Welcome to Issue #33 of the CosmicBytez Labs Weekly Digest — your curated rundown of what mattered in cybersecurity this week.
Extortion deadlines and healthcare data dominated the headlines. McKesson confirmed unauthorized access after ShinyHunters claimed 284 million records and set a roughly $55 million ransom deadline for today, September 1 — while separately, hospital operator Nutex Health confirmed the Gentlemen ransomware gang stole patient, employee, and financial data and is threatening a leak. Berlin's state government also confirmed data theft from a Rhysida ransomware attack and says it won't pay, ahead of a September 20 election.
AI infrastructure took real damage this week too. A critical unauthenticated RCE in Langflow (CVE-2026-0768) is being actively exploited to harvest OpenAI and AWS credentials straight out of exposed AI-agent servers, and Aurora ransomware operators were caught running Cursor's agentic AI — powered by Claude Sonnet — to automate reconnaissance and lateral movement across ten victim networks. Anthropic separately warned that infostealer malware is now hijacking active Claude login sessions to drain usage and payment methods.
On the identity front, a new dark web marketplace called Nexus is selling more than 153 million US and Canadian drivers licenses, reportedly sourced from ID-verification firm idscan.net — one of the largest identity-document dumps we've tracked. And PaperCut's already-patched NG/MF auth-bypass and RCE chain (now on CISA's KEV list) has pivoted from opportunistic payloads to straight database exfiltration, a reminder that "patched" doesn't mean "over" once exploitation is already in motion.
The throughline: extortion crews are working to deadlines and using AI tooling to move faster, while defenders are stuck patching yesterday's bugs against today's follow-on attacks.
Top Stories
McKesson Confirms Data Breach as ShinyHunters' Deadline Looms
Healthcare giant McKesson confirmed unauthorized access to two of its business units after the ShinyHunters extortion group claimed to have stolen 284 million records and demanded roughly $55 million by September 1 — today. The confirmation comes without full scope disclosed, leaving patients, providers, and partners waiting on exactly what was taken. This is the second major healthcare extortion story running