealed two GoCaracal build profiles: a lightweight implant designed to establish access and deliver additional payloads, and an extended build intended for sustained intelligence collection and interactive control.” states the report. “The extended build also supports an Ethereum smart-contract fallback that allows operators to retrieve replacement command-and-control (C2) infrastructure without redeploying the malware.” That fallback is the most interesting twist. The extended GoCaracal configuration can include an Ethereum smart‑contract address alongside the usual HOST and PORT values. If the malware cannot reach its primary C2 after repeated tries, it calls a public Ethereum JSON‑RPC endpoint, reads a stored value from the contract, and updates its in‑memory C2 address before retrying. “An extended GoCaracal variant uses Ethereum smart contracts as a fallback source for replacement C2 addresses.” states Artic Wolf “Blockchain activity indicates that the capability was tested and operationalized rather than merely included as dormant code.” Ethereum does not carry the malware’s entire command channel. Instead, GoCaracal uses it as a backup source for a new C2 address. This lets the attackers change the server the malware contacts without releasing a new version. Arctic Wolf found a custom Solidity contract called BulletproofC2 that stores a changeable C2 address. Only its owner can update it. Transaction records show that the attackers changed the address to a public IP, suggesting they tested and used the system. The same wallet also deployed similar contracts on Ethereum’s Sepolia testnet before moving some to the mainnet. The contracts contained both public and private IP addresses, suggesting the attackers first tested the mechanism before using it operationally. GoCaracal is not replacing Bandook, at least not yet. Arctic Wolf says the two families now run in parallel, with GoCaracal augmenting the group’s existing toolkit and potentially reducing future reliance on Bandook, but current evidence does not show a full swap‑out. The June 2026 Bandook sample shows deliberate anti‑analysis tweaks. Sequential command identifiers like @0001 through @0136 were replaced with randomised strings, and plugin export names were obfuscated with generic labels, preserving functionality while weakening signature‑based detection built on older naming conventions. The wider campaign still looks like Dark Caracal. Arctic Wolf identified seven related Spanish‑language, document‑themed domains used to deliver malicious SVGs and downstream payloads, with two previously linked to the group and a new one registered in July 2026 observed delivering GoCaracal. Infrastructure is compartmentalised. Of 24 unique C2 addresses extracted from GoCaracal samples, 23 sat on AEZA Group‑operated networks, while Bandook C2 addresses were hosted on AlexHost, a provider previously associated with Dark Caracal. That separation likely limits the blast radius if one provider gets hit. Geographically, the focus remains Latin America. Arctic Wolf sees related artifacts and infrastructure tied to Brazil, Ecuador, Chile, Colombia, El Salvador and Uruguay, and assesses broader regional activity with moderate confidence while continuing to map the scope. “Taken together, the findings show Dark Caracal is preserving familiar targeting and delivery practices while modernizing their malware and infrastructure.” concludes the report. “Dark Caracal’s continued use of established tooling such as Bandook, combined with the introduction of GoCaracal and its separate C2 footprint, suggests an expanding and increasingly compartmentalized toolkit rather than a wholesale change in operational strategy.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, malware)
PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company says it is aware of confirmed attacks on customers and is urging organizations with Internet-exposed PaperCut Application Servers to immediately restrict access to the web interfaces to trusted IP addresses. "PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF," reads an urgent security advisory published Thursday. "We are aware of confirmed customer incidents and are treating this matter with the highest priority." PaperCut says the vulnerability affects all versions of PaperCut NG and MF, but has not shared details about the flaw or how it is being exploited.
