A 68-year-old has been sentenced in the U.K. to more than six years in prison for operating an illegal IPTV (Internet Protocol Television) service that generated £980,812 ($1.3 million) over three years. An investigation by the Police Intellectual Property Crime Unit (PIPCU) at the City of London Police found that Milan Ibrahim ran a "sophisticated operation" that provided illegal IPTV services to users in the UK and abroad. According to PIPCU, Ibrahim sold illegal broadcasts from major rights holders such as the BBC, ITV, Sky, the Premier League and the Motion Picture Association. The police seized and shut down all servers they found during the operation, disrupting the illegal streams that users of the IPTV service received. “The investigation revealed that the business operated on 80 servers from premises in Chorley and generated £980,812 over a three-year period,” announced the City of London Police.
Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. The code injection vulnerability (CVE-2026-60004) targeted in these attacks was reported by Salesforce security researcher Shai Rod, and it allows authenticated attackers to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint. While successful exploitation requires repository write access to repositories hosted on vulnerable servers, Gitea comes with self-registration enabled by default, allowing unauthenticated attackers to register an account, create a new repository, and trigger the vulnerability without prior credentials.
Hasbro, one of the world's largest toy and game companies, has disclosed that attackers have accessed the personal and financial information of an undisclosed number of employees. Founded in 1923, Hasbro is a publicly traded American multinational entertainment conglomerate on the NASDAQ and owns many brands, including Monopoly, Clue, Nerf, Transformers, Play-Doh, Peppa Pig, Scrabble, Magic: The Gathering, Dungeons & Dragons, and many others. The company has filed data breach notification letters with the Massachusetts Attorney General's Office, but didn't disclose the total number of affected individuals or when the incident was detected. "The information involved varied by individual but may have included your name and one or more additional personal information elements such as email, address, phone number, national ID number, or financial information," Hasbro said.
PaperCut warns that a zero-day in NG and MF is being exploited. The company already release emergency patches to address it. PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products. The flaw has no CVE yet, and the company has not released technical details. PaperCut issued emergency patches on Friday and urged customers to install them immediately. It also recommends disconnecting application servers from the internet and limiting access to trusted IP addresses. “If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).” states the advisory. “Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.” The company confirmed incidents affecting customers and said its investigation is still underway. “PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.” reads the advisory. “We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.” PaperCut has not yet disclosed details about the vulnerability, the attack method, or the attackers behind the campaign. So far, the company has identified several indicators of compromise: Intrusion-detection, endpoint-security, or network-monitoring tools may flag suspicious activity involving the PaperCut Application Server, especially activity linked to pc-app.exe. Attackers may delete, truncate, or alter PaperCut server.log files to hide their activity. The server.log file may contain these entries: ERROR No suitable driver found for jdbc:no:x ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST Users running PaperCut should check their systems for these signs of compromise. In May 2023, Microsoft warned that Iran-linked APT groups were exploiting another flaw, tracked as CVE-2023-27350, in attacks against PaperCut MF/NG print management servers. The CVE-2023-27350 flaw is a PaperCut MF/NG Improper Access Control Vulnerability. PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of SYSTEM. In April 2023, Microsoft linked the attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to a financially motivated threat actor tracked as Lace Tempest (formerly DEV-0950). The group is known to be an affiliate of the Clop ransomware RaaS affiliate, it has been linked to GoAnywhere attacks and Raspberry Robin infection. Since April 13, 2023, Lace Tempest added the PaperCut exploits to its arsenal. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Zero-Day)
A cyberattack on Manchester Airports Group exposed data of 8.7 million customers across Manchester, Stansted, and East Midlands airports. Manchester Airports Group disclosed that an unauthorised third party accessed customer data belonging to approximately 8.7 million people across three of England’s busiest airports: Manchester, London Stansted, and East Midlands. “Manchester, London Stansted and East Midlands airports have been hit by a cyber-attack in which hackers accessed the data of about 8.7 million customers.” reads the report published by The Guardian. “The incident involved data related to “car park, lounge and fast-track bookings and in-airport wifi sign-ups”, and the hackers obtained email addresses, phone numbers, vehicle registration numbers and postcodes, said Manchester Airports Group (MAG), which operates the three hubs.” MAG says it learned about the incident on Tuesday, August 25, after attackers breached the system over the weekend. The affected data included car park bookings, lounge and fast-track security reservations, and airport Wi-Fi sign-ups. Attackers accessed email addresses, phone numbers, vehicle registration numbers, and postcodes. The system did not store bank