cybr.cx Daily Digest — September 01, 2026

Critical Vulnerabilities

⚠️ Actively Exploited — CVE-2026-82078 & CVE-2026-81578 | PaperCut NG/MF

These two vulnerabilities are being chained in active attacks right now and were added to the CISA KEV catalogue on August 31. CVE-2026-81578 is an unauthenticated endpoint that allows remote modification of system configurations — no credentials required. CVE-2026-82078 then weaponises that access via unsafe reflection to execute arbitrary Java bytecode running under the PaperCut server's security context. Together they hand an unauthenticated attacker full remote code execution on any exposed PaperCut instance. Patch immediately; PaperCut has a history of rapid, widespread exploitation when vulnerabilities surface.

CVE-2026-82807 | ieungSoft Ultra RAMDisk Pro 1.82 — CVSS 8.8

A privilege escalation flaw in the URDSCSI.sys kernel driver allows a local attacker to gain SYSTEM-level privileges through improper privilege management. A public exploit already exists, the vendor has not responded to disclosure, and no patch is available. If this software is anywhere in your estate — particularly on developer or power-user machines — treat it as a local privilege escalation risk until further notice.

CVE-2026-82862 | Hulumi < v1.3.2 — CVSS 8.4

The threat-model helper script is resolved from an unsafe root path, meaning an attacker who can write files to the workspace can shadow the legitimate script with a malicious one. Arbitrary code executes during local skill execution — a classic dependency-confusion-style attack surface. Update to v1.3.2. Be particularly cautious in CI/CD environments where workspace contents may be partially attacker-controlled.

CVE-2026-82876 | Phison PS3111-S11 SSD Controller — CVSS 8.2

The firmware signature verification process embeds the trusted RSA public modulus inside the firmware image itself rather than in write-protected hardware storage. An attacker can generate their own RSA key pair, sign malicious firmware with the private key, embed the matching modulus in the signature segment, and the controller accepts it as legitimate. This effectively nullifies firmware signing as a security control for affected Phison-based SSDs. Physical or supply-chain access is the likely attack path — relevant for high-security environments and hardware supply chain assessments.

CVE-2026-66047 | ProfilePress (wp-user-avatar) WordPress Plugin < 4.17.2 — CVSS 8.1

Unauthenticated attackers can brute-force a weak 32-bit connect token via the ppress_connect_process AJAX handler, then supply an attacker-controlled URL to silently install and activate arbitrary plugins — which typically equates to unauthenticated RCE on WordPress. A 32-bit token space is trivially exhaustible. Update to 4.17.2 immediately; this plugin has a substantial install base.

CVE-2026-72001 | Pangolin < 1.22.0 — CVSS 8.1

An authentication bypass in the share-link endpoint allows anyone holding a single valid share link — for any resource — to authenticate against all protected resources by omitting the expected resource identifier from the token verification call. One leaked link equals full access. Update to 1.22.0 and audit your share link logs.

CVE-2026-56718 | AJCloud AJY IPC Firmware < 01.10715.11.37 — CVSS 7.5

A path traversal vulnerability in the jdbhttpd web service on port 80 allows completely unauthenticated remote attackers to read arbitrary files with root privileges by including traversal sequences in the HTTP URI. Credentials including cleartext passwords are directly accessible. IoT/IP camera devices are rarely patched promptly in production — assess your network perimeter for exposed instances.

Headline News

The Steam "Teraleak": 12TB of Gaming History — and a Significant Data Exposure Event

A 12TB dataset described as originating from Valve's Steam platform has circulated publicly, reportedly containing over a decade's worth of unreleased game builds, internal development assets, source code fragments, and historical data spanning multiple major titles. For security practitioners, the significance extends beyond nostalgia: leaked source code and internal tooling can expose proprietary authentication logic, API structures, and platform internals that threat actors can leverage to develop targeted attacks against Steam's infrastructure or its users. Supply chain and insider threat vectors are the obvious areas of concern — a dataset of this scale does not leave an organisation accidentally. Valve has not publicly confirmed the scope of the leak at time of publication, but the volume and apparent authenticity of the data suggest a deep, prolonged access event rather than a one-time exfiltration.

Berlin City Government Under Active Ransomware Extortion

Threat actors are publicly extorting the city of Berlin, demanding payment in exchange for not releasing data allegedly exfiltrated from municipal systems. The attack follows a now-familiar playbook: compromise government infrastructure, exfiltrate sensitive data, and apply public pressure to accelerate payment. What makes this notable for practitioners is the target profile — European municipal governments hold highly sensitive citizen data including tax records, social services information, and law enforcement-adjacent databases, and they typically operate with constrained security budgets and complex legacy IT estates. The public extortion approach, rather than a quiet negotiation, suggests the attackers are either confident in their leverage or have already determined the organisation will not pay privately. Defenders supporting public sector clients should review their incident response and data exfiltration detection capabilities accordingly.

Military Commissary Freezers: An ICS Security Wake-Up Call in Plain Sight

A first-person account of anomalous behaviour in a US military commissary's commercial refrigeration systems has raised credible questions about whether internet-connected building management or industrial control systems at a military facility were accessed or manipulated. The specific indicators observed — erratic temperature control behaviour inconsistent with hardware failure — are consistent with known attack patterns against SCADA and BMS systems that use default credentials or expose management interfaces to external networks. Whether or not this specific incident constitutes a confirmed intrusion, it illustrates the persistent and underappreciated attack surface that OT and building management systems represent, including at sensitive government and military sites. Practitioners responsible for facility security or OT environments should treat commercial refrigeration, HVAC, and building automation systems with the same scepticism they apply to corporate IT assets.

Schrödinger's Feed

MIT's quantum initiative has launched its first cohort of QMIT postdoctoral fellows this autumn, specifically tasked with advancing interdisciplinary quantum research with a focus area that includes securing wireless communications in next-generation devices. This is a direct acknowledgement from one of the field's most influential institutions that the security implications of quantum computing — particularly for wireless protocols — need dedicated research attention now, not after capable quantum hardware arrives. The intersection of quantum sensing, quantum key distribution, and post-quantum cryptographic standards for wireless is still a relatively sparse research space. Practitioners building long-lived wireless infrastructure today should be watching this space closely — "harvest now, decrypt later" attacks make near-term decisions about wireless encryption architectures genuinely consequential.

/dev/random

Someone has repurposed their home security camera system to automatically identify bird species in real time using BirdNET-Go, an open-source acoustic and visual bird recognition model, routed through the existing camera feeds. The result is a garden surveillance apparatus that logs every avian visitor with species-level precision — which means the motion detection is now equally likely to alert on a nuthatch as an intruder. Setting aside the ornithological productivity gains, there's a quietly interesting security observation buried here: consumer IP cameras are general-purpose compute nodes with network access, and most of their owners have no idea what else is running on them. At least this particular deployment added known software.