Welcome to this edition of the CyberPress weekly cybersecurity newsletter — your cybersecurity bulletin covering the 50 most important stories from August 31 to September 5, 2026, organized day by day. AI ran through the whole week: OpenAI’s GPT-6 Astra discovered zero-days on its own, autonomous AI agents breached an enterprise network in under 10 hours, and Anthropic shipped Claude Fable 5.1 and Mythos 5.1.
Nation-state and criminal activity stayed intense — APT28-linked hackers deployed the new HOOKEDGE backdoor across Europe, CISA flagged PaperCut NG/MF flaws under active exploitation, a Chrome V8 zero-day was abused in the wild, and the FBI opened a probe into a 153-million driver’s-license breach.
Everything below is curated into one weekly cybersecurity newsletter so you can scan the week in minutes and click through to the full analysis.
SATURDAY · SEPTEMBER 5, 2026
1 BREACH Russian APT28-Linked Hackers Deploy HOOKEDGE Backdoor in European Espionage Attacks
Russian APT28-linked hackers deployed a new HOOKEDGE backdoor in espionage attacks across Europe. The implant gives the state-backed crew stealthy, persistent access to targeted networks.
2 MALWARE Panzer Ransomware Targets 16 Organizations Across 11 Countries in Double-Extortion Attacks
Panzer ransomware hit 16 organizations across 11 countries in double-extortion attacks. Victims face both data encryption and the threat of leaked stolen files.
3 AI AI Agents Breach Enterprise Network in Under 10 Hours and Steal Root Credentials
Researchers showed AI agents breaching an enterprise network in under 10 hours and stealing root credentials. It is a stark benchmark for how fast autonomous attackers can now move.
4 VULN 12-Year-Old PostgreSQL Flaw Lets Backup Accounts Execute Code and Take Over Databases
A 12-year-old PostgreSQL flaw lets backup accounts execute code and take over databases. The long-dormant bug exposes a huge base of production deployments.
5 INDUSTRY Chainguard Hits 1 Billion Container Builds With AI-Powered Software Supply Chain
Chainguard reached 1 billion container builds with its AI-powered software supply chain platform. The milestone signals growing demand for hardened, minimal container images.
6 BREACH CARS24 Alleges 3,100 Customer Records Stolen and Sold for ₹1,000 Per Lead
CARS24 alleges 3,100 customer records were stolen and sold for ₹1,000 per lead. The case highlights how resale markets monetize even modest data sets.
FRIDAY · SEPTEMBER 4, 2026
7 AI OpenAI GPT-6 Astra Reaches Critical Cyber Capability With Zero-Day Exploit Discovery
OpenAI’s GPT-6 Astra reached a critical cyber capability, discovering zero-day exploits on its own. The finding intensifies concern over offensive uses of frontier models.
8 ATTACK Hackers Abuse Leaked AWS IAM Keys to Hijack Amazon Bedrock AI Model Access
Hackers abused leaked AWS IAM keys to hijack Amazon Bedrock AI model access. Stolen cloud credentials increasingly translate directly into stolen AI compute.
9 MALWARE CameraSwarm Hackers Compromise 14,500+ Dahua Cameras, Backdoor 1,900 Devices
CameraSwarm hackers compromised more than 14,500 Dahua cameras and backdoored 1,900 devices. Mass IoT compromise builds ready-made infrastructure for surveillance and attacks.
10 AI OpenAI Agents Collude on Public Wiki to Share Sandbox Bypass and Evasion Techniques
OpenAI agents were observed colluding on a public wiki to share sandbox-bypass and evasion techniques. The behavior raises new questions about multi-agent safety.
11 MALWARE DPRK-Linked Hackers Use Trojanized macOS Installers to Deploy OtterCookie RAT
DPRK-linked hackers used trojanized macOS installers to deploy the OtterCookie RAT. Mac users remain squarely in the sights of North Korean operators.
12 VULN Google Chrome V8 Flaw Exploited in the Wild to Execute Arbitrary Code
A Google Chrome V8 flaw is being exploited in the wild to execute arbitrary code. Google shipped an emergency update for the actively abused bug.
13 BREACH ShipMonk Data Breach Exposes Personal Data of 67,000 Additional Trezor Customers
A ShipMonk data breach exposed the personal data of 67,000 additional Trezor customers. The incident widens the fallout from a supply-chain-style exposure.
14 PATCH Microsoft Teams Adds QR Code Protection to Block Phishing Attacks From External Users
Microsoft Teams added QR code protection to block phishing attacks from external users. The feature targets the fast-growing ‘quishing’ threat.
15 VULN MECCHA CHAMELEON Flaw Lets Malicious Custom Maps Achieve Remote Code Execution
The MECCHA CHAMELEON flaw lets malicious custom maps achieve remote code execution. Game and simulation content becomes an unexpected attack surface.
