This Week in Cybersecurity: Week 35

The week's clearest pattern was a run of critical, actively exploited flaws in server software that a lot of organizations run without thinking about it: Gitea, Oracle WebLogic, and PaperCut all had real-world attacks this week, not just disclosures. PaperCut is the one to watch closest. It is the same print-management software that gave the Cl0p ransomware crew an entry point into hundreds of organizations back in 2023, and this week it shipped an emergency patch, then a second emergency patch, and researchers still found a way around the fix.

There was also a large government breach, a decades-old file-sharing bug used to steal nuclear research records, and a wave of scams and shady browser extensions aimed squarely at ordinary people rather than IT departments. On the positive side, WhatsApp quietly rolled out one of the better consumer security upgrades of the year.

This roundup covers Monday, August 24 through Sunday, August 30, 2026.

What to act on#

Turn on WhatsApp's new passkey support#

WhatsApp now supports multiple passkeys per account on both iOS and Android, up from a single passkey before, and it upgraded its two-step verification option from a six-digit PIN to a full alphanumeric password. Meta says over a billion users already sign in with a passkey on WhatsApp. Passkeys are phishing-resistant by design, because they are tied to the app and can't be typed into a fake login page the way a password or a one-time code can. If you use WhatsApp, go to Settings > Account > Passkeys and add one. It's a good moment to look at passkeys and password hygiene more broadly across your other accounts too.

Don't give your passcode to "Apple Support" on the phone#

A phishing-as-a-service operation called AnonyMousKIT is running a scam aimed specifically at people whose iPhones were recently lost or stolen. It uses stolen devices' Find My status to build convincing, Apple-branded fake tracking pages, then contacts the owner by email, text, WhatsApp, or an AI-generated voice call impersonating Apple Support, and asks for the device passcode, Apple ID password, and a live two-factor code. Apple will never ask for your passcode, password, or 2FA code over a call or a webpage. If someone claiming to be Apple Support asks for any of those, hang up and contact Apple directly through the number on apple.com. Our iPhone hardening guide covers the account settings worth locking down if you've had a device lost or stolen.

Check your browser extensions#

Researchers found 19 Chrome and Edge extensions quietly stealing cryptocurrency wallet seed phrases, browser history, and social media logins while functioning normally on the surface. Some were built by the attacker from scratch; others were legitimate extensions with real users that the attacker bought from their original developers and then modified. The worst offender, a screen-copy tool called "Enable Right Click & Copy," had roughly 80,000 users on its own. Open your browser's extensions page, remove anything you don't actively use or don't recognize, and be wary of extensions that change ownership. Our guide to browsers built for privacy and security is a reasonable next step if you want to reduce this kind of exposure generally.

WordPress site owners: patch now#

Five separate WordPress plugins and themes got critical, unauthenticated takeover bugs disclosed this week, including a maximum-severity flaw in the GiveWP donation plugin and a TranslatePress bug affecting a reported 400,000 sites. The others hit the Avada theme, the WPMU DEV Dashboard plugin, and the Pods plugin, all rated CVSS 9.8. None were reported as actively exploited yet at time of writing, which is exactly the window to close before that changes. If you run WordPress, update GiveWP, Avada, TranslatePress, Pods, and WPMU DEV Dashboard to their latest versions this week.

The week's biggest#

PaperCut zero-day, patched twice, still bypassable#

PaperCut confirmed active exploitation of its NG and MF print management software, affecting every version, and shipped an emergency patch for versions 25 and 26. Researchers at Huntress then found attackers chaining two specific flaws, an authentication bypass in the web management interface (CVE-2026-81578) and unsafe dynamic class loading in the database connection code (CVE-2026-82078), to get unauthenticated remote code execution. PaperCut released a second, hardened patch, and watchTowr researchers promptly found a bypass for that too. Organizations running PaperCut with the application server exposed to the internet should restrict access to trusted IP addresses immediately rather than waiting on a fully working patch. Who's exposed: organizations running PaperCut NG or MF, particularly with the server open to the internet. If that isn't you, the main reason to know this one is history: a PaperCut flaw was Cl0p's way into hundreds of organizations in 2023, so this pattern tends to escalate.

