Friday, August 28, 2026
Daily digest
Two urgent patch-now items lead today: three maximum-severity (CVSS 10.0) ServiceNow AI Platform flaws and an actively-exploited PaperCut zero-day hitting all NG/MF versions — both demand immediate attention from self-hosted/on-prem admins.
Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL
ServiceNow patched four vulnerabilities in its AI Platform, three rated CVSS 10.0, that allow unauthenticated code injection, SQL injection, and privilege escalation. Hosted instances have already been updated automatically, but self-hosted customers must apply the update themselves.
Why it matters: If ServiceNow is self-hosted or run via partner instances anywhere in scope, patch immediately — unauthenticated max-severity RCE/SQLi in a platform likely storing CUI is a reportable-incident-level risk under NIST 800-171.
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
PaperCut confirmed active zero-day exploitation against all versions of PaperCut NG and MF print management software, with confirmed customer incidents already reported. An emergency patch was released for v25 and v26; no official fix exists for earlier versions.
Why it matters: PaperCut is common in government/enterprise print environments; if deployed, patch to v25/v26 immediately or take the server offline — unpatched instances on older versions have no official fix and are being actively hit.
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel released patches for two critical Next.js vulnerabilities enabling unauthenticated remote code execution: one via crafted AVIF image files, the other a Windows filesystem path-traversal flaw (CVE-2026-75604).
Why it matters: Any internally developed or third-party web apps built on Next.js hosted on Windows servers should be patched immediately — unauthenticated RCE is directly exploitable from the internet.
China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
VulnCheck disclosed two factory-installed firmware implants, SPEAKINGSTONE and DARKLANTERN (CVE-2026-74232, CVE-2026-74233), in routers built by Shenzhen Zhibotong Electronics that grant unauthenticated root access. ZBT hardware is widely white-labeled and sold globally under other brand names.
Why it matters: Under CMMC/NIST 800-171 supply-chain requirements, verify network hardware isn't OEM'd from ZBT — white-labeling makes origin hard to confirm, and this aligns with the new White House ban on foreign-made grid/power equipment for similar backdoor concerns.
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future's Insikt Group identified a new APT28-linked backdoor, HOOKEDGE, deployed against government and diplomatic targets in Romania, Spain, and Türkiye between September 2025 and April 2026. The backdoor is a lightweight Windows batch script distributed to targeted organizations.
Why it matters: APT28 (Russian GRU) actively targets government/diplomatic entities similar in profile to CMMC-regulated defense contractors; watch for batch-script-based initial access techniques in EDR/SIEM detections.
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
Australian Federal Police charged two men, aged 23 and 21, with 14 offenses over their alleged role in TeamPCP, the group behind the March 2026 compromise of open-source tools Trivy, Checkmarx KICS, and the LiteLLM AI gateway that reportedly infected over 1,000 organizations.
Why it matters: If Trivy, Checkmarx KICS, or LiteLLM are used in your container scanning or self-hosted AI pipeline, confirm you're on patched versions — this was a widespread supply-chain compromise of common DevSecOps tooling.
White House bans foreign-made equipment for power generation over cyber backdoor concerns
The Trump administration issued a ban on acquiring foreign-made components used in electricity and power generation management, citing evidence that foreign actors are creating and exploiting backdoors in the technology.
Why it matters: Signals tightening federal supply-chain scrutiny in the same vein as CMMC hardware/software provenance requirements — expect similar bans to extend to networking and IT hardware categories over time.
DHS names DOGE staffer as next CIO
DHS appointed Kyle Schutt, a DOGE team member previously detailed to CISA, GSA, HHS, and FEMA, as its new CIO, replacing Antoine McCord. Schutt has a notably limited public/digital footprint.
IRS still looking for hundreds of IT assets assigned to former employees
A TIGTA watchdog report found the IRS has been unable to locate nearly 600 laptops, portable printers, and smartphones assigned to employees among the 22,000 who departed the agency recently.
Why it matters: A cautionary example for CMMC-scoped asset management controls (AC/MP families) — offboarding workflows must confirm device recovery/wipe before an employee's access is fully terminated, particularly for Intune-managed fleets.
Microsoft preps this year's Windows 11 feature tweaks: 26H2 hits Release Preview
Windows 11 version 26H2 has entered the Release Preview channel, remaining on the same servicing branch as 24H2 and 25H2. The update brings incremental feature changes ahead of general availability.
Why it matters: Begin ring-based testing in Intune now against 26H2 Release Preview builds before broad rollout, especially since it shares a servicing branch history with 24H2/25H2 update quality issues.
Extend Amazon Bedrock Guardrails to Tool Interactions Using the Strands Agents SDK
AWS published guidance on extending Amazon Bedrock Guardrails beyond the model boundary to cover AI agent tool invocations and external data flows, using three validation checkpoints built with the Strands Agents SDK.
Why it matters: Relevant if any self-hosted AI/agentic workloads run in AWS GovCloud via Bedrock — model-level guardrails alone don't cover tool-call data exfiltration paths, a gap increasingly exploited (see the Hugging Face and Amazon Kiro incidents this week).
Red Hat announces GA of automation orchestrator for Ansible Automation Platform
Red Hat announced general availability of a new automation orchestrator for Ansible Automation Platform, aimed at unifying IT workflows at scale. Separately, Red Hat Hardened Images now support AWS InspectorScan API and ECR Basic scanning for supply-chain integrity verification.
Why it matters: Worth evaluating for consolidating Ansible playbook orchestration across the Nutanix AHV and hybrid-cloud environment; the AWS ECR/InspectorScan integration also aids container image compliance evidence for CMMC assessments.