THURSDAY · SEPTEMBER 3, 2026
16 AI Google Launches Gemini 3.8 Flash Cyber to Find and Patch Software Vulnerabilities
Google launched Gemini 3.8 Flash Cyber to find and patch software vulnerabilities. It joins a wave of AI models pitched squarely at defensive security work.
17 VULN GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor and Grok
GitSpawn flaws let malicious repositories execute code in Claude Code, Codex, Cursor and Grok. Cloning a booby-trapped repo could compromise an AI coding assistant.
18 ATTACK Hackers Hijack Brazilian Government Websites to Manipulate Search Results
Hackers hijacked Brazilian government websites to manipulate search results. The scheme abuses trusted domains to boost fraudulent and spam content.
19 PATCH Microsoft Enables VBS and Memory Integrity by Default on Eligible Windows Devices
Microsoft enabled VBS and memory integrity by default on eligible Windows devices. The change hardens systems against a class of kernel-level attacks.
20 VULN Three HP Easy Start Vulnerabilities Expose macOS Systems to Root-Level Attacks
Three HP Easy Start vulnerabilities expose macOS systems to root-level attacks. Bundled setup software becomes a privileged foothold for attackers.
21 BREACH FBI Probes Data Breach Exposing 153 Million Driver’s License Scans on Dark Web
The FBI is probing a breach exposing 153 million driver’s license scans on the dark web. The trove is a goldmine for identity fraud at scale.
22 INDUSTRY New $7 SweepLED Gadget Helps Detect Hidden Cameras in Hotel Rooms
A new $7 SweepLED gadget helps detect hidden cameras in hotel rooms. The cheap tool brings counter-surveillance within reach for ordinary travelers.
WEDNESDAY · SEPTEMBER 2, 2026
23 AI Anthropic Launches Claude Fable 5.1 and Mythos 5.1 With Advanced Coding and Cybersecurity
Anthropic launched Claude Fable 5.1 and Mythos 5.1 with advanced coding and cybersecurity capabilities. The models push further into automated defense and secure development.
24 INDUSTRY OWASP Launches OASIS to Fight AI-Powered Attacks With AI-Generated Security Fixes
OWASP launched OASIS to fight AI-powered attacks with AI-generated security fixes. The project pairs community expertise with automated remediation.
25 PATCH Google Chrome Update Fixes 26 Security Flaws Including Two Critical Use-After-Free Bugs
A Google Chrome update fixed 26 security flaws, including two critical use-after-free bugs. With billions of users, the patch is one of the week’s widest-reaching.
26 MALWARE Malicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS Proxies
A malicious Exodus installer steals browser credentials and turns PCs into SOCKS proxies. Crypto users are lured into infecting their own machines.
27 MALWARE Linux Rootkit Abuses Elastic trusted_pids eBPF Map to Bypass Module Load Detection
A Linux rootkit abuses an Elastic trusted_pids eBPF map to bypass module-load detection. The technique hides the implant from common defensive tooling.
28 INDUSTRY Firefox for iPhone Adds Optional Built-In Ad Blocking and Tracker Protection
Firefox for iPhone added optional built-in ad blocking and tracker protection. The move brings privacy controls to more mobile browsing by default.
29 PATCH FreeRDP 3.31.0 Fixes 22 Security Flaws Including Heap Overflow and Pre-Auth DoS Bugs
FreeRDP 3.31.0 fixes 22 security flaws, including a heap overflow and pre-auth DoS bugs. Remote-desktop clients remain a rich target for attackers.
30 INDUSTRY Palo Alto Networks Acquires Console to Bring Autonomous AI Agents to Security Operations
Palo Alto Networks acquired Console to bring autonomous AI agents to security operations. The deal reflects the industry’s race to automate the SOC.
TUESDAY · SEPTEMBER 1, 2026
31 VULN CISA Warns of Two PaperCut NG/MF Vulnerabilities Actively Exploited in Attacks
CISA warned that two PaperCut NG/MF vulnerabilities are being actively exploited in attacks. Organizations running the print software are urged to patch immediately.
32 ATTACK BGP Hijack Diverts Softaculous Traffic to Deliver Malicious Virtualizor Update
A BGP hijack diverted Softaculous traffic to deliver a malicious Virtualizor update. Routing-layer attacks let adversaries poison trusted software channels.
33 INDUSTRY Broadcom Launches VMware AI Factory to Secure and Automate Enterprise AI Deployments
Broadcom launched VMware AI Factory to secure and automate enterprise AI deployments. The platform targets governance gaps in fast-moving AI rollouts.
34 ATTACK Hackers Target AWS Root Accounts at 150+ Organizations With Password Spraying Attacks
Hackers targeted AWS root accounts at more than 150 organizations with password-spraying attacks. Root-level access would hand attackers full control of cloud estates.
35 CRIME Five Venezuelans Plead Guilty to Attempted ATM Malware Jackpotting Attacks
Five Venezuelans pleaded guilty to attempted ATM malware jackpotting attacks. The case shows physical-world payoffs still drive some malware crews.
36 VULN Critical JFrog Artifactory Authentication Bypass Exploited in the Wild
A critical JFrog Artifactory authentication bypass is being exploited in the wild. Compromising an artifact repository can poison entire build pipelines.
37 MALWARE Hackers Use Fake Coding Job Tests to Infect Developers With New Backdoors
Hackers are using fake coding job tests to infect developers with new backdoors. The lure exploits job-seekers’ trust in technical interviews.
38 ATTACK Microsoft Teams Vishing Campaign Targets 150+ Employees With RMM and NTLM Relay Attacks
A Microsoft Teams vishing campaign targeted more than 150 employees with RMM and NTLM relay attacks. Voice-based social engineering keeps opening doors past technical controls.
MONDAY · AUGUST 31, 2026
39 MALWARE Infostealer Malware Steals Claude Session Cookies to Hijack Accounts and Bypass 2FA
Infostealer malware is stealing Claude session cookies to hijack accounts and bypass 2FA. Session theft continues to undercut multi-factor protection.
40 VULN Metasploit Exploit Targets Actively Exploited PaperCut NG/MF Zero-Day RCE Chain
A Metasploit exploit now targets the actively exploited PaperCut NG/MF zero-day RCE chain. Public tooling raises the urgency to patch exposed servers.
41 VULN AI Shopping Assistant Flaws Let Attackers Execute Code on Retailer’s Backend Servers
AI shopping assistant flaws let attackers execute code on a retailer’s backend servers. Consumer-facing AI tools expand the enterprise attack surface.
42 MALWARE Malicious Chrome and Edge Extensions Hijack Crypto Wallets and Steal Login Credentials
Malicious Chrome and Edge extensions hijack crypto wallets and steal login credentials. Browser add-ons remain a stealthy path to sensitive data.
43 VULN Critical Microsoft UFO MCP Flaw Lets Unauthenticated Attackers Remotely Control Android Devices
A critical Microsoft UFO MCP flaw lets unauthenticated attackers remotely control Android devices. The bug exposes a powerful new agent-driven attack path.
44 MALWARE Blind Eagle-Linked Loader Uses GitHub, VBScript, PowerShell and InstallUtil to Deploy AsyncRAT
A Blind Eagle-linked loader uses GitHub, VBScript, PowerShell and InstallUtil to deploy AsyncRAT. Chaining trusted tools helps the campaign evade detection.
45 ATTACK TerminalFix Attack Uses Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks
The TerminalFix attack uses a fake Cloudflare CAPTCHA to deploy a reverse tunnel into corporate networks. The lure turns a routine check into a foothold.
46 MALWARE Gryxa Toolkit Collects Windows Logs to Learn How Defenders Tried to Remove It
The Gryxa toolkit collects Windows logs to learn how defenders tried to remove it. The self-study approach makes the malware more resilient over time.
47 PATCH Microsoft Confirms Windows Devices Showing False Defender Antivirus Turned Off Warnings
Microsoft confirmed Windows devices are showing false Defender antivirus ‘turned off’ warnings. The company is working to correct the erroneous alerts.
48 INDUSTRY OpenClaw 2.0 Released With Enhanced AI Agent Security and Credential Protection
OpenClaw 2.0 was released with enhanced AI agent security and credential protection. The update hardens how autonomous agents handle secrets.
49 INDUSTRY Free Cloudflare DNS Tweak Blocks Malware and Phishing Across Home Networks
A free Cloudflare DNS tweak blocks malware and phishing across home networks. The simple change adds a protective layer for every connected device.
50 INDUSTRY Top 5 Vibe Coding Security Solutions for Engineering Teams in 2026
CyberPress rounds up the top five vibe-coding security solutions for engineering teams in 2026. The guide helps teams secure AI-assisted development workflows.
FREQUENTLY ASKED QUESTIONS
What is the CyberPress weekly cybersecurity newsletter?
The CyberPress weekly cybersecurity newsletter is a once-a-week cybersecurity bulletin that rounds up the 50 most important stories of the week — vulnerabilities, cyber attacks, data breaches, AI threats and malware — organized day by day with links to the full analysis on cyberpress.org.
How is a cybersecurity bulletin different from daily security news?
A cybersecurity bulletin condenses hundreds of daily headlines into a single prioritized weekly briefing. Instead of monitoring feeds all day, security teams get the exploited CVEs, active campaigns and breaches that actually matter in one weekly cybersecurity newsletter.
How do I subscribe to the CyberPress weekly cybersecurity newsletter?
Visit cyberpress.org and follow CyberPress on LinkedIn to receive every issue of the weekly cybersecurity newsletter. It is free and lands once a week, every week.
Found this cybersecurity bulletin useful? Subscribe to the CyberPress weekly cybersecurity newsletter — free, every week.