Gitea RCE actively exploited via open registration#

A critical flaw in Gitea, the self-hosted alternative to GitHub, lets anyone with repository write access run arbitrary shell commands (CVE-2026-60004, CVSS 9.8). Because Gitea allows open self-registration by default, an attacker doesn't need stolen credentials, just an account and a repository they create themselves. CISA has confirmed active exploitation, and one developer reported a cryptocurrency-mining payload dropped on their instance, pushing CPU usage past 70% until the hosting provider flagged it. A fix landed in version 1.27.1. Who's exposed: anyone self-hosting Gitea, especially with the default settings of open registration and no email confirmation. GitHub and GitLab's own hosted services are unaffected.

Maximum-severity Oracle flaw under active attack across 100+ countries#

A CVSS 10.0 flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in lets an unauthenticated attacker create, delete, or modify data over the network with no credentials required (CVE-2026-21962). Oracle patched it in January, but multiple security firms report continued active exploitation, and government and commercial systems across more than 100 countries have reportedly been targeted. U.S. federal agencies were given until August 27 to patch under a binding directive. Who's exposed: organizations running Oracle HTTP Server or WebLogic with the proxy plug-in, which tends to mean larger enterprises and government agencies rather than individuals.

Three CVSS 10.0 flaws in ServiceNow#

ServiceNow disclosed three separate maximum-severity vulnerabilities: code injection through its GraphQL API, an access-control flaw in system configuration uploads, and a SQL injection in a dynamic schema query. All three need no authentication and no user interaction. ServiceNow says it isn't aware of active exploitation and no public exploit code exists yet, and it patched its own cloud-hosted customers automatically. Self-hosted and partner-managed instances on older patch levels have to apply the fix manually. Who's exposed: organizations running self-hosted or partner-managed ServiceNow instances that haven't updated. ServiceNow-hosted customers are already covered.

cPanel bug lets one hosting customer take root on a shared server#

A flaw in cPanel's domain-parking feature lets an authenticated, low-privilege hosting account write arbitrary files to the server and get code execution as root (CVE-2026-65643). That means one customer on a shared hosting box could, in theory, take over every other customer's site on the same server. cPanel has not said whether it has seen exploitation, and it isn't on CISA's exploited list yet, but it patched the issue and servers with automatic updates should already have it. Who's exposed: shared hosting providers running cPanel and, by extension, every customer on an unpatched box. If your site is on managed shared hosting, this is on your host to fix, not you.

Critical Keycloak flaw allows account takeover without email access#

A flaw in Keycloak, an open-source identity and login system used by many organizations to handle authentication, lets an unauthenticated attacker skip the email verification step in password reset and jump straight to setting a new password (CVE-2026-18963), potentially including for administrator accounts. No evidence of active exploitation yet. Fixed versions are available (26.7.2 upstream, with matching Red Hat builds), and Red Hat's interim advice is to disable the "Forgot password" feature until you patch. Who's exposed: organizations that use Keycloak for login, particularly if the "Forgot password" flow is enabled. This doesn't touch consumer accounts directly.

Backdoors built into China-made ZBT routers from the factory#

Researchers found two backdoors, nicknamed SPEAKINGSTONE and DARKLANTERN, built into the firmware of ZBT-brand routers as shipped, not added after the fact. Both give an attacker root-level command execution without a password; one phones home to a command-and-control server, the other listens for commands on a network port. Researchers found over 200 internet-exposed instances across 22 countries, and when they registered one backdoor's backup domain, nearly 400 devices connected, most inside China on a mobile carrier network. There is no patched firmware yet. Who's exposed: owners of ZBT and white-labeled ZBT routers, which are sold under a range of other brand names, making this hard to spot from the box alone. Blocking UDP ports 9992 and 10000 at the network edge is the only mitigation for now.

