Welcome to today's edition of Secret CISO, where we sift through the last 48 hours of breaches, research, and exploited flaws so you don't have to. It's been a loud stretch: a British airport operator is confirming one of the largest customer data breaches in its sector's history, and a German capital is refusing to bow to a ransomware gang's countdown clock just weeks before an election.

On the corporate front, a medical device giant is still digging out from a cyberattack that pro-Russian hackers claim credit for, a UK electric-vehicle salary-sacrifice broker is watching hundreds of thousands of driver records get hawked for pocket change, and a toy-making giant's employees are learning their Social Security numbers were exposed months after the intrusion that took them.

Security researchers had just as busy a stretch. A firmware audit of budget routers sold worldwide turned up not one but two unauthenticated backdoors quietly phoning home, while a fresh Palo Alto Networks report tries to separate real AI-powered malware from the noise of researchers slapping "ChatGPT" into a sample's filename. Meanwhile, a proof-of-concept for bypassing Microsoft Defender's own patch is circulating, and Apache's Tomcat maintainers disclosed a batch of access-control quirks that could quietly expose resources you thought were locked down.

The exploited-vulnerability list is just as packed. A Citrix NetScaler flaw that Citrix once called a mere denial-of-service is now confirmed unauthenticated remote code execution, and CISA's deadline for patching it just passed. PaperCut is still shipping emergency patches for a chainable pair of zero-days after attackers beat them to the punch. And a SQL injection flaw in a popular BI tool let attackers walk straight into admin panels at two well-known startups.

Rounding it out, we've got a Windows kernel driver zero-day that North Korea's Lazarus Group quietly rode for weeks before a patch arrived, and yet another authentication bypass in remote-monitoring software that's now a favorite pivot point into managed service providers' client networks.

Let's get into it.

Data Breaches

1. Manchester Airports Group Confirms 86GB Customer Data Theft: The extortion group FulcrumSec says it stole roughly 86GB of data, including consolidated customer profiles, from Manchester Airports Group after finding airport-specific Iterable API credentials exposed in client-side JavaScript. MAG confirmed a breach affecting roughly 8.7 million customers across Manchester, London Stansted, and East Midlands airports, primarily exposing email addresses, booking histories, and Wi-Fi registrations, though it says no payment card data was stored on the compromised systems. Source: BleepingComputer
2. Berlin Refuses Rhysida's Ransom Ahead of Elections: The Rhysida ransomware gang claims it stole 5.79TB of data, including 46,500 contracts, from Berlin's state government network, with exfiltration traced to a window between August 7 and 12. The gang demanded roughly 30 bitcoin (about $2.3 million) and set a one-week countdown, but Berlin's mayor and interior senator jointly declared the city "will not submit to extortion," leaving the leaked trove's fate unresolved just weeks before a local vote. Source: The Hacker News
3. Boston Scientific Cyberattack Disrupts Global Operations: Medical device maker Boston Scientific disclosed a cyberattack causing a "global disruption," preventing access to certain business systems and disrupting its ability to process and ship customer orders, with manufacturing staff in Cork, Ireland sent home. The pro-Russian hacktivist-styled group Server Killers claimed responsibility, though Boston Scientific says the unauthorized activity appears limited to on-premise systems with no impact to cloud applications. Source: TechCrunch
4. 877,000 Love Electric Driver Records Offered for $600: A seller on a data-breach forum claims to have obtained the full driver database of Love Electric, a UK broker for electric-vehicle salary-sacrifice schemes, offering 877,000 records for just $600 in cryptocurrency. Researchers who examined a sample found strong internal consistency, including correctly linked National Insurance numbers and driver-to-quote relationships, suggesting the leak likely came from a genuine production database. Source: Security Affairs
5. Hasbro Discloses Employee Data Breach Tied to March Intrusion: Toy maker Hasbro disclosed that attackers who compromised an employee account earlier this year accessed personal and financial information belonging to an undisclosed number of staff, including Social Security numbers, financial account details, and driver's license information for at least 436 Massachusetts residents. Hasbro says it has no indication the data has been misused and is offering affected employees complimentary identity protection. Source: BleepingComputer

