Week of August 31, 2026: McKesson Breach Claims, PaperCut Zero-Days Exploited

The week of August 31, 2026 brought a wave of disclosed breaches, with McKesson confirming unauthorized access to third-party systems tied to a ShinyHunters extortion claim of 284 million records and Thomson Reuters revealing that C-Track court files were taken from courts across a dozen U.S. states and Canada. CISA added actively exploited PaperCut NG/MF and SonicWall SMA 1000 flaws to its Known Exploited Vulnerabilities Catalog, while international law enforcement dismantled the 23-year-old Sality botnet and the FBI warned of OAuth consent phishing against high-profile individuals.

McKesson Discloses Breach After ShinyHunters Claims 284 Million Records

Healthcare distributor McKesson disclosed a cybersecurity incident after detecting unauthorized access to certain third-party applications on August 25, 2026. Chief Information and Technology Officer Francisco Fraga said the investigation, supported by outside cybersecurity experts, found the unauthorized access and data exfiltration tied to a subset of customers within its Oncology & Multispecialty and Medical-Surgical business units. The ShinyHunters extortion group told BleepingComputer it took about a terabyte of data via compromised Okta, Salesforce and Snowflake access, claiming 284 million database records and demanding $55,236,150. McKesson said it has not determined the incident to be material. (Help Net Security)

CISA Adds PaperCut NG/MF Flaws to KEV Catalog Amid Active Exploitation

CISA added two PaperCut NG/MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to its Known Exploited Vulnerabilities Catalog on August 31, 2026, citing evidence of active exploitation. The flaws, chained together, let an unauthenticated attacker bypass authentication and execute arbitrary Java bytecode on internet-facing PaperCut Application Servers. Separate reporting showed attackers installing SimpleHelp and AnyDesk remote access tools on compromised servers after three rounds of emergency patches from PaperCut. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of catalog entries on publicly exposed assets. (CISA)

SonicWall Confirms Active Exploitation of SMA 1000 Zero-Days

SonicWall confirmed on September 1, 2026 that attackers were actively exploiting two previously undisclosed vulnerabilities in its SMA 1000 series secure remote access appliances. CVE-2026-83548 is a pre-authentication server-side request forgery flaw in the Appliance Work Place interface, while CVE-2026-83549 is an OS command injection bug in the Appliance Management Console that can enable remote code execution. SonicWall urged customers running affected 6210, 7210 and 8200v models to apply a hotfix immediately and check for indicators of compromise, recommending re-imaging and password resets if compromise is confirmed. (Help Net Security)

Thomson Reuters Discloses C-Track Breach Exposing US and Canadian Court Records

Thomson Reuters publicly disclosed on September 2, 2026 that an unauthorized third party obtained C-Track court case management files in March 2026, after the company detected the activity on June 30, 2026. Affected systems span at least 12 U.S. states, the U.S. Virgin Islands, and three Ontario courts, with exposed data potentially including Social Security numbers, driver's license numbers, medical information, and sealed court records. Thomson Reuters said the breach occurred within its own cloud environment, not the courts' systems, and is offering affected individuals 12 months of credit monitoring. (Help Net Security)

International Operation Dismantles 23-Year-Old Sality Botnet

International law enforcement agencies, working with CrowdStrike and the Shadowserver Foundation, ran a sinkhole operation on August 31, 2026 that ended the 23-year run of the Sality peer-to-peer botnet, which had infected more than 15,000 machines worldwide. Investigators in the U.S., Bulgaria, Hungary, and Romania also seized domains hosting Sality's payload files. CrowdStrike said the botnet's main recent payload, a clipboard hijacker called EggJagger that swapped cryptocurrency wallet addresses, earned its operator at least $150,000, and that the botnet had also been used to launch denial-of-service campaigns. (Help Net Security)

FBI Warns of OAuth Consent Phishing Targeting Prominent Individuals

The FBI's Internet Crime Complaint Center warned on September 2, 2026 that attackers are using OAuth consent phishing to gain persistent access to the accounts of prominent individuals, their relatives, and personal contacts. Attackers register malicious applications with legitimate OAuth providers, then contact targets through messaging apps or email posing as journalists or event organizers to get them to approve permission requests on genuine login pages. Once approved, the attacker's application can read email and access sensitive data without a password, and changing the password does not revoke access. (Help Net Security)

Nutex Health Updates SEC Filing on Data Exfiltration and Extortion Threat

Nutex Health filed an updated Form 8-K on August 31, 2026 describing the scope of a cybersecurity incident first disclosed in a prior filing. The company said an unauthorized third party accessed and exfiltrated patient, employee, credentialed provider, and business and financial information from its servers, and that the third party threatened to post the data externally. Nutex said it had not identified any material impact on business operations or financial reporting systems as of the filing date and continues to evaluate notification obligations. (SEC EDGAR)

CISA and G7 Issue Call to Action on Post-Quantum Cryptography Transition

CISA and the Group of Seven Cyber Security Working Group published Preparing for the Post-Quantum Era: A Call to Action on September 3, 2026, urging organizations and governments to begin transitioning to post-quantum cryptography. The guidance sets five priorities: raising awareness of quantum risks, developing national PQC adoption strategies, advancing quantum-safe research and development, fostering public-private partnerships, and integrating PQC requirements into cybersecurity procurement processes. The release gives security leaders a reference point for budgeting and vendor conversations about migration timelines. (CISA)