Australian police charged two men linked to TeamPCP over malware hidden in open-source code that stole 500,000+ credentials from 1,000+ organizations. Australian police have charged two men from Western Australia over a global cybercrime operation that allegedly hid malicious code in open-source software and used it to steal data from thousands of organisations. “Two West Australian men have been charged following a joint investigation between the AFP and Western Australia Police Force (WAPF), working in parallel with the Federal Bureau of Investigation (FBI), into a sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses.” states AFP. “The AFP charged the men yesterday (26 August, 2026) with a combined total of 14 offences after executing search warrants in Perth with WAPF, and the assistance of the FBI.” The Australian Federal Police, the Western Australia Police Force and the FBI executed search warrants in Perth on 26 August 2026 and arrested a 21-year-old from Cottesloe and a 23-year-old from Mandurah. They face a combined total of 14 charges covering unauthorised data modification, possession and supply of data for computer offences, and dealing with proceeds of crime. Police say the pair were principal participants in a syndicate known as TeamPCP, which allegedly inserted malicious code into software hosted on public repositories and then let other developers pull it in without knowing. Infected components ended up in systems across government, academia and the private sector, giving the group a way to steal credentials and other sensitive material at scale. “Parallel investigations started in April, 2026, after the AFP and FBI received information from multiple cyber threat assessment companies regarding a syndicate that allegedly inserted malicious code into software available on an open-source repository, which was then unwittingly used by other developers.” continues AFP. “Police will allege infected software was then distributed into computer systems at other organisations across government, academia and the private sector. The software allegedly enabled the syndicate to infiltrate those organisations to steal or harvest sensitive data, including user credentials and authentication materials.” The numbers are not small. Investigators estimate the malicious code potentially compromised more than 1,000 organisations worldwide, enabling the theft of over 500,000 credentials and the exfiltration of at least 300 gigabytes of data. Remediation costs so far run into the hundreds of millions of dollars. TeamPCP is behind multiple supply chain attacks, in the past, they targeted PyPI packages and NPM repositories, and most recently the “Mini Shai-Hulud” campaign also caught two OpenAI employees. The pattern is consistent: go after the tools developers trust, poison the supply chain, and let the downstream damage multiply. The confirmed list of modified tools includes Trivy, a widely used container vulnerability scanner; KICS, a static analysis tool for infrastructure-as-code; LiteLLM, a popular library for routing requests across AI model APIs; and the Telnyx Python SDK. These aren’t niche utilities. They’re commonly integrated into enterprise CI/CD pipelines, cloud infrastructure workflows, and security scanning processes. Hitting them means hitting a large number of organizations simultaneously through a single poisoned update. The group also deployed four distinct malware families. CanisterWorm harvested cloud access tokens, credentials, and API keys for AWS, GCP, and Azure. SANDCLOCK extracted AWS credentials, Kubernetes ServiceAccount tokens, local environment variables, and cryptocurrency wallet data. Mini Shai-Hulud was a self-replicating worm designed to spread across both npm and PyPI registries. Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files. The worm component is the part that deserves particular attention. Mini Shai-Hulud and its Miasma variant didn’t just infect the initial target and stop. They spread across open-source package registries autonomously, harvesting credentials and poisoning configuration files as they went. The FBI confirmed two GitHub repository names used for exfiltration: tpcp-docs and docs-tpcp. If either of those repository names appears in your GitHub organization, the worm created it using stolen credentials. TeamPCP’s method was straightforward and effective: inject malicious code into legitimate software packages, push the trojanized versions through normal distribution channels, and wait for CI/CD pipelines to pull them in automatically. The modified tools installed credential-stealing malware and persistent backdoors without any visible sign that anything had changed. “These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide,” Assistant Director Leatherman said. “We are proud to work with the Australian Federal Police and the Western Australia Police Force to impose cost on criminal actors and combat the growing threat of software supply-chain attacks.” The charges show how serious the alleged operation was. The 21-year-old faces several charges, including changing data without authorization, possessing and supplying data for computer crimes, failing to comply with a production order, and handling at least A$100,000 in criminal proceeds. The 23-year-old faces similar hacking charges, with maximum penalties ranging from three to 20 years. Police seized electronic devices and other items from properties in Cottesloe, Hamilton Hill and Mandurah. Investigators are now examining a large amount of data and have not ruled out further arrests or charges. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Confirm this action.
Leaving now will discard your changes.