Latest / Daily DefSec Brief / Cyber Security News for August 27 2026 - Daily DefSec Brief
Transcript
- Jerry: Papercut NG and MF are under attack right now, and there's no patch out yet. So the plan today is to make sure attackers can't reach that box in the first place. This is the Daily F Sec brief. I'm Jerry Bell, the day security news in five minutes for Thursday, August 27th, 2026. 15 items on the board today. And by the way, sorry for being late. my dog had to go to the vet. So here we are. One. Papercut NG and MF print server are being exploited in the wild with confirmed customer incidents and there's no patch yet. Restrict access to the papercut server, get it off the public internet, and watch the vendor advisory for a fix. Two, a Rowhammer variant called GPU Thor flips bits past ECC on Ampere class Nvidia GPUs with GDDR6, Which gets you denial of service or a root shell. Either way, that's great. Avoid cross-tenant sharing on affected A-series cards, watch your ECC error counters, and treat shared GPU nodes as higher risk. 3. A flaw in Veeam 1 lets an unauthenticated attacker coerce SMB authentication out of the service account and grab those credentials. Check the Veeam advisory for the fixed build, patch it, and restrict SMB egress from that server in the meantime. four. Ubiquity effects twenty two bugs across the unify line, three of them rated a perfect ten, all improper access control. Apply the updates now, and remember this is branch and small business gear, not just stuff in your house. 5. Microsoft is seeing attackers go after exposed AI gateways like Light LLM, Ragflow, and Kestra to steal credentials, set up persistence, and mine crypto on your compute. Lock those services down, rotate your provider API keys, and hunt for evidence of mining. 6. A fishing campaign in Cambodia is dropping SparkRet and using a vulnerable Opswat driver to disable security software before it goes to work. Add the ARDRV.sys driver to your blacklist and hunt for InnoSetup droppers arriving in compressed archives. 7. Researchers found LLMs.txt files on more than a hundred sites pointing AI agents at executable content they'll auto install, and some Fortune five hundred companies have already run proof of concept code at least with one site pointing to live malware. Eight. A plain summarizes web request hijacks Claude Code's Opus V in auto mode and lands code execution somewhere between 60 and 80% of the time. Meanwhile, an anthropic commissioned evail put that number at zero percent. So you know what that eval's worth. Don't treat the safety classifier as containment. Run agents isolated and watch them. 9. A suspected Chinese-speaking operator used old own cloud and WordPress flaws to steal data from a Philippine nuclear research body and a Navy-serving engineering firm. Make sure your internet-facing stuff has an owner and is actually being managed. 10. a Russian speaking Aurora ransomware affiliate leaned on an AI coding assistant while hitting more than twenty organizations across nine countries. And it all came out because they misconfigured one of their servers. We're seeing rapid adoption of AI in adversary circles and we need to be ready. 11. A new Go based malware called GoCaracal does the usual remote shell keylogging and proxying kit, but it pulls a replacement C2 address off an Ethereum smart contract to survive takedowns. Arctic Wolf has a Yara rule and IOCs, and it also might be a good idea to watch for outbound connections that resolve their C2 from a blockchain lookup. 12. AWS published a walkthrough of how one stolen key or session lets an attacker walk in as an approved user, run discovery, and end in data theft or persistence. Enforce short-lived credentials, alert on API calls from unfamiliar addresses, and rotate any key that turns up in code or logs. thirteen the IRGC linked Nimbus Manticore group expanded across Europe and the Middle East with a new backdoor and a reverse SSH tunneler disguised as a Windows Terminal Server DLL. Hunt for Rogue reverse SSH tunnels pretending to be system DLLs and review group IB's indicators. 14 CISA added an Ajax.net Professional deserialization flaw to the Kev catalog, meaning it's actively exploited with remote code execution through arbitrary.NET classes. That product is likely end of life with no fix coming, so discontinue it or move to something that is supported. This is a good reminder to watch for dependencies that silently get abandoned. 15. CISA also added a Microsoft SQL Server remote code execution flaw to the Kev. Running in the context of the database service engine account. I feel compelled to say that the patch for this has been out for seven years, but yeah, let's keep freaking out about AI. That's the board for today. All the sources and CVEs are in the show notes. If this is useful, give it a like and subscribe and send it to a friend. Thanks for watching, and I'll be back again tomorrow.