CISA adds a decade-old batch of exploited flaws, including NetScaler and Linux#

CISA added six flaws to its Known Exploited Vulnerabilities catalog this week, the most notable being active exploitation of a Citrix NetScaler denial-of-service bug, with 36 documented exploitation attempts from a dozen attacker IPs in under two weeks. The batch also includes a 2022 Linux kernel privilege-escalation flaw and a 2019 Microsoft SQL Server remote-code-execution bug, both newly confirmed as exploited years after disclosure. Federal agencies have until August 29 for NetScaler and SQL Server, and September 9 for the rest. Who's exposed: organizations running unpatched NetScaler appliances, older Linux kernels, or old SQL Server installs. This is a reminder that "old" doesn't mean "safe to ignore" when it comes to patch backlogs.

Old ownCloud bug used to steal nuclear research records#

A three-year-old ownCloud authentication bypass (CVE-2023-49105, patched in late 2023) was actively exploited this month to steal nuclear material records, reactor component data, and a personnel database from a Philippine nuclear research body. A Chinese-speaking threat actor pulled 176 files, including BitLocker keys and password-manager databases, before CISA added the flaw to its exploited list on August 27. Who's exposed: organizations still running unpatched ownCloud core between versions 10.6.0 and 10.13.0. This is a case study in why old, patched bugs still matter: the fix has existed since 2023, and someone still got breached by it this month.

Worth knowing about#

A commercial phishing kit called Mirage2FA has been hitting Microsoft 365 logins at scale, targeting more than 4,500 US and EU companies and logging over 9,000 session-theft events. It works as an adversary-in-the-middle proxy: the victim types their password and one-time code into a convincing fake Microsoft page, and the kit relays it live to the real login page, capturing the resulting session cookie in the process. That's the practical difference between a one-time code and a phishing-resistant login: TOTP codes and app-based approvals can still be relayed this way, while a passkey, which is bound to the real Microsoft domain, cannot be. It's a useful data point for anyone evaluating what actually puts a company's accounts at risk.

Berlin's state government said no to a ransom demand after the Rhysida ransomware group claimed to have stolen close to 6 terabytes of data, including records on more than 12,000 people, from the city's administrative network. The mayor's office cited standard guidance that paying doesn't guarantee the data comes back and tends to invite more attacks. No election data was affected.

A Chinese-speaking group tracked as UAT-10147 is using AI tools to automate large parts of its attack pipeline, from AI-assisted vulnerability scanning to a custom backdoor called SPECTRE that can disable security software using a legitimate but vulnerable driver, and a companion Linux rootkit that survives reboots. The group has scanned roughly 170,000 URLs looking for exposed servers, mostly in education, media, and gaming. It's a preview of what "AI-scaled" attacks look like in practice: not a single dramatic exploit, but faster, cheaper reconnaissance across a much larger set of targets.

Summary#

1. If you use WhatsApp, turn on passkeys and upgrade your two-step verification password.
2. Never give a passcode, password, or 2FA code to anyone who calls claiming to be Apple Support, even if the call looks legitimate.
3. Review your Chrome or Edge extensions and remove anything unfamiliar or unused.
4. If you run WordPress, patch GiveWP, Avada, TranslatePress, Pods, and WPMU DEV Dashboard now.
5. If you run PaperCut, Gitea, Oracle WebLogic/HTTP Server, cPanel, ServiceNow (self-hosted), Keycloak, or ownCloud, check patch status this week; several of these are under active attack.
6. A decades-old backdoor built into ZBT-brand routers has no fix yet; block UDP ports 9992 and 10000 if you can't confirm your router isn't affected.
7. Phishing kits like Mirage2FA can now defeat one-time codes in real time; passkeys are the defense that actually holds up against this.

If your organization needs help figuring out where any of this actually applies to you, get in touch.

This roundup is compiled from public reporting for general awareness and is not a substitute for a formal risk assessment of your own environment.