Security Signal Weekly: August 22-28, 2026

I spent most of this weekend moving, so Friday’s edition slipped past me. I am publishing it late rather than pretending the week was quiet.

Overview

PaperCut and NetScaler both moved into active-exploitation territory, Next.js shipped fixes for two critical remote-code-execution flaws, and another trusted npm publishing path was turned against developers.

The incident side was just as busy. Two large healthcare companies disclosed disruptions, ATF called an intrusion into a standalone system a major incident, and the FBI and Justice Department shut down infrastructure used to hide attacks against US critical networks. The practical thread is familiar: reduce exposed attack surface first, then verify the trusted systems and third parties that can still reach sensitive data.

Reality check: Being late to a patch does not make the exposure disappear. It only makes the verification step more important, because you now have to ask whether the attacker arrived before the fix.

Top 10 Security Signals

1. PaperCut zero-day chain is under active exploitation

What happened: PaperCut confirmed customer incidents involving active exploitation of PaperCut NG and MF and released Emergency Patch Release 2 for supported v24, v25, and v26 installations. The vendor’s urgent bulletin now identifies CVE-2026-81578, an authentication bypass, and CVE-2026-82078, unsafe dynamic class loading that can execute arbitrary Java bytecode after configuration access; Huntress documented the pre-auth attack chain and observed post-exploitation remote-access tooling.

Why it matters: A print-management server is easy to underestimate, but it usually sits on a trusted internal network, connects to identity and database services, and runs with enough privilege to become a durable foothold. Every version is in scope, and the vendor is still working toward a normal release.

Action:

• Immediately restrict PaperCut NG/MF web access to trusted internal addresses and install Emergency Patch Release 2 on the application server, site servers, and secondary print servers.
• Review PaperCut server.log files for the vendor’s published database-error strings, missing or truncated logs, and unexpected class or command files under the server directories.
• Hunt for pc-app.exe or pc-app launching shells, SimpleHelp’s Remote Access Service, unexpected AnyDesk installs, and other activity that began before the patch was applied.

2. NetScaler memory flaw is being used for pre-auth root access

What happened: CISA added CVE-2026-8452 to the Known Exploited Vulnerabilities catalog after attackers began targeting vulnerable NetScaler ADC and Gateway appliances. Citrix’s bulletin describes the issue as a memory overflow affecting Gateway or AAA virtual-server configurations, while watchTowr’s technical analysis showed that the bug can be turned into unauthenticated code execution as root.

Why it matters: A VPN or authentication gateway is both exposed and trusted. That combination makes even a narrowly configured appliance valuable to attackers, and a clean upgrade result does not prove that a web shell or stolen session was not left behind.

Action:

• Upgrade affected NetScaler 14.1 and 13.1 appliances to the fixed builds listed by Citrix and verify the running firmware on every node after failover or reboot.
• Use Citrix’s configuration checks to identify Gateway, AAA, and SAML exposure rather than assuming every appliance has the same preconditions.
• Review appliance files, processes, authentication logs, and outbound connections for web shells or discovery activity that predates the upgrade.

3. Next.js fixes two critical unauthenticated RCE paths

What happened: Next.js released versions 16.3.3 and 15.5.24 to address two critical flaws: CVE-2026-75604, a Windows path-traversal issue that can lead to unauthenticated code execution, and GHSA-2xp9-vwfh-vxw4, an Image Optimizer flaw triggered by a crafted AVIF image. The Next.js August security release provides the upgrade guidance, and Cloudflare shipped emergency WAF coverage for both attack paths.

Why it matters: These bugs sit in framework features that applications may expose without developers thinking of them as upload or execution surfaces. Public Next.js deployments on Windows and sites that optimize attacker-controlled images need a direct inventory, not a generic JavaScript dependency ticket.

Action:

• Upgrade supported Next.js applications to 16.3.3 or 15.5.24 and rebuild and redeploy them from a trusted environment.
• Identify Windows-hosted Next.js servers and applications that accept or fetch untrusted AVIF images, then prioritize internet-facing instances.
• Use WAF rules only as temporary defense in depth and review web, image-optimization, and process-creation logs for suspicious requests before the upgrade.

4. CISA’s KEV update puts old server bugs back on the urgent list

What happened: CISA added six exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2019-1068 in Microsoft SQL Server, CVE-2022-0995 in the Linux kernel, two 2015 Red Hat privilege-escalation flaws, CVE-2021-23758 in Ajax.NET Professional, and the NetScaler issue above. Several of the older bugs align with Cisco Talos research on UAT-10147, a Chinese-speaking crime group using public exploits and AI-assisted workflows against Windows and Linux web servers.

Why it matters: The age of a CVE says nothing about whether the vulnerable component is gone. Legacy web applications, old Linux hosts, and database servers often outlive the inventory entries that were supposed to track them, which makes them ideal for scaled exploitation.

Action:

• Search asset, software, and vulnerability inventories for all six KEV entries, including inherited applications and unsupported servers that may not report through normal patch tools.
• Patch or isolate affected systems by the CISA due dates and remove internet exposure from applications that cannot be updated immediately.
• Hunt exposed Windows and Linux web servers for unexpected web shells, scheduled tasks, Defender exclusions, rootkits, and outbound traffic matching the Talos indicators.

5. Malicious npm releases carried valid provenance

What happened: Attackers published ten malicious versions of @7nohe/openapi-react-query-codegen across every maintained release line after abusing a comment-triggered GitHub Actions publishing workflow. Socket’s investigation found that the packages executed during installation, targeted cloud and registry credentials, GitHub Actions secrets, and AI-agent configuration, and still carried valid npm provenance attestations.

Why it matters: Provenance can prove which workflow published a package while still saying nothing about whether that workflow accepted untrusted input. A green attestation is not a substitute for reviewing the release trigger and the code that actually landed in the tarball.

Action:

• Check lockfiles, SBOMs, package caches, developer workstations, and CI logs for the ten affected versions and pin to the last known-good release for the relevant major line.
• Treat any environment that installed an affected version as potentially compromised and rotate reachable npm, GitHub, cloud, SSH, Kubernetes, Terraform, and AI-agent credentials.
• Audit publishing workflows for issue_comment or pull-request paths that can invoke release jobs without a trusted-author or trusted-commit check.

6. Factory-installed router implants expose root access

What happened: VulnCheck found two undocumented implants, DARKLANTERN and SPEAKINGSTONE, in a white-labeled ZBT cellular router purchased from a US seller. The research says DARKLANTERN exposes unauthenticated root command execution over UDP and SPEAKINGSTONE phones home for commands; internet scans identified 203 DARKLANTERN instances across 22 countries and 16 self-reported models.

Why it matters: This is a supply-chain trust failure inside the device that is supposed to enforce the network boundary. Because ZBT hardware is sold under multiple brands and the implant is in firmware, a model name on the case may not be enough to identify the real manufacturer or restore trust.

Action:

• Inventory cellular, travel, and small-business routers by hardware and firmware origin, not only the reseller brand printed on the enclosure.
• Block and monitor the published UDP ports and command-and-control indicators while identifying affected ZBT-derived devices.
• Replace confirmed affected hardware or reflash only with independently trusted firmware; do not treat a password change as remediation for a factory implant.

7. Boston Scientific cyberattack disrupts global order processing

What happened: Boston Scientific disclosed that a cybersecurity incident detected August 25 caused a global disruption to operations. The company’s SEC filing says access to business applications was limited, including systems used to process and ship customer orders, and that there was no timeline yet for full restoration.

Why it matters: Medical-device availability depends on ordinary business systems such as ordering, logistics, identity, and communications. An attack does not have to alter a device to create clinical and supply-chain pressure.