Security Research

1. Chinese-Made ZBT Routers Ship With Two Unauthenticated Backdoors: Researchers at VulnCheck found that more than a dozen models of Zbtlink routers, sold worldwide and tracked as CVE-2026-74232 and CVE-2026-74233, contain two implants dubbed SPEAKINGSTONE and DARKLANTERN. One phones home to ZBT's cloud infrastructure to run arbitrary commands and steal ISP credentials, while the other listens on the WAN interface and executes commands from the open internet with no authentication at all; scans found over 200 exposed devices across 22 countries, more than half in the United States. Source: The Hacker News
2. Unit 42 Separates Real AI-Powered Malware From the Hype: Palo Alto Networks' Unit 42 analyzed 405 malware samples where AI was either a functional component, a delivery mechanism, or just marketing, and found the space still overwhelmingly consists of proof-of-concept code and researcher submissions rather than production threats. Only 12 of the 405 samples actually appeared in real endpoint telemetry, though the report warns that early cases of LLM-assisted ransomware development and agentic execution point to where the trend is heading. Source: Unit 42
3. ShieldBreak PoC Fully Bypasses Microsoft Defender's Own Patch: A researcher going by "Chaotic Eclipse" released ShieldBreak, a proof-of-concept exploit chain that defeats Microsoft's July fix for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine. The bypass reportedly achieves a 100 percent success rate on Windows 11 25H2 and Windows Server 2025, letting a low-privileged local attacker regain SYSTEM-level access even on fully patched machines. Source: The Hacker News
4. Apache Tomcat Discloses Batch of Access-Control Bypass Flaws: Apache disclosed several path-based authorization flaws in Tomcat, most notably CVE-2026-65182, where defining a security constraint for a longer URL path before a stricter one for a shorter sub-path can silently bypass the more restrictive rule. The issues span versions from Tomcat 7 through 11 and range from low-severity quirks to bugs that could expose resources administrators believed were protected. Source: Cybersecurity News
5. Metabase Zero-Day Let Attackers Walk Into Admin Panels Unauthenticated: A critical SQL injection flaw in the open-source BI tool Metabase, reachable through its unauthenticated password-reset endpoint, allowed attackers to gain full administrator access and was exploited in the wild against Metabase Cloud customers, including Framework and Tally, resulting in stolen customer names, emails, and billing details. Metabase has patched its Cloud platform and urged self-hosted customers running version 1.58 or later to update immediately. Source: The Hacker News

Top CVEs

1. CVE-2026-8452: A pre-authentication heap memory overflow in Citrix NetScaler ADC and Gateway's SAML SSO parsing, originally disclosed in June as a denial-of-service bug, was demonstrated by watchTowr Labs to enable full unauthenticated remote code execution. Attackers are now dropping web shells on unpatched, internet-facing Gateway and AAA virtual server configurations, and CISA's federal patch deadline of August 29 has already passed. Source.
2. CVE-2026-82078: An unsafe dynamic class-loading flaw in PaperCut NG and MF's database connection utilities allows arbitrary Java code execution, and when chained with the access-control bypass tracked as CVE-2026-81578, enables pre-authentication remote code execution against the PaperCut Application Server. PaperCut has confirmed customer incidents and shipped a second emergency patch on August 28 after the first fix proved incomplete. Source.
3. CVE-2026-68820: A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) let North Korea's Lazarus Group escalate to SYSTEM privileges as part of its Operation Dream Job campaign against defense, aerospace, and aviation targets. Check Point Research says Lazarus exploited the flaw as a zero-day for roughly five weeks before Microsoft patched it, using it to deploy an updated version of the FudModule kernel rootkit. Source.
4. CVE-2026-55040: A weak-authentication flaw in Microsoft SharePoint's JSON Web Token validation lets an unauthenticated attacker forge tokens that SharePoint accepts as valid, impersonating site users or administrators without any credentials. Attackers began exploiting it within hours of a technical write-up and proof-of-concept going public, and it now sits on CISA's Known Exploited Vulnerabilities list, affecting on-premises SharePoint Server 2016, 2019, and Subscription Edition. Source.
5. CVE-2026-18577: An authentication bypass in N-able's N-central remote monitoring and management platform, stemming from an incomplete fix for an earlier flaw, lets unauthenticated attackers gain administrative control and pivot into managed endpoints via the platform's Take Control feature. Exploitation has been ongoing since early August, prompting N-able to ship a second hotfix, and CISA has added it to its Known Exploited Vulnerabilities catalog. Source.

Final Words

If there's a thread running through today's edition, it's how often the second fix is the one that actually works. PaperCut, N-able, and Microsoft Defender's own patch team all shipped a remediation that attackers or researchers promptly found a way around, a reminder that "patched" and "safe" aren't always the same status update.

The Manchester Airports and Love Electric stories also make the same point from a different angle: neither breach required a sophisticated exploit chain, just exposed API credentials and a database that wasn't locked down as tightly as assumed. Meanwhile, Berlin's standoff with Rhysida is worth watching as a test case for how a major government responds to extortion timed for maximum political pressure.

As always, if today's edition was useful, the best thing you can do is forward it to a colleague who'd rather read one email than chase down ten sources. It genuinely helps us grow.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!