Week of August 24, 2026: UK power plant attack, Boston Scientific outage, PaperCut zero-days

Security leaders faced a run of fresh exploitation and disclosure during the week of August 24, 2026, as CISA added Gitea and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog, PaperCut Software confirmed zero-day attacks against its print management software, and Boston Scientific disclosed a cyberattack that disrupted global operations. The period also brought a suspected Iran-linked attack on a UK power plant into public view, a Justice Department takedown of Chinese state-sponsored hacking infrastructure, and a CISA advisory contrasting two red team assessments at critical infrastructure organizations.

Suspected Iran-linked attack on UK power plant becomes public

News broke that a suspected Iran-linked cyberattack had knocked a British power plant offline for four days in July 2026, with the incident reported to the National Cyber Security Centre. UK Minister of State Michael Shanks confirmed a cyber incident had affected a small-scale energy generator without naming the facility, saying energy CEOs were briefed afterward and further advice was shared with companies. Security commentators said the episode underscored how exposed smaller critical infrastructure operators and their supply chains remain to state-linked disruption. (Help Net Security)

Boston Scientific discloses cyberattack disrupting global operations

Medical device maker Boston Scientific disclosed a cyberattack that caused a network outage and disrupted global operations after noticing the incident on August 25, 2026. The company activated incident response protocols and engaged third-party cybersecurity experts to investigate and contain the threat. An SEC filing said the breach disrupted systems supporting order processing and shipping, with no restoration timeline confirmed. Boston Scientific had not determined whether the incident was reasonably likely to be material, and no group had claimed responsibility by the time of disclosure. (Help Net Security)

CISA advisory contrasts two red team outcomes at critical infrastructure orgs

CISA published an advisory on August 25, 2026, detailing two simultaneous red team assessments at critical infrastructure organizations. In one environment, the red team achieved full domain compromise and reached sensitive business systems and cloud resources without being detected; in the other, defenders quickly identified the intrusion, isolated affected systems, and forced the red team into an assume-breach model. CISA urged organizations to tune detection baselines, reduce alert noise, break down response silos, and strengthen cloud security controls to improve outcomes during real incidents. (CISA)

CISA adds exploited Gitea code injection flaw to KEV catalog

CISA added a Gitea code injection vulnerability, CVE-2026-60004, to its Known Exploited Vulnerabilities catalog on August 25, 2026, after attackers began exploiting it to compromise self-hosted Git instances. A documented incident showed an automated scanner using the flaw to run arbitrary commands and deploy crypto-mining software inside a Gitea container running in Docker. CISA ordered federal civilian agencies to remediate the vulnerability, which affects unpatched Gitea instances with open user registration, giving organizations outside government a clear signal to patch and check for compromise. (CISA)

Previously patched Citrix NetScaler flaw added to KEV catalog after active exploitation

CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on August 26, 2026, including a previously patched Citrix NetScaler ADC and Gateway flaw, CVE-2026-8452, now confirmed under active exploitation. Researchers had shown the flaw, originally described by Citrix as a denial-of-service issue, could be chained into full unauthenticated remote code execution after a public proof-of-concept was released. Threat intelligence firms reported attackers dropping web shells and running discovery commands on compromised NetScaler appliances within days. CISA gave federal agencies until August 29, 2026 to remediate. (CISA)

PaperCut warns of zero-day attacks chaining two NG/MF vulnerabilities

PaperCut Software warned on August 27, 2026, that two vulnerabilities in its PaperCut NG and PaperCut MF print management software, CVE-2026-82078 and CVE-2026-81578, were being exploited in zero-day attacks against confirmed customers. The vendor urged organizations to restrict internet access to the Application Server and watch for indicators of compromise. PaperCut released an emergency patch on August 27 and a hardened second release on August 28 after researchers found the flaws could be chained for unauthenticated remote code execution, with limited exploitation already observed on two customer environments. (Help Net Security)

DOJ and FBI seize domains behind Chinese state-sponsored hacking tools

The Justice Department and FBI announced on August 27, 2026, that they had seized domains used by QScan and QTRouter, two hacking tools tied to a Chinese state-sponsored group called QTFY. Court documents link QTFY to a Nanjing-based company that investigators say sold intrusion services to China's Ministry of State Security and the People's Liberation Army, with targets including NASA, the Department of Energy, the Department of Justice, and the U.S. Senate. The FBI and NSA published an advisory listing indicators of compromise tied to the group. (Help Net Security)

Compromised Zimbra instances climb as CVE-2026-73570 attacks continue

At least 274 internet-facing Zimbra Collaboration Suite instances had been compromised through CVE-2026-73570 as of August 24, 2026, according to the Shadowserver Foundation, with the number continuing to rise through the week. The code injection flaw affects Zimbra mailservers running the optional zimbra-snmp package with SNMP notifications enabled, letting unauthenticated attackers execute operating system commands as the Zimbra user. Synacor had patched the issue in ZCS v10.1.20 in July, but Shadowserver found roughly 8,200 instances still not updated, leaving a large pool of potentially exposed mail servers. (Help Net Security)