Joint AFP, Western Australia Police Force and FBI release: two West Australian men were charged on 26 August 2026 with a combined 14 offences after Perth search warrants. Police allege a syndicate inserted malicious code into software on an open-source repository that other developers then pulled in. The AFP estimates more than 1,000 organisations globally, more than 500,000 credentials, and at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. The FBI statement in that release names the group TeamPCP. The men are not named in the AFP release. The investigation continues; further arrests have not been ruled out.
OpenAI published an open letter, "A call for collective action on cyber defense," signed on that page by OpenAI, Anthropic, Google, Microsoft, AWS and a long listed set of other firms. The letter says there is a limited window to strengthen cyber defences; that in the coming months AI-enabled cyber attacks will become far more widespread and sophisticated as models become more capable; and that hospitals, water treatment plants and internet infrastructure are at risk. It argues status-quo security will not be enough, and calls on organisations, cybersecurity companies and governments to put cyber-capable AI in defenders' hands, starting with essential services. Dated 27 August 2026 in contemporaneous reporting; the letter page itself does not print a date.
ownCloud core before 10.13.1 accepts pre-signed WebDAV URLs even when the file owner has no signing-key configured (the default). If the victim username is known, an unauthenticated attacker can access, modify, or delete any of that user's files. ownCloud rates CVSS 9.8. Fixed in 10.13.1 by denying pre-signed URLs when no signing-key is set. Patch, then review access logs for unexpected WebDAV activity.
Out-of-bounds write in the Linux IPv6 send path (__ip6_append_data) when the paged-allocation branch undersizes the linear skb by fraggap bytes. An unprivileged local user can trigger it with a UDPv6 socket using MSG_MORE and MSG_SPLICE_PAGES. kernel.org rates CVSS 7.8. Red Hat describes the same flaw as a privilege-escalation and container-escape path on affected kernels. Patch to 6.1.177, 6.6.144, 6.12.95, 6.18.38 or 7.1.3, or the distro kernel that carries those stable commits. Red Hat documents a temporary workaround of user.max_user_namespaces=0; that setting breaks some container workflows.
Product
Linux kernel (IPv6)
Versions
From 6.0 until 6.1.177 / 6.6.144 / 6.12.95 / 6.18.38 / 7.1.3
Authenticated path-limitation flaw in JFrog Artifactory: under specific remote-repository conditions a user may write outside the intended Docker cache path. NVD affected builds end before 7.146.35, and 7.161.0 through builds before 7.161.16. CVSS 5.3. Patch to 7.146.35 or 7.161.16 (or later). Treat artifact caches as part of the software supply chain, not a side appliance.
ServiceNow's 27 August 2026 CVE record says it remediated an unauthenticated SQL injection in the ServiceNow AI Platform that could, in certain circumstances, let an unauthenticated user run arbitrary SQL against the instance database and read or change data beyond what was intended. ServiceNow scored it 10.0 (CVSS 4.0). Hosted instances received a vendor-deployed security update; partners and self-hosted customers were given the update. ServiceNow says it is not currently aware of malicious exploitation. The same 27 August CNA batch includes CVE-2026-6876 (Now Platform sandbox escape, CVSS 4.0 8.7) and CVE-2026-18886 (AI Platform improper access control). Self-hosted operators should apply the August 2026 CVE advisory updates. Affected CNA rows include Xanadu, Yokohama, Zurich and Australia patch families listed on the CVE record.
Product
ServiceNow AI Platform (also Now Platform for CVE-2026-6876)
Versions
CNA-listed Xanadu, Yokohama, Zurich and Australia patch-family builds (see KB3152242)
PaperCut Software's 27 August 2026 (AEST) security bulletin, last updated 28 August, says its response team is investigating active exploitation of PaperCut NG and PaperCut MF, with confirmed customer incidents. The advisory applies to all versions of both products. Immediate action: if the Application Server is reachable from the public internet, restrict web access to trusted addresses now. At 8:42pm AEST on 28 August, PaperCut published Emergency Patch Release 2 for NG/MF v25 and v26 (Windows, Linux and macOS), with extra hardening after work with Huntress and watchTowr. At 10:08pm AEST the same day it published Release 2 for v24 as well. Install Release 2 even if you already applied the original emergency patch. Versions before v24 should upgrade to the latest. The bulletin now lists CVE-2026-82078 (unsafe dynamic class loading in the database connector, CVSS 4.0 9.4 Critical) and CVE-2026-81578 (authentication bypass that can let an unauthenticated remote attacker modify certain system configurations, CVSS 4.0 8.8 High). Site Servers and secondary/print servers should be updated, not only the primary Application Server. Print Deploy and Mobility Print are not affected. ASD's ACSC had not published a matching PaperCut alert at last check.
CISA added CVE-2019-1068 to KEV on 26 August 2026 (federal due date 29 August 2026). NVD: a remote code execution issue when SQL Server incorrectly handles processing of internal functions. Apply the Microsoft security update from the MSRC advisory. Do not invent a cumulative update number here.
CISA added CVE-2026-8452 to KEV on 26 August 2026 (federal due date 29 August 2026). NVD describes a memory-overflow issue in NetScaler ADC and NetScaler Gateway that can cause unpredictable behaviour and denial of service when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Apply the fixed builds in Citrix bulletin CTX696604. This desk does not invent build numbers the bulletin page would not yield over a plain fetch.
Product
Citrix NetScaler ADC and NetScaler Gateway
Versions
Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server configurations (see CTX696604)
