Weekly Security Watch
Identity and trusted-access abuse are the link between this week’s most important stories. Fake support interactions, compromised third-party applications, exposed cloud credentials and poisoned development modules turn legitimate access into attack infrastructure.
Important Developments
1. PaperCut zero-days move into active exploitation
PaperCut issued a second emergency fix for actively exploited CVE-2026-82078 and CVE-2026-81578. CISA listed both in KEV; NCSC-NL rates potential damage high.
- Why you should care: Print servers often hold privileged credentials and broad network access, especially in education and government.
- Impact: Remote code execution may enable disruption and lateral movement; material Dutch incidents require Cyberbeveiligingswet assessment.
- Recommended actions: Patch now, isolate management access, review indicators, rotate service credentials and hunt for configuration changes.
Sources
https://advisories.ncsc.nl/2026/ncsc-2026-0334.html
https://www.cve.org/CVERecord?id=CVE-2026-82078
2. SonicWall SMA1000 zero-days chained for remote compromise
SonicWall warned that CVE-2026-83548 and CVE-2026-83549 are exploited and can be chained for unauthenticated code execution.
- Why you should care: Internet-facing remote-access appliances provide a direct route into internal networks.
- Impact: Sessions, credentials and services may be exposed; isolation can interrupt remote access.
- Recommended actions: Update immediately, restrict administration, inspect logs and reset sessions and credentials where compromise is possible.
Sources
https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/
3. Coder registry compromise distributes malicious Terraform modules
Attackers compromised Coder infrastructure and added registry servers that delivered credential-stealing Terraform modules.
- Why you should care: Infrastructure-as-code can carry cloud privileges and trusted deployment access across environments.
- Impact: Credential theft may enable unauthorized cloud changes, data access and costly rebuilds.
- Recommended actions: Trace affected modules, validate hashes, rotate secrets, review CI/CD logs and enforce module provenance.
Sources
4. Microsoft tracks fake IT support turning Teams sessions into enterprise access
Microsoft reported actors impersonating IT support and using remote sessions to expand access after social engineering.
- Why you should care: The method exploits trust in internal support channels and bypasses email controls.
- Impact: Account takeover, remote execution and lateral movement can follow one successful interaction.
- Recommended actions: Require ticket verification, block unsolicited remote tools, harden help-desk checks and deploy phishing-resistant authentication.
Sources
5. Manchester Airports Group data published after extortion
FulcrumSec published data linked to MAG. Confirmed exposure includes customer information; detailed scale and actor claims remain partly unverified.
- Why you should care: Contact, vehicle and travel data can support convincing fraud and impersonation.
- Impact: MAG reports no operational or payment-system impact, but privacy exposure is substantial.
- Recommended actions: N/A
Sources
6. McKesson confirms third-party application breach
U.S. healthcare company McKesson confirmed third-party application access and exfiltration affecting some healthcare customers. Claims about scale and identity-platform access are "developing."
- Why you should care: Healthcare integrations combine sensitive data with broad downstream dependencies.
- Impact: Patient privacy, fraud and supplier disruption risks may create GDPR responsibilities for EU recipients.
- Recommended actions: Inventory integrations, restrict permissions, rotate tokens, review cloud logs and separate confirmed facts from actor claims.
Sources
https://www.mckesson.com/utility/cybersecurity/customer-cybersecurity-information-center/#update
7. Active exploitation expands across JFrog, Langflow and edge software
Critical JFrog Artifactory and Langflow flaws were reportedly exploited soon after disclosure, alongside new KEV additions.
- Why you should care: Repositories and AI workflows hold trusted code, tokens and deployment paths.
- Impact: Attackers may gain privileged access, execute code or poison build pipelines.
- Recommended actions: Patch exposed instances, rotate tokens, validate artifacts and monitor new administrators, keys and outbound traffic.
Sources
https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
8. AI agents demonstrate end-to-end offensive capability
Research showed agents completing attack chains and coordinated activity against Hugging Face; widespread autonomous enterprise attacks are not established.
- Why you should care: Agents can accelerate reconnaissance, exploit adaptation and credential abuse.
- Impact: Weak permissions or exposed secrets can create rapid, scalable compromise.
- Recommended actions: Sandbox agents, separate secrets, require approval for destructive actions, log tools and test prompt-injection scenarios.
Sources
9. G7 and CISA call for post-quantum migration planning
G7 cyber authorities and CISA urged organizations to identify assets, map dependencies and plan phased post-quantum migration.
- Why you should care: Long-lived confidential data may face harvest-now-decrypt-later collection.
- Impact: Delayed planning creates future confidentiality, interoperability and vendor concentration risk.
- Recommended actions: Build a cryptographic inventory, classify secrecy lifetimes, require crypto-agility and assign executive ownership.
Sources
https://www.cisa.gov/resources-tools/resources/preparing-post-quantum-era-call-action
Takeaways
Common Patterns
Identity and trusted-access abuse link this week’s most important stories. Fake support interactions, compromised third-party applications, exposed cloud credentials and poisoned development modules turn legitimate access paths into attack infrastructure.
At the same time, exploitation of internet-facing systems continues to move faster than standard patch cycles. But this failure of control is not just explained by missing patches. Excessive privileges, incomplete asset visibility and insufficient monitoring after valid credentials are obtained all contribute to suboptimally secured digital environments.
Sector Insights
Healthcare faced the clearest business and privacy pressure through McKesson and continuing disruption around medical suppliers. The transport sector saw a large privacy event at Manchester Airports Group without reported safety impact, but the travel data enables highly credible follow-on fraud. Technology and software teams face concentrated risk in artifact repositories, infrastructure-as-code and AI tooling. Financial services and critical infrastructure should treat edge-device exploitation and post-quantum planning as resilience and dependency-management issues, not isolated security projects.
Regulatory Implications
In the Netherlands, the Cyberbeveiligingswet is now in force, so affected essential and important entities should integrate rapid incident classification, evidence preservation and management accountability into response playbooks. GDPR remains central where health, travel or customer data is exposed. DORA-regulated entities should connect third-party application incidents and concentration risk to registers of information, contractual controls and tested exit plans. The G7 post-quantum call adds a governance signal for long-lived data and critical services.
Strategic Recommendations
CISOs should set a 24-hour internal escalation path for exploited edge, repository and remote-access flaws. Security leaders should require phishing-resistant authentication for administrators and service desks, and monitor session-token misuse. Risk leaders should map critical third-party applications to services, data and recovery dependencies. Privacy officers should pre-build fact-based notification templates that separate confirmed impact from attacker claims. Across all roles, add agentic AI, infrastructure-as-code and cryptographic dependencies to the enterprise risk register and exercise them in incident scenarios.
Board-level Narrative
This week’s signal is that operational resilience increasingly depends on controls outside the traditional endpoint: identity platforms, remote-access appliances, build infrastructure, third-party applications and AI agents. A single trusted connection can expose multiple business services before malware is visible.
Boards should therefore ask whether management can identify critical external dependencies, revoke access quickly, continue priority services without them, and communicate confirmed facts within regulatory deadlines. Investment should favor measurable reduction in recovery time and blast radius: privileged-access hardening, tested isolation procedures, immutable recovery, supplier evidence, and fast patching for exploited internet-facing assets. Post-quantum migration is not an emergency patch, but delaying ownership and inventory work creates avoidable future cost and concentration risk.
This overview was generated with AI assistance and has been verified and edited by a human editor. If you have spotted a factual error, please let us know in the comments.
The information contained in this security watch is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. CISO Community and CISO Platform Nederland assume no legal liability or responsibility for any damage resulting from either the use or inability to use the information included. This includes damage resulting from the inaccuracy or incompleteness of the information contained in the briefing.
