🔴 Unpatched Microsoft UFO MCP flaw (CVSS 9.4), 🛒 Superior campaign hits 80k browser extension users, 🔓 Composer path traversal CVE-2026-59944, 🤖 Gryxa AI-built persistence toolkit, 🎯 Blind Eagle AsyncRAT via GitHub, 📶 D-Link unauthenticated admin reset, 🍪 Infostealer malware hijacks Claude sessions, 💰 Berlin refuses to pay extortionists, 🖨️ PaperCut emergency zero-day patches

A critical vulnerability in Microsoft's open-source UFO Desktop AgentOS framework lets unauthenticated attackers remotely take over connected Android devices. Tracked as CVE-2026-73296 with a CVSS score of 9.4, the flaw affects UFO versions up to v3.0.7 and has no patch available. The bug sits in the Mobile Model Context Protocol implementation, where two HTTP servers bound to 0.0.0.0 expose ADB-backed tools without any authentication. Attackers can exfiltrate screenshots, UI hierarchies, and device metadata, or inject arbitrary input events including taps, swipes, and text input into connected devices. Organizations using UFO with Android devices should immediately restrict network access to the MCP ports until a fix ships.

A supply-chain campaign Socket researchers call "Superior" has compromised 18 malicious Chrome extensions and one Edge extension that collectively targeted roughly 80,000 users. The attackers either built extensions from scratch or acquired existing ones from legitimate developers, then pushed malicious updates after the extensions had built user bases. The highest-impact extension, "Enable Right Click and Copy Smart Unlock + OCR," had about 70,000 Chrome users and 10,000 Edge users when the malicious code was introduced. Once installed, the malware establishes encrypted WebSocket connections to command-and-control servers, downloads 16 distinct JavaScript modules, and strips Content Security Policy headers. The modules handle crypto wallet theft, credential harvesting, browser history exfiltration, and ClickFix lure injection. Google removed the Chrome version, but the Edge version remained available at the time of disclosure.

A path-traversal vulnerability in Composer, the PHP package manager, allows malicious packages to manipulate file permissions outside their installation directory. Tracked as CVE-2026-59944, the flaw affects versions 2.3.0 through 2.10.2 and versions 1.0 through 2.2.29, with patches available in 2.10.3 and 2.2.30. A malicious package can declare a binary path that escapes its package directory or use a symlink resolving outside it, causing Composer to change permissions on the target file during installation. On shared and multi-tenant systems, this could make previously restricted files world-readable. The issue does not enable remote code execution but creates a confidentiality risk in shared hosting environments.

ReliaQuest researchers disclosed Gryxa, a Windows toolkit that combines RMM software abuse, AI-assisted development, browser credential theft, and aggressive persistence mechanisms. The toolkit's most distinctive behavior emerges after defenders remove the visible RMM implant: a surviving component collects Windows logs and host artifacts that reveal how the response was performed, then exfiltrates that intelligence back to the attackers, creating a feedback loop to adapt against specific defensive playbooks. Researchers linked Gryxa activity to a public code repository and an attacker-operated management console listing 324 hosts, with 69 shown as online. Many repository commits included co-author metadata from a commercial AI coding agent. Gryxa distributes files across multiple hidden directories and deploys at least seven scheduled tasks plus a permanent WMI event subscription, ensuring partial cleanup triggers immediate reinfection.

Researchers have uncovered a Blind Eagle-linked malware operation using GitHub repositories, VBScript, PowerShell, and the legitimate Windows InstallUtil utility to deploy AsyncRAT. The investigation began with a GitHub account hosting an AutoIt interpreter alongside separately retrievable malicious script logic, allowing attackers to update payloads without re-uploading executables. A compromised attacker-side workstation provided an unusual view into the operational ecosystem: the recovered stealer log contained phishing templates, RAT-building tools, bulk-email software, and evidence of commercial crypter use. The analyzed samples were self-extracting RAR archives disguised as invoice-themed attachments that launch a VBScript-based dropper via wscript.exe.

D-Link has patched two vulnerabilities in the DIR-X1860Z router that allow an unauthenticated attacker on the local network to reset the administrator password and extract Wi-Fi credentials. The flaws reside in the ubus JSON-RPC management interface on TCP port 23355, where the routerd.passwd_set method requires no authentication. After changing the password, an attacker can log in through the standard web admin workflow and alter DNS settings, modify firewall rules, change port-forwarding configurations, or lock the legitimate owner out. The second vulnerability leaks wireless configuration data directly. D-Link has released fixed firmware for the affected hardware revision.

Infostealer malware is actively targeting Anthropic's Claude AI platform, stealing authenticated session cookies rather than passwords to bypass two-factor authentication entirely. Two distinct attack chains have been confirmed: one involving Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer on macOS, and a separate FakeAgent campaign that used malicious Claude Artifacts hosted on claude.ai itself. Between July 21 and 22, the FakeAgent campaign served malicious "Claude desktop app" ads on Bing that linked to a malicious public Claude Artifact, which inherited the platform's SSL certificate and search authority. Anthropic detected the pattern after noticing usage limits being refilled and then drained while account owners were inactive, and has responded by invalidating compromised sessions and removing saved payment methods.

Berlin's state government has declined to pay the extortion group demanding 30 bitcoin after the group claimed to have stolen sensitive data from the city's administrative network. The refusal to negotiate follows the government's earlier decision to withhold information about which data was accessed and who is behind the attack. The hackers had targeted Berlin's administrative data network roughly two weeks ago, and the breach has widened as the government refuses to disclose the scope of compromised data, citing investigative tactics. The government's silence and refusal to identify the threat actor leaves open whether this is a financially motivated group or a state-linked operation, and the decision not to pay raises the likelihood of data publication.

PaperCut has released two emergency security updates for its NG and MF print management software after confirming active exploitation of two vulnerabilities that can be chained for unauthenticated remote code execution. CVE-2026-81578 is an authentication bypass in the web management interface, and CVE-2026-82078 is an unsafe dynamic class-loading flaw in the database connector. Together they give unauthenticated attackers code execution on any internet-facing PaperCut Application Server. The initial patch was released August 28, but researchers found multiple bypass methods within a day, forcing a second emergency release. The Canadian Centre for Cyber Security issued advisory AV26-858 covering all versions prior to the second patch. PaperCut NG and MF are widely deployed in enterprise, education, and government environments, and the web management interface is typically internet-accessible for remote administration.

Watchlist: monitor Microsoft for a patch to CVE-2026-73296 and restrict UFO MCP port access (8020, 8021) immediately; audit browser extensions in your organization for the Superior campaign indicators and remove any with broad permissions from unverified publishers; update Composer to 2.10.3 or 2.2.30 and audit shared hosting environments for permission anomalies; deploy PaperCut's second emergency patch and check for unauthorized database driver loading in logs; track Berlin for potential data publication following the refusal to pay; monitor Claude usage logs for unexpected spikes indicating session cookie theft.