Action:

• Healthcare and distribution partners should identify Boston Scientific-dependent orders, confirm alternate communication paths, and document manual procedures for urgent fulfillment.
• Monitor vendor identities, file exchanges, and support communications for phishing or fraudulent changes while the company restores normal systems.
• Use the incident to test whether critical suppliers have operational workarounds that function when their normal identity and ordering platforms are unavailable.

8. McKesson confirms cyber incident tied to third-party applications

What happened: McKesson disclosed a cybersecurity incident discovered August 25 and said the investigation was still in its early stages. Its August 28 SEC filing points customers to the company’s incident page, while McKesson’s incident updates confirmed unauthorized access and data exfiltration involving third-party applications; the company had not confirmed the attacker’s much larger public claims.

Why it matters: McKesson sits deep in pharmaceutical and healthcare workflows, so third-party access can expose sensitive data and cause service problems far beyond one corporate network. The unknowns are part of the risk, not a reason to repeat unverified record counts.

Action:

• Organizations connected to McKesson should review third-party application access, API activity, service accounts, and data exports beginning before August 25.
• Watch for targeted phishing, fraudulent support requests, and identity abuse using healthcare, prescription, provider, or shipment context.
• Track McKesson’s official updates and preserve relevant logs now instead of waiting for final scope or individual notifications.

9. ATF designates standalone-system intrusion a major incident

What happened: The Bureau of Alcohol, Tobacco, Firearms and Explosives disclosed a cyber incident affecting a standalone system and said senior Justice Department officials designated it a major incident. ATF’s statement says the agency terminated connections to the affected environment and found no indication that the enterprise network, eForms, or other ATF systems were affected.

Why it matters: Segmentation appears to have limited the known blast radius, but a standalone system can still contain sensitive investigative data. The incident is a useful reminder that isolated does not mean low-value and that containment claims should stay scoped to what the investigation actually supports.

Action:

• Validate that standalone and enclave systems have current asset owners, independent logging, tested isolation controls, and incident-response access before they are needed.
• Review trust paths such as shared identities, administrative workstations, backup systems, and data-transfer processes that can quietly bridge a segmented environment.
• Keep public and internal incident language precise: distinguish confirmed isolation from conclusions about the data affected or the actor responsible.

10. FBI and Justice Department disrupt QTFY botnet infrastructure

What happened: The Justice Department and FBI seized domains used by QScan and QTRouter, two platforms operated by the PRC-linked QTFY group to infect IoT devices and hide attacks against critical networks. The Justice Department announcement says the hard-coded domains were essential to the malware and that the seizures made both platforms inoperable; the FBI and NSA also released a joint advisory with indicators.

Why it matters: A takedown removes attacker infrastructure, not the weaknesses or compromised edge devices that fed it. Organizations targeted through residential and IoT proxy networks may see traffic that looks local or ordinary, which makes identity, device, and behavior context more important than country blocking.

Action:

• Compare the joint advisory’s domains, IP addresses, certificates, malware artifacts, and behaviors with DNS, proxy, firewall, endpoint, and edge-device telemetry.
• Inventory internet-facing and remotely managed IoT devices, replace unsupported hardware, and restrict outbound communication to what each device actually needs.
• Investigate suspicious sessions based on identity and behavior even when the source IP is domestic, residential, or otherwise looks low risk.

Closing Notes

My first calls for this late edition are PaperCut and NetScaler because exploitation is confirmed and both products can sit in high-trust positions. Next.js teams and anyone using the affected npm package should move just as quickly, but their validation work looks different: rebuild from known-good code, rotate reachable secrets, and check whether the bad version ever ran.

The healthcare and government incidents are still developing, so I am keeping the claims narrow. Preserve logs, review third-party access, and make sure manual continuity plans work before the next vendor outage tests them for real. I will be back with the next Security Signal on the normal schedule, with fewer moving boxes in the way.