Critical Zero-Day in PaperCut Exploited; ServiceNow Patches 10.0 CVSS Flaws

McKesson Data Breach Claimed by ShinyHunters Extortion Group

U.S. healthcare giant McKesson has confirmed a cybersecurity incident involving unauthorized network access and data exfiltration. The ShinyHunters extortion group has claimed responsibility, alleging the theft of approximately one terabyte of data, including 284 million patient-related records, from a Snowflake environment. The breach was discovered on August 25, 2026, with the data exfiltration reportedly occurring over the preceding four days. McKesson has acknowledged the incident in an SEC filing but has not yet determined its full material impact. The investigation is ongoing, and the company has warned customers of potential service degradation.

Data BreachShinyHuntersHealthcareSnowflakeData Exfiltration +1 more

McKesson Discloses Breach After ShinyHunters Claims Patient Data Theft

Berlin Refuses Ransom After Rhysida Group Steals 5.79TB of Data

Berlin Government Defies Rhysida Ransomware After 5.79TB Data Theft

The state government of Berlin, Germany, has publicly refused to pay a ransom demand from the Rhysida ransomware group. The threat actors claim to have exfiltrated 5.79 terabytes of data, including 1.44 million files, from the city's administrative network. The stolen data, which allegedly includes contracts, personal information, and classified documents, is being auctioned on the group's darknet leak site with a starting price of 30 bitcoin. The breach primarily affected the Senate Department for Mobility, Transport, Climate Protection and Environment, with data exfiltration occurring between August 7 and August 12, 2026. An investigation by German authorities is underway.

RansomwareRhysidaData BreachGovernmentExtortion +1 more

Berlin Refuses Ransom After Rhysida Group Steals 5.79TB of Data

Manchester Airports Group Breach Exposes 8.7 Million Customers' Data

Data of 8.7M Customers Exposed in Manchester Airports Group Breach

Manchester Airports Group (MAG), operator of Manchester, Stansted, and East Midlands airports in the UK, has suffered a data breach affecting approximately 8.7 million customers. An unauthorized third party accessed a system containing customer information related to bookings for services like car parking and airport lounges. The exposed data includes names, email addresses, phone numbers, vehicle registrations, and postcodes. MAG has stated that no payment card details were compromised and that airport operations and security were not affected. The 'Manage My Booking' portal has been taken offline, and affected customers are being notified.

Data BreachTransportationAirportUKPII

4 min read

Manchester Airports Group Breach Exposes 8.7 Million Customers' Data

PaperCut Zero-Day RCE Actively Exploited; Emergency Patches Released

CRITICAL

PaperCut Urges Patch for Actively Exploited Zero-Day RCE Flaws

Print management software provider PaperCut has issued an urgent security warning about a vulnerability chain being actively exploited in the wild. The flaws, affecting all versions of PaperCut NG and MF, can be chained to achieve pre-authentication remote code execution (RCE). The attack combines an authentication bypass (CVE-2026-81578, CVSS 8.8) with an unsafe dynamic class-loading issue (CVE-2026-82078, CVSS 9.4). PaperCut has released emergency patches and strongly advises customers with internet-facing servers to apply them immediately or restrict access via firewall rules. Security firm Huntress has confirmed observing exploitation in customer environments.

Zero-DayVulnerabilityRCEPaperCutActive Exploitation +2 more

6 min read

PaperCut Zero-Day RCE Actively Exploited; Emergency Patches Released

Russian APT BlueDelta Targets European Governments with HOOKEDGE

BlueDelta (APT28) Uses HOOKEDGE Backdoor in Espionage Campaign

The Russian GRU-linked threat group BlueDelta, also known as APT28, has been observed in a recent espionage campaign targeting European government and diplomatic organizations in Romania, Spain, and Türkiye. The campaign, detailed by Recorded Future, uses a new lightweight backdoor called HOOKEDGE. This backdoor is delivered via macro-enabled Word documents with diplomatic lures. In a novel technique, HOOKEDGE uses the legitimate developer service 'webhook.site' for its command and control (C2) communications, allowing it to blend in with normal web traffic and evade detection.

APT28BlueDeltaGRUEspionageHOOKEDGE +2 more

6 min read

Russian APT BlueDelta Targets European Governments with HOOKEDGE

Baylor Genetics Breach Exposes Medical Data of Over 2.8 Million

Baylor Genetics Data Breach Affects 2.8 Million Individuals

Houston-based genetics testing firm Baylor Genetics has disclosed a massive data breach affecting 2,810,878 individuals. According to its report to the U.S. Department of Health and Human Services, an unauthorized party accessed its network for nearly a week, from June 11 to June 17, 2026. The compromised data is highly sensitive, potentially including names, Social Security numbers, addresses, medical diagnoses, lab results, and other genetic testing information. The company discovered the intrusion on June 15 and has since secured its systems and begun notifying the large number of affected individuals across the United States.

Data BreachHealthcareGeneticsPIIPHI +1 more

6 min read

Baylor Genetics Breach Exposes Medical Data of Over 2.8 Million

Updated Articles (2)

ATF Confirms Major Incident After Qilin Ransomware Breach Claim

Qilin Ransomware Claims Breach of US ATF Agency

Update:

The Qilin ransomware group, responsible for the ATF breach, has recently been linked to the exploitation of a zero-day vulnerability in Check Point VPN appliances. While not confirmed as the specific initial access vector for the ATF incident, this detail provides crucial insight into Qilin's sophisticated tactics, techniques, and procedures (TTPs). The updated analysis includes T1190 (Exploit Public-Facing Application) specifically referencing VPN vulnerabilities and suggests monitoring VPN logs, especially from Check Point devices, as a hunting hint. This new information enhances understanding of potential attack vectors and strengthens detection and mitigation strategies against Qilin.

August 27, 2026

Updated: August 29, 2026

ransomwareqilinatfdojdata breach +3 more

ATF Confirms Major Incident After Qilin Ransomware Breach Claim

ServiceNow Patches Three Critical CVSS 10.0 Flaws in AI Platform

CRITICAL

ServiceNow Patches Critical Unauthenticated RCE Flaws

Update:

The initial report of critical ServiceNow vulnerabilities has been updated with a new CVE ID for one of the remote code execution flaws. CVE-2026-74944, a file upload RCE, is now listed instead of CVE-2026-18885. Both are CVSS 10.0. The updated advisory also provides additional context, noting that a separate ServiceNow vulnerability (CVE-2026-6875) was actively exploited in July 2026, underscoring the urgency for patching these critical flaws. Affected versions now include 'Australia Patch 5' and earlier.

August 28, 2026

Updated: August 29, 2026