PaperCut Zero-Days, McKesson Breach, ATF Hack

PaperCut Warns of Active Zero-Day Exploitation in Print Software

PaperCut disclosed on August 27 that attackers are actively exploiting two vulnerabilities (CVE-2026-81578 and CVE-2026-82078) in its NG and MF print management software, affecting all versions. The flaws allow unauthenticated attackers to modify system configurations and execute arbitrary Java code remotely. PaperCut released emergency patches after being alerted by a university customer, with security firms Huntress confirming exploitation in at least two environments starting August 26. [1]

McKesson Reports Breach as ShinyHunters Claims 284 Million Records

Healthcare distributor McKesson disclosed on August 28 that it discovered unauthorized access to third-party applications on August 25, with data exfiltration confirmed. The ShinyHunters extortion group claims it stole 284 million patient records and is demanding over $55 million in ransom. ShinyHunters told BleepingComputer it used voice phishing to compromise employee Okta accounts and access Salesforce and Snowflake environments, though the record count claim remains unverified by the company. [2]

ATF Declares Major Incident After Ransomware Gang Claims Breach

The Bureau of Alcohol, Tobacco, Firearms and Explosives declared a cyberattack on one of its systems a major incident on August 27, triggering formal congressional notification. The Qilin ransomware gang claimed responsibility on its leak site, though no evidence was provided. An ATF spokesperson confirmed the targeted system contained information on ATF investigation targets, though the system was described as stand-alone and separate from the bureau's main network. [3]

Boston Scientific Hit by Cyberattack Disrupting Global Operations

Medical device maker Boston Scientific disclosed on August 26 that a cyberattack detected the day prior is causing ongoing disruptions to IT systems and business applications, including order processing and shipping. The company treats 48 million patients annually with devices including pacemakers and defibrillators. As of August 29, Boston Scientific said the unauthorized activity appears limited to on-premise systems with no impact to cloud-based systems, though full restoration timeline remains unknown. [4]