Cyber Roundup — Week of August 31st
جدول المحتويات
Here are the main stories you missed last week.
1. Microsoft Exchange: CVE-2026-62911 lets any attacker with basic network access take over every mailbox on a server, and 21,899 servers are still unpatched
The headline: As of August 31, 21,899 internet-facing Microsoft Exchange servers remained unpatched against CVE-2026-62911, an authentication bypass by capture-replay flaw that Microsoft fixed in its August 11 Patch Tuesday. The Netherlands National Cyber Security Centre reported on August 28 that public exploit code for the vulnerability is already circulating online. Shadowserver’s daily scans identified 6,200 vulnerable instances in the United States and 5,100 in Germany. Germany’s Federal Office for Information Security separately warned that approximately 85% of on-premises Exchange servers in the country remain vulnerable. CVE-2026-62911 was discovered by DEVCORE researcher Orange Tsai and carries a CVSS score of 8.0. Microsoft’s own advisory confirms that a successful attacker can take over the mailboxes of all Exchange users, including reading and sending email and downloading attachments. Exchange Server 2016 and 2019 are both out of mainstream support; only organizations enrolled in the Period 2 Extended Security Update program will receive patches through October 2026.
What we’re actually watching: Three weeks after patch release, 85% of German on-premises Exchange servers are still exposed and public exploit code is already available. That combination, known exploitation path, public tooling, and a large unpatched population, is the exact precondition that produced the ProxyLogon and ProxyShell mass exploitation waves. Exchange is not a peripheral system. It processes every email, calendar entry, and meeting request in an organization. A full mailbox takeover gives an attacker the ability to read communications, reset passwords by intercepting verification emails, and conduct business email compromise at a scale and credibility that external phishing cannot match.
The MRSProxy endpoint at the root of this vulnerability is an internet-reachable Exchange component that fails to enforce Extended Protection for Authentication. An attacker captures NTLM authentication traffic from an Exchange machine account, replays it, and bypasses authentication entirely. Organizations that have applied the August Patch Tuesday but not verified their specific build number should double-check: sub-versions of Exchange Server SE, 2019 CU15 and CU14, and 2016 CU23 before the August security update remain exploitable even if cumulative updates were applied earlier in the year. This follows a pattern we have covered in recent weeks: a patch ships, organizations assume compliance, and a significant proportion of the exposed population remains vulnerable weeks later because patch verification processes do not confirm the actual binary version running in production.
The CISO question: For every on-premises Exchange server in your environment, have you verified the exact build number rather than assuming cumulative update status provides protection, confirmed that Extended Protection for Authentication is enabled on all virtual directories, and reviewed mail flow and authentication logs for evidence of NTLM relay activity that may indicate exploitation before the patch was applied?
2. Manchester Airports Group: FulcrumSec found an API key in public JavaScript and walked out with 8.7 million customer records, 200,000 of them tied to upcoming travel
The headline: Manchester Airports Group confirmed on August 27 that an unauthorized third party accessed customer data across Manchester, London Stansted, and East Midlands airports. The breach affected car park, lounge, Fast Track booking, and in-airport Wi-Fi registration systems. The extortion group FulcrumSec claimed responsibility on August 30, telling BleepingComputer it stole 86 GB by exploiting Iterable API credentials exposed in client-side JavaScript. By September 3, FulcrumSec published the data on its leak site, clarifying that 86 GB reflected its own compression and that the files expand to roughly 640 GB. MAG confirms approximately 8.7 million customers are affected, primarily by email address exposure. FulcrumSec’s samples include a 21.5 GB consolidated customer export with booking histories and marketing classifications, and the group claims the haul includes nearly 200,000 records tied to upcoming travel through the rest of 2026, complete with passenger names, dates, terminals, booking references, and vehicle registrations. BleepingComputer validated one traveler’s record from the samples. MAG has confirmed no bank details, payment card data, passwords, or passport numbers were stored in the affected system. The company refused to pay a ransom.
What we’re actually watching: FulcrumSec did not hack Manchester Airports Group. It read a JavaScript file on a public webpage, found an API key, and used it to authenticate to a customer engagement platform with access to eight and a half million customer records. No server intrusion was required. No credential was stolen. The key was in the source of a publicly accessible page, placed there by a developer who needed it to initialize a client-side marketing tool and did not consider that every visitor to the page could read it too.
The 200,000 upcoming travel records are the most operationally significant part of this breach. A UK postcode combined with a name, travel date, terminal, and booking reference is precise enough to enable targeted physical fraud, including impersonation at airport services, tailored vishing calls referencing specific booking details, and physical surveillance of travelers whose complete itineraries are now publicly available. Unlike a credential dump, this data cannot be changed. The trips are happening. The data is published. CybelAngel monitors dark web leak sites and criminal forums for customer data from organizations in our clients’ ecosystems, surfacing exposure before it becomes the basis for downstream attacks against shared customers or partners.
The CISO question: Does your organization scan its own client-side JavaScript for exposed API keys, authentication tokens, and service credentials before deploying to production, and do you have a process for rotating credentials that may have been exposed in public-facing code for any period before discovery?
3. Google Chrome: CVE-2026-85046 is the sixth V8 zero-day exploited in 2026 and was confirmed under active attack before the patch shipped on September 3
The headline: جوجل released an emergency Chrome update on September 3 fixing CVE-2026-85046, a type confusion vulnerability in V8, Chrome’s JavaScript and WebAssembly engine, that allows a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. The vulnerability carries a CVSS score of 8.8. Google confirmed it was aware of active exploitation before the patch shipped. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4 with a federal remediation deadline of September 18. The fix is included in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux. CVE-2026-85046 is the sixth actively exploited Chrome zero-day Google has patched in 2026. The vulnerability was reported on August 4 by researcher Salvatore Gulizia and awarded a $1,000 bug bounty.
What we’re actually watching: Six exploited Chrome zero-days in nine months is not an aberration. It is the baseline production rate for V8 vulnerabilities in an environment where browser exploitation remains one of the most reliable initial access vectors available to sophisticated threat actors. V8’s JavaScript engine optimizations create recurring type confusion conditions as the compiler makes assumptions about object types that attackers can violate with crafted JavaScript. The pattern has produced exploitable flaws in 2024, 2025, and 2026 at a consistent rate despite Google’s continuous hardening efforts.
The pre-patch exploitation window between August 4, when the vulnerability was reported, and September 3, when the fix shipped, is 30 days. That window represents the period during which any threat actor with independent discovery of the same bug, or access to the research before responsible disclosure completed, had a reliable browser exploitation capability against every Chrome user on the planet. Organizations that investigate suspicious browser activity only after a patch is confirmed should factor that 30-day pre-patch window into their retrospective review scope for CVE-2026-85046.
The CISO question: For every managed device in your environment running Chrome, have you confirmed that the update to version 152.0.7977.82 or later has been applied, and have you reviewed web proxy and EDR telemetry for suspicious browser activity occurring between August 4 and September 3 that may indicate exploitation during the pre-patch window?
4. PaperCut: Two chained vulnerabilities giving unauthenticated attackers code execution on print management servers were added to CISA KEV on August 31
The headline: سايزا added CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog on August 31 with a September 14 federal remediation deadline. CVE-2026-81578 (CVSS 8.8) is a missing-authentication flaw in PaperCut NG and PaperCut MF that allows an unauthenticated attacker to modify server configurations by invoking privileged components without credentials. CVE-2026-82078 (CVSS 9.4) is an unsafe reflection vulnerability that allows an attacker who has modified configurations via CVE-2026-81578 to execute arbitrary Java bytecode under the PaperCut server process’s security context. PaperCut patched both vulnerabilities on August 28. Huntress confirmed active exploitation in two customer environments, observing attackers running reconnaissance commands including whoami, ver, and tasklist within two-minute sessions. A Metasploit module for the exploit chain is now publicly available.
What we’re actually watching: PaperCut was extensively exploited in 2023, when CVE-2023-27350 was weaponized by Cl0p and LockBit affiliates within days of public disclosure. The 2023 campaign produced confirmed intrusions across universities, healthcare organizations, and government agencies globally. The same platform is under active attack again in 2026, with a two-vulnerability chain that produces unauthenticated code execution and a publicly available Metasploit module. The organizations that did not fully remediate their 2023 PaperCut exposure, and a significant number did not, face a platform with a documented exploitation history now under its second major attack cycle.
PaperCut’s deployment profile makes it a high-value target for attackers seeking network footholds. It integrates with enterprise identity systems including Active Directory, is deployed on internal networks with broad printer connectivity, and manages user authentication and document workflows across organizations. The Huntress observation that attackers were running only reconnaissance commands in confirmed exploitation suggests the active wave is in its early stages: identifying and inventorying compromised hosts before deploying secondary payloads. Organizations that confirm compromise should treat the PaperCut server as a staging point for a follow-on intrusion rather than a contained incident.
The CISO question: For every PaperCut NG or MF server in your environment, have you applied the August 28 patches, confirmed that the management interface is not internet-accessible, reviewed PaperCut application logs for reconnaissance command execution consistent with the Huntress-documented attack chain, and treated any confirmed exploitation as the beginning of a broader intrusion rather than a contained event?
5. APT28: Russia’s most active cyber unit deployed a new HOOKEDGE backdoor across European targets this week while the EU elections approach
The headline: Security researchers confirmed this week that APT28, the Russian military intelligence unit also tracked as Fancy Bear and Forest Blizzard, deployed a previously undocumented backdoor named HOOKEDGE across multiple European targets. HOOKEDGE establishes persistent access through a combination of scheduled tasks and COM hijacking, communicates over HTTPS using legitimate cloud service infrastructure for C2 traffic obfuscation, and is designed to survive system reboots and common endpoint security removal procedures. The campaign targets government, defense-adjacent think tanks, and election administration infrastructure across EU member states. The timing places APT28’s latest European campaign less than two months before the EU parliamentary committee elections scheduled for November 2026.
What we’re actually watching: APT28 deploying a new, previously undocumented backdoor specifically against election-adjacent infrastructure in the two months before a major European election is consistent with their operational pattern going back to the 2016 US election and the 2017 French presidential campaign. New tooling means new detection signatures need to be built from behavioral indicators rather than known file hashes. HOOKEDGE’s use of legitimate cloud service infrastructure for C2 means perimeter controls filtering on destination IP reputation will not catch it. The traffic looks like normal cloud service usage because it is using normal cloud service infrastructure.
The COM hijacking persistence mechanism is worth specific attention for incident response teams. COM object hijacking does not require elevated privileges, does not write to monitored registry locations in ways that standard persistence detection covers, and survives many endpoint security removal procedures that catch more conventional persistence techniques. Organizations in APT28’s target profile, including government contractors, defense think tanks, political consulting firms, and election administration, should treat the HOOKEDGE disclosure as a threat-hunting trigger rather than a passive awareness item.
The CISO question: For organizations in sectors that have historically been APT28 targets, have you deployed threat-hunting queries for COM hijacking persistence and outbound HTTPS traffic to cloud service infrastructure from unusual process trees, and does your incident response plan account for the scenario where initial access occurred weeks or months before this week’s HOOKEDGE disclosure?
The pattern across all five stories
Last week’s incidents shared a characteristic that does not show up in CVSS scores or KEV deadlines: in each case, the exposure was older than the headline.
The gap between when exposure begins and when anyone finds out is where CybelAngel operates. We scan your external attack surface continuously so the gap is measured in hours, not weeks.
عن المؤلف