or payment details. According to MAG, most of the 8.7 million affected customers only lost their email addresses, while the impact varies depending on which services they used. The attack did not disrupt airport operations or flights. As a precaution, MAG temporarily suspended its Manage My Booking service, but all existing reservations remain valid. Customers who need to change a booking within the next 72 hours can use a dedicated phone line. “We would urge you to be particularly cautious of unexpected emails, calls or text messages claiming to be from us. We will never contact you unexpectedly to ask for payment or banking information. We apologise for any inconvenience or concern this may cause.” reads the email sent by Stansted to affected customers. That warning is relevant because the combination of an email address, a phone number, and the knowledge that someone recently made a parking or lounge booking gives a convincing starting point for a targeted phishing message. Attackers don’t need payment data if they can impersonate the airport convincingly enough to obtain it themselves. The timing adds pressure. The attack landed during the peak summer travel season, with millions of families flying back into the UK before the school year begins. The three airports combined handled around 54 million passengers last year, and MAG recently reported a record 66 million passengers across its network. The scale of the data exposure reflects the sheer volume of ancillary services these airports sell, and how much personal data those services routinely collect. The wifi registration system is the detail worth noting: signing into airport wifi typically requires a name, email, and phone number at minimum, and that information now belongs to whoever executed this breach. MAG says it quickly contained the incident, brought in external cybersecurity experts and notified the relevant authorities. No group has claimed responsibility, and investigators have not publicly linked the attack to any specific actor. The incident adds to a growing list of cyberattacks against UK infrastructure. Earlier in August, Iran-linked hackers took a British power plant offline for four days, marking the first confirmed case of Iranian actors shutting down a UK generator. Last year, attacks disrupted production at Jaguar Land Rover and targeted Marks & Spencer, Harrods and the Co-op. Heathrow also faced flight delays and cancellations after attackers disrupted check-in and boarding systems used by several European airports. MAG’s breach adds further pressure on UK infrastructure operators to strengthen their cyber defenses. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, UK Airport Operator MAG)
Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC. The flaws are tracked as CVE-2026-76639 and CVE-2026-76640, with the first involving a network-adjacent path through chat_go and bashrunner and the
The Manchester Airports Group (MAG) disclosed that hackers breached its systems and stole customer data, including Wi-Fi sign-ups from Manchester, Stansted, and East Midlands airports. The intruder did not access customer payment details, and the attack had no impact on airport operations, the company said. A statement from the company today notes that the exfiltrated data also "relates to car park, lounge and Fast Track bookings." The list of compromised details includes customers' email addresses, phone numbers, vehicle registration numbers, and postcodes. “The incident has not resulted in any operational disruption,” assured the organization, adding that “Airport operations remain unaffected and customer parking services continue to operate normally.” Out of an abundance of caution, MAG has temporarily suspended its online “Manage My Booking” service and is instead directing travelers to use its phone line.
Threat research gives security teams insight into how attackers operate, while MDR turns that intelligence into faster detection and response. ESET explains how combining threat intelligence, continuous monitoring, and human expertise can help SMBs strengthen their defenses.
Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular vulnerabilities, and protect the privacy of users’ home networks. Android 17 adds support for Encrypted Client Hello (ECH), a new privacy standard that operates in conjunction with private DNS to hide profiling metadata, including visited domain names. ECH acts as a privacy extension for TLS, the protocol that secures HTTPS connections, encrypting the opening part of the TLS handshake that reveals the contacted hostname via the Server Name Indication (SNI). Even if the connection to a website or service is secure, internet service providers (ISPs) and Wi-Fi operators can still see the destination, which can be collected for commercial profiling purposes. Android users benefit from ECH when browsing with Chrome 117 and later or Firefox 119 and later, but Android 17 incorporates the protection at the platform level.
The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retailer giant Carhartt earlier this month, according to data breach notification service Have I Been Pwned. Founded in 1889, Carhartt is an American apparel company with workwear and streetwear manufacturing facilities in Kentucky and Tennessee and more than 3,000 employees in the United States and Europe. While Carhartt has yet to confirm the extortion group's claims or issue a statement about the breach, ShinyHunters claimed the attack on August 13 and said they allegedly stole more than 50GB of documents containing a wide range of customer, employee, and corporate data. "Millions of records of customer data and vast amount of sensitive information and PII containing employee, customer, customer metadata (royalty info), and other internal corporate data was compromised," the cybercrime gang said.
Confirm this action.
Leaving now will discard your changes.