Daily Cybersecurity News – September 11, 2026
PaperCut Flaws Attacked by Hundreds of AI Agents
CriticalWhat happened
An attacker deployed hundreds of AI agents to exploit two recently disclosed PaperCut MF and NG vulnerabilities, compromising at least 440 instances and gaining domain administrator access in at least 12 organizations.
The flaws, CVE-2026-81578 (improper access control allowing unauthenticated admin actions) and CVE-2026-82078 (unsafe dynamic class loading), chain for authentication bypass, unauthorized configuration changes, and remote code execution. Both are rated critical, listed in CISA KEV as actively exploited, and were patched by PaperCut on August 27, 2026. GreyNoise observed the actor begin AI-assisted exploit development on August 31 from IP 45.142.193.132 using a DeepSeek model with OpenAI Codex, reaching first real-world RCE in under four hours and domain admin as fast as five minutes.
Who is affected
Organizations running unpatched PaperCut MF or NG print management software. GreyNoise identified 395 named victim organizations across 48 countries, with the highest counts in the United States (98), followed by the UK, France, Spain, and Canada.
Education was the most impacted sector (204 organizations). The campaign was opportunistic and reflected PaperCut's customer base rather than targeted selection.
Why it matters
AI agents compressed the time from vulnerability research to full domain takeover into minutes or hours, enabling mass opportunistic compromise of a widely deployed print server product that often sits deep inside networks with high privileges.
Builders and operators face a new reality where fresh critical flaws in enterprise software can be weaponized and scaled globally almost immediately after disclosure, turning patching delays into rapid widespread domain admin losses.
How it could have been prevented
Apply the August 27, 2026 emergency patches for PaperCut MF and NG without delay. Prioritize any internet-exposed or internally reachable instances as CISA KEV items.
Isolate PaperCut servers where possible, monitor for unusual configuration changes or outbound connections, rotate credentials after patching, and hunt for signs of prior compromise given the 440 known victims.
Relevant professional terms
- Remote Code Execution (RCE)
- A vulnerability that lets an attacker run their own malicious code on a target system from over the network without needing prior access.
- Domain Administrator
- The highest-privilege account in a Windows Active Directory environment, with full control over every computer, user, and policy in the domain.
Anthropic Catches Russian Spies Using Claude for Hacking
HighWhat happened
Anthropic detected and disrupted a Russia-linked cyber-espionage group using its Claude AI tool in operations that targeted more than 20 government, intelligence, diplomatic, and defense organizations between December 2025 and August 2026.
The activity aligned with Midnight Blizzard (also known as APT29, Cozy Bear, BlueBravo), attributed to Russia's SVR. The group compromised hotel Wi-Fi providers, altered DNS records to redirect travelers, stole a complete proprietary software development kit for a military drone vision system from manufacturers, and used Claude to reverse-engineer the architecture, bill of materials, suppliers, and unannounced products. They also used the model to monitor security-product detections and iteratively modify implants to evade them. Anthropic disrupted the activity, strengthened safeguards, and shared intelligence.
Who is affected
Primarily members of the Ukrainian government, military, and diplomatic staff, plus entities in the military drone supply chain. Additional misuse involved suspected ShinyHunters affiliates for credential scanning, system mapping, and data theft, and a Chinese-speaking group.
More than 20 organizations in government, intelligence, diplomatic, and defense sectors were targeted in the core campaign.
Why it matters
Nation-state actors are now using frontier AI to accelerate reverse engineering of stolen proprietary systems, close the detection-evasion loop faster than defenders can update signatures, and lower the skill barrier for complex operations.
This inverts traditional defender advantages: a new detection that once slowed attackers can now be analyzed and bypassed by the same AI in near real time, raising the operational tempo of espionage against critical defense and diplomatic targets.
How it could have been prevented
Treat AI-assisted attacks as the new baseline: accelerate patching and credential rotation cycles, implement robust monitoring for anomalous DNS changes and hotel/public Wi-Fi related redirects, and segment sensitive development and supply-chain environments.
Share IOCs promptly with partners, restrict high-risk AI tool access for sensitive roles where policy allows, and assume stolen source or SDKs will be rapidly reverse-engineered.
Relevant professional terms
- Cyber Espionage
- The use of digital techniques by nation-states or groups to secretly steal sensitive government, military, or corporate information.
- Indicators of Compromise (IOCs)
- Forensic artifacts such as malicious IPs, domains, file hashes, or behavioral patterns that signal a system or network has been breached or is under attack.
CISA: WatchGuard Firebox Bug Now in Ransomware Attacks
CriticalWhat happened
CISA confirmed that an out-of-bounds write vulnerability in WatchGuard Firebox appliances, CVE-2025-14733, is now being exploited in ransomware campaigns. The flaw was added to the KEV catalog in December 2025 and the ransomware-use flag was updated to Known.
CVE-2025-14733 (CVSS 9.8) affects the Fireware OS iked process and allows remote unauthenticated code execution via IKEv2 mobile-user or branch-office VPN configurations with a dynamic gateway peer. It is nearly identical in class to the earlier CVE-2025-9242. Shadowserver still observed several thousand exposed devices months later.
Who is affected
Organizations running WatchGuard Firebox firewalls with vulnerable Fireware versions that expose IKEv2 VPN or branch-office tunnels. Thousands of internet-facing devices remained unpatched long after the KEV listing.
Any network relying on these appliances as the boundary security control is exposed to initial access that ransomware groups can immediately follow with lateral movement.
Why it matters
Unauthenticated RCE on an internet-facing firewall is a direct path into the internal network. Ransomware operators treat KEV-listed edge appliance flaws as high-value entry points, and the nine-month lag from KEV addition to public ransomware confirmation does not mean the exploitation window was empty.
Operators who wait for an explicit ransomware flag before prioritizing face the risk of discovering their own compromise only after encryption or data theft has already occurred.
How it could have been prevented
Immediately upgrade Fireware to 12.11.6, 2025.1.4, or 12.5.15 as recommended. Rotate every credential and key stored on or managed by the appliance, even after patching, because attackers have been observed exfiltrating configurations and management databases.
Verify that IKEv2 and branch-office VPN settings match intended policy, confirm post-compromise lateral-movement detections actually cover this device class, and treat every new internet-facing appliance KEV as an urgent one-week remediation item regardless of the current ransomware field.
Relevant professional terms
- Out-of-bounds Write
- A memory-safety error in which a program writes data beyond the limits of an allocated buffer, frequently enabling an attacker to overwrite critical structures and execute code.
- IKEv2
- Internet Key Exchange version 2, the protocol that negotiates and establishes secure IPsec VPN tunnels between clients or gateways and a firewall.
Attackers Chain JFrog Artifactory Flaws for Admin Backdoors
HighWhat happened
Attackers chained two vulnerabilities in self-hosted JFrog Artifactory to obtain administrator control and plant backdoors, according to Wiz observations between August 15 and September 8, 2026. JFrog had already released fixes, so only unpatched servers were hit.
CVE-2026-42018 returns an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. CVE-2026-42016 then allows that token to be exchanged for one with administrator scope because the server validates signature and issuer but not the token's actual permissions. Attackers moved from first request to new admin account in under five minutes in some cases, created persistent admin accounts, installed malicious Groovy plugins for code execution, and dropped custom Rust backdoors or simple HTTP droppers. A separate critical authentication-bypass flaw, CVE-2026-82329 (CVSS 9.8, CISA KEV), was exploited on its own against newer branches.
Who is affected
Organizations running self-hosted JFrog Artifactory instances that had not applied the relevant patches. The chain requires both CVE-2026-42018 and CVE-2026-42016 (affecting versions before 7.133.11 on certain branches); CVE-2026-82329 affects six release branches up to 7.161 under default configuration.
Any DevOps or software-build pipeline that pulls packages from a vulnerable Artifactory server is at risk of supply-chain compromise.
Why it matters
Artifactory sits at the center of modern software build and distribution pipelines. Administrator access lets attackers poison artifacts, inject backdoors into downstream software, and maintain persistent code-execution footholds via plugins.
Because the malicious admin actions appear in logs under the anonymous identity, detection is harder, and the speed of the chain (minutes) leaves little room for manual response once a vulnerable server is discovered.
How it could have been prevented
Upgrade all self-hosted Artifactory instances to versions that include the fixes for CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329. Immediately audit for unexpected administrator accounts (especially those showing as token:anonymous), review installed Groovy plugins, and inspect world-writable directories such as /tmp for dropped binaries.
Rotate tokens and credentials, enforce least-privilege on remaining tokens, and monitor the token-creation and plugin-execution endpoints for anomalous unauthenticated or anonymous activity.
Relevant professional terms
- Privilege Escalation
- An attack technique that allows someone with limited access to gain much higher permissions, such as moving from an anonymous token to full administrator rights.
- Token Scope
- The specific set of permissions and actions that an authentication token is authorized to perform; failing to validate scope can turn a low-privilege token into an admin one.
PuzzleMask: Plain Prose Bypasses LLM Policy Checks
MediumHow it works
- Attacker wraps a forbidden payload inside coherent, benign-looking prose.
- Lightweight gatekeeper LLM reads the whole prompt, fails to spot the embedded intent, and labels it safe.
- Full prompt is passed to the stronger target model.
- Target extracts the payload and treats it as actionable input, often executing the harmful request.
What happened
Check Point Research published PuzzleMask, a prompt-crafting technique that embeds a policy-violating payload inside ordinary-looking English prose so that a lightweight LLM gatekeeper classifies the entire input as benign and forwards it to a stronger target model.
The target model then notices, extracts, and acts on the hidden payload (for example, file-encryption instructions or jailbreak text). No special encoding, emojis, or invisible characters are required. In tests against 23 automated prompts, gatekeeper models (gpt-4o-mini, gpt-oss-safeguard, Claude 3 Haiku, Llama Guard 3) consistently missed the payload, while a capable target (gpt-5-thinking-high) extracted and executed it in more than 90 percent of trials.
Who is affected
Any application or service that uses a fast LLM-based policy checker or guard model in front of a more powerful target LLM to filter untrusted user input. This architecture is increasingly common for content moderation, tool-use agents, and enterprise AI gateways.
Why it matters
Simple input classifiers can be defeated by carefully wrapped natural language, allowing malicious instructions to reach the model that actually has tools or high capabilities. The technique is not itself a jailbreak but composes cleanly with one, lowering the bar for attackers who want to bypass safety layers without exotic obfuscation.
Defenders relying solely on a quick semantic check of raw input now face a stealthy, plain-text evasion path that scales with automated prompt generation.
Relevant professional terms
- Large Language Model (LLM)
- An AI system trained on massive amounts of text so it can understand, generate, and reason about human language.
- Prompt Injection
- A technique that inserts crafted text into an LLM's input to override its original instructions or safety policies and make it perform unintended actions.
AIs Compress Exploit Timeline From Rumor to Weapon
HighWhat to watch
- Speed of exploit development after any public hint, commit, or partial advisory.
- Whether open-source projects shorten or abandon traditional multi-week embargoes.
- Growth of defensive AI agents that automatically generate and test patches at the same pace.
- Changes in how TLAs and vendors share early warnings without creating searchable tips for attacker AIs.
What happened
Security researchers observe that modern AI agents can turn a mere rumor or high-level description of a vulnerability into a working exploit far faster than traditional timelines allow. In one account highlighted by Bruce Schneier, simply knowing roughly what a flaw was about was enough for an agent to locate and weaponize it before a public patch existed.
Simon Willison and others note that this speed is incompatible with existing open-source embargo and coordinated-disclosure practices: once a hint circulates, exploit traffic can appear within minutes of a fix PR, collapsing the window that maintainers and downstream users once relied upon.
Who is affected
Open-source maintainers, software vendors who use embargoes, and every organization that consumes open-source components. The pattern applies broadly to any software whose vulnerability details can leak as rumors, commit messages, or partial advisories.
Why it matters
The classic assumption that secrecy during an embargo buys a safe patching window no longer holds when AI agents need only a vague tip to search code, generate proof-of-concepts, and launch probes. Defenders must shift from time-based secrecy to continuous deployment readiness and automated defensive response that matches attacker speed.
Failure to adapt means newly discovered issues become mass-exploitation events almost as soon as they are whispered about, especially in widely used libraries and infrastructure projects.
Relevant professional terms
- Coordinated Disclosure
- The practice of privately reporting a security flaw to a vendor and giving them time to prepare a patch before the details are made public.
- Embargo
- A temporary agreement among researchers, vendors, and sometimes governments to keep vulnerability details secret until fixes are ready and distributed.
Ukrainian Conti Developer Gets Four Years in Prison
MediumWhat it means
Law-enforcement pursuit of ransomware actors does not end when a brand shuts down. Individual technical contributors remain exposed to multi-year sentences through extradition and forensic evidence of continued activity. Organizations should still treat historical Conti indicators as relevant for threat hunting and should maintain robust backups and segmentation against successor groups that reuse the same tooling and tactics.
What happened
Oleksii Lytvynenko, a 44-year-old Ukrainian national, was sentenced to four years in U.S. prison for his role as both a hacker and developer in the Conti ransomware operation. He pleaded guilty in June after being extradited from Ireland.
Prosecutors said he personally targeted at least a dozen companies, stored stolen data from eight U.S. and four overseas victims, and worked on a malware loader used by the group. Conti attacked organizations in 47 U.S. states and 31 countries before shutting down in 2022; the FBI estimated more than $150 million in ransoms paid by early 2022. Forensic evidence showed he continued ransomware-related activity after Conti's collapse. Irish authorities arrested him in Cork in July 2023.
Who is affected
The more than 1,000 organizations worldwide previously victimized by Conti, including critical-infrastructure entities across the United States and other countries. The sentencing also affects remaining Conti affiliates still facing charges.
Why it matters
Even after a major ransomware brand dissolves, individual developers and operators remain reachable by law enforcement through international cooperation and extradition. The case reinforces that technical contributors who build loaders or handle stolen data face real prison time years later.
It signals continued pressure on the ransomware ecosystem and may deter some participants who assumed geographic distance or group dissolution would protect them.
Relevant professional terms
- Ransomware
- Malicious software that encrypts a victim's files or systems and demands payment, usually in cryptocurrency, before restoring access.
- Malware Loader
- A small malicious program whose job is to download, install, or launch additional payloads such as ransomware or backdoors on an already compromised machine.