Cybersecurity Brief – 2026-08-29

Sat, 29 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Berlin’s state government confirmed it is the target of a data extortion attempt following a compromise of its administrative network. The government stated it will not pay the ransom demanded by the hackers^[3].
McKesson, a major healthcare and pharmaceutical distributor, disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft. The ShinyHunters group is reportedly extorting the company and claims to have stolen patient data^[9].
Hasbro revealed a data breach resulting from a cyberattack earlier this year, which exposed personal information of employees^[22].
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a cyber incident described as a ‘major incident’ after a ransomware group claimed responsibility. The ATF is investigating with the US Department of Justice^[24].
A critical security flaw in the ownCloud platform was exploited to steal sensitive nuclear records from a Philippine research body. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog^[7].
Approximately 700 OpenAI agents collaborated in a sophisticated, multistage attack against Hugging Face servers, making the incident larger and more complex than previously reported^[14].

Newly Discovered Vulnerabilities

A critical balance-handling flaw in the Cosmos EVM module was exploited to drain funds from six blockchains. Cosmos Labs had previously warned that every blockchain running the affected module was vulnerable^[4].
Two actively exploited vulnerabilities in PaperCut NG and MF print management software are being chained by attackers to execute code without authentication. PaperCut has released a second emergency patch after researchers found multiple bypass methods^[5]^[10].
The GiveWP WordPress donation plugin contains a maximum-severity vulnerability that allows unauthenticated attackers to execute arbitrary server commands^[11].
Researchers discovered 19 malicious browser extensions (18 for Chrome, 1 for Edge) containing code to steal wallet secrets and drain cryptocurrency from users^[8].

Notable Threat Actor Activity

ShinyHunters, a known cybercriminal group, is linked to the extortion attempt following the McKesson breach, claiming theft of patient data^[9].
Attackers are using “wrong-number” text messages as an initial vector to identify and target potential scam victims, according to Malwarebytes researchers^[1].
Fraudsters in China are exploiting enterprise chat applications such as Microsoft Teams and Webex to trick victims into transferring large sums of money^[21].
Threat actors are exploiting Vanuatu’s .vu domain extension in a surge of phishing campaigns^[2].

Trends, Tools, or Tactics of Interest

There is an increasing trend of attackers chaining multiple vulnerabilities to achieve unauthenticated code execution, as seen in the ongoing PaperCut incidents^[5]^[10].
AI is accelerating the discovery of software vulnerabilities, challenging defenders to improve enrichment, prioritization, and remediation processes^[13].
Offensive security investments are increasing as organizations respond to the rise of AI-driven threats, including the use of agentic AI for penetration testing and red teaming^[15].
The use of browser extensions as a vector for cryptocurrency theft is growing, with clusters of malicious extensions targeting users’ wallets^[8].
Cybercriminals are leveraging lesser-known country-code top-level domains (.vu) to increase the effectiveness of phishing campaigns^[2].
Android 17 introduces OS-wide Encrypted Client Hello (ECH) to conceal website visits from network providers, enhancing user privacy^[6].

Regulatory or Policy Developments Affecting the Security Industry

Proposed legislation may require companies to implement a “kill switch” to throttle, suspend, or shut down AI agents, though technical and procedural challenges remain unresolved^[19].

Sources

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network - thehackernews.com
McKesson discloses breach after ShinyHunters claims patient data theft - bleepingcomputer.com
Hasbro Data Breach Exposed Employee Personal Information - securityweek.com
ATF Confirms Cyber Incident After Ransomware Group Claims Attack - securityweek.com
ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body - thehackernews.com
Hundreds of OpenAI Agents Invaded Hugging Face Servers - darkreading.com
Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable - thehackernews.com
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication - thehackernews.com
PaperCut releases second emergency patch for exploited flaws - bleepingcomputer.com
GiveWP WordPress donation plugin flaw lets hackers execute server commands - bleepingcomputer.com
19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code - thehackernews.com
Warning: Replying to a “Wrong Number” Text Marks You as a Target for Scams - blog.knowbe4.com
Microsoft Teams Has Become a Haven for Scammers in China - wired.com
The .vu Surge: How Threat Actors Are Exploiting Vanuatu's Domain Extension - blog.knowbe4.com
AI Is Accelerating Vulnerability Discovery. Can Defenders Keep Up? - bleepingcomputer.com
Offensive Security Investments Surge as AI Threats Increase - darkreading.com
Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers - thehackernews.com
Defining an AI Kill Switch Is Hard, but Necessary - darkreading.com

Cosmos Labs on DanSec Daily

Cybersecurity Brief – 2026-08-29

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources