The Core Lightning team reviewed AI-generated security reports and confirmed real flaws in some of them. Fixes are being prepared under an approximately two-week embargo.
PaperCut has confirmed customer incidents and the active exploitation of an as-yet-unspecified flaw in PaperCut NG and PaperCut MF. The risk affects all versions.
On August 27, 2026, CISA added CVE-2026-66384 in JFrog Artifactory to the KEV catalog. Operators of self-hosted instances should verify the version and deploy available fixes.
CISA added CVE-2026-8452 in NetScaler ADC and NetScaler Gateway to its Known Exploited Vulnerabilities catalog. U.S. federal civilian agencies must update the devices by August 29, 2026.
The U.S. ATF confirmed an incident in a system separated from its enterprise network. The agency has not yet confirmed Qilin’s involvement or any data breach.
Manchester Airports Group confirmed that an unauthorized third party obtained some customer data. The incident did not affect airport operations or payment information.
V12 researchers identified two bugs in Signal’s Contact Discovery Service Icelake. Public commits confirm related server-side fixes, but exploitation in practice has not been confirmed.
The U.S. cybersecurity agency CISA added the CVE-2023-49105 vulnerability in ownCloud Server to its Known Exploited Vulnerabilities catalog. Unpatched instances may expose users’ files to unauthorized reading, modification, or deletion.
Executive Order 14420 paves the way for restricting selected foreign technologies used in the U.S. power grid, including industrial control systems and remote maintenance.
U.S. authorities took the QScan and QTRouter platform domains offline. According to the DOJ, they were used by the Chinese group QTFY to scan for vulnerabilities and mask its activity.