PaperCut NG/MF flaws added to KEV after active exploitation

🚨 ACTIVE EXPLOITATION

• PaperCut NG/MF flaws added to KEV after active exploitation CVE-2026-81578 CVE-2026-82078
  Attackers are exploiting two PaperCut NG/MF vulnerabilities added to CISA's KEV catalog.
  • PaperCut NG and MF print-management servers used by enterprises, schools, and other organizations are affected.
  • CVE-2026-81578 is an 8.8 authentication bypass in the web management interface.
  • CVE-2026-82078 is a 9.4 unsafe dynamic class-loading flaw in database connection utilities.
  • Attackers can chain the flaws to alter configurations and execute arbitrary Java bytecode as the PaperCut server process.
  • PaperCut versions 24, 25, and 26 received emergency patches; all versions are potentially impacted, with pc-app.exe activity and anomalous server.log entries reported as indicators.
    📎 Coverage: rapid7.com · 👁 via SecurityWeek

🕵️ RESEARCH & DEEP DIVES

• Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set
  Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
  📎 Coverage: securelist.com · 👁 via Securelist (Kaspersky)

• Password-Spraying Campaign Targets AWS Root Accounts at 150+ Organizations
  Datadog observed password-spraying attacks against AWS root accounts at more than 150 organizations.

  • AWS customers across multiple industries and regions were targeted.
  • AWS root accounts, which have unrestricted access to cloud resources and account settings, were attacked.
  • The campaign ran from July 24 to August 23, 2026, with a median of two failed attempts per organization and up to eight.
  • Attackers tunneled login requests through hosting infrastructure and residential proxies across multiple countries and ASNs.
  • Observed user agents included Chrome/85.0.4183.83 with Edge/85.0.564.41 and Firefox/120.0. No successful logins were identified.
    📄 Source: securitylabs.datadoghq.com · 📎 Coverage: gbhackers.com · 👁 via Cyber Security News, cryptika.com (discovered)

🔓 CVEs & KEV

• CVE-2026-19806 — CVSS 8.8 — Support Genix through 1.4.52 - Authenticated (Subscriber+) Authentication Bypass t...

• CVE-2026-19952 — CVSS 7.5 — Frontend Admin by DynamiApps through 3.29.12 - Unauthenticated Arbitrary File Dele...

• CVE-2026-19573 — CVSS 7.2 — Affiliate Super Assistent through 1.10.2 - Unauthenticated Stored Cross-Site Scrip...

• CVE-2026-75921 — CVSS 7.2 — Master Addons for Elementor through 3.1.9 - Incorrect Authorization to Authenticat...

• CVE-2026-77189 — CVSS 6.5 — Charitable through 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'orde...

• CVE-2026-18752 — CVSS 6.5 — Persistent Login through 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wp...

• CVE-2026-18488 — CVSS 6.4 — Blocksy Companion through 2.1.51 - Authenticated (Author+) Stored Cross-Site Scrip...

• CVE-2026-75980 — CVSS 6.4 — BetterDocs through 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scriptin...

• CVE-2026-12747 — CVSS 6.4 — Frontend Admin by DynamiApps through 3.29.11 - Authenticated (Contributor+) Stored...

• CVE-2026-13203 — CVSS 6.4 — Live Composer through 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scri...

• CVE-2026-16787 — CVSS 6.4 — Live Composer through 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scri...

• CVE-2026-75965 — CVSS 6.4 — User Profile Builder through 4.0.0 - Authenticated (Contributor+) Stored Cross-Sit...

• CVE-2026-75964 — CVSS 6.1 — User Profile Builder through 4.0.0 - Unauthenticated Stored Cross-Site Scripting v...

📋 ADVISORIES

• 📄 Source for Fake Crypto AML Sites Trick Users Into Approving Wallet-Draining Transactions — malwarebytes.com