2026-09-03: September 2026 security update: From printers to power plants, last month's biggest threats need no login to strike

Today’s threat landscape 

From manual to malware: AI turns public documentation into attack code against industrial controllers

On 19 August, the NSA, CISA, the FBI, the Department of Energy, and the Environmental Protection Agency issued a joint advisory warning that cybercriminals are using AI-generated Python scripts, disguised as ordinary monitoring utilities, to probe internet-exposed Siemens S7 programmable logic controllers - the small industrial computers that open a valve or trip a turbine, so anything able to reach one can affect a physical process rather than just data. It's the first joint government warning to name generative AI as the enabling capability: feed an AI tool public Siemens documentation, and it hands back working reconnaissance code. The advisory covers every S7 generation, and the sectors named - water, energy, chemical, manufacturing, and food - map closely onto NIS2's essential-entity categories. Regulators are responding in kind: the European Central Bank now requires every significant euro area institution to submit a board-endorsed action plan against AI-enabled cyber threats by 31 October.

Top 3 vulnerabilities 

No login required: Chained PaperCut vulnerabilities give cybercriminals full control of print servers

PaperCut NG and PaperCut MF are print-management servers that meter, release, and account for printing, common across European schools, universities, hospitals, and local government, where they sit between staff and every networked printer. On 27 August PaperCut disclosed two zero-days in a single urgent bulletin and said it was investigating active exploitation with confirmed customer incidents. The two chain together.

CVE-2026-81578 (CVSS v4.0 8.8) is a missing authentication weakness in the web management interface: under certain conditions the server performs administrative backend actions before it finishes checking access, so a request arriving without any login credentials or prior access can alter system configuration. That sets up CVE-2026-82078 (CVSS v4.0 9.4), an unsafe reflection issue in the database connection code, which builds database driver objects from names held in configuration without checking them against an approved list. Alter the configuration and the server loads and runs Java code of the intruder's choosing under its own account. Alone the second vulnerability needs high privileges; chained to the first it needs none. CISA lists both as actively exploited.

Both CVEs list every version before 24.1.10, 25.0.13, and 26.0.5 as affected. PaperCut's first emergency patch didn't hold, so Emergency Patch Release 2, published 28 August, is the one to apply: upgrade to 24.1.10, 25.0.13, or 26.0.5 depending on the branch in use. If patching must wait, restrict the server's web interface to trusted internal addresses.

Patched but not protected: Command injection lets cybercriminals hijack Zimbra mail servers

Zimbra Collaboration Suite is a self-hosted mail and calendar platform widely run by European universities, municipalities, and hosting providers, which is why CVE-2026-73570 (CVSS v3.1 8.9) became one of August's most damaging events. The root cause is OS command injection: in versions before 10.1.20, an optional monitoring package that generates SNMP alerts fails to sanitize untrusted input while processing incoming mail, and it ships enabled by default. The vulnerability can therefore be triggered without any login credentials or prior access, and the injected commands run as the Zimbra service account, which owns the mailboxes.

Zimbra released the fix in version 10.1.20 on 20 July, but mass exploitation began roughly a month later. CERT Polska flagged live attacks and published indicators of compromise, CISA lists it as actively exploited, and counts of compromised servers rose from 155 on 20 August to 274 by 24 August, with some 8,200 instances still unpatched. Upgrade to 10.1.20 or later; if that is impossible, remove the optional SNMP package or turn off its notifications. Either way, hunt for signs of compromise afterward, because patching evicts nobody already inside.

Under active attack, and worse to come: Two Artifactory vulnerabilities put admin control up for grabs

JFrog Artifactory is the repository server development teams use to store and proxy the software packages their builds depend on, which makes it a high-value target.

CVE-2026-66384 (CVSS v3.1 5.3) is a path traversal issue: under specific remote-repository configurations, an authenticated user can write data outside the intended container image cache directory, to any location the Artifactory process can reach. The score stays in medium territory because only integrity is affected, yet dropping a chosen file into a chosen path on a build server is exactly the sort of capability that gets chained into something worse. CISA lists it as exploited. Everything before 7.146.35 is affected, plus the 7.161.0 to 7.161.16 range, fixed in 7.146.35 and 7.161.16.

A far more severe issue followed on 28 August: CVE-2026-82329 (CVSS v3.1 9.8) is an improper authentication weakness that lets someone reach a server over the network and take administrator privileges without any login credentials, in the default configuration. It is not currently on the CISA KEV catalog. Six release branches need patching, to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20; JFrog's advisory confirms cloud instances are already fixed.

Industry news 

Power plants and city halls: Cybercriminals hit critical infrastructure and government networks across Europe

Industrial systems drew fire across Europe last month. An Iranian cyberattack forced a small British power plant offline for four days in July without affecting the wider grid. More striking was CERT Polska's report on a Polish power plant, where cybercriminals compromised a wind farm firewall, pivoted through a cellular router into a private mobile network shared with the distribution operator, and reached a controller left on default credentials before shutting down a steam turbine and a water treatment system. Separately, cybercriminals targeted senior EU officials with spear-phishing over WhatsApp.

Meanwhile, Germany's capital ran much of its government by phone and fax for over a week. Berlin's Senate Chancellery disconnected two state departments, covering urban development and housing as well as mobility, transport, and environment, from the government network after discovering an intrusion; district offices could no longer process housing benefit applications. The Rhysida ransomware group claimed responsibility, saying it took roughly 5.79 terabytes of data covering 12,076 individuals, though German authorities had not confirmed that attribution at the time of writing. Berlin refused to pay: Governing Mayor Kai Wegner said the city was being blackmailed and would not capitulate, and the network was fully restored by 23 August. Together, the two incidents underscore that both industrial control systems and public-sector IT now sit squarely in cybercriminals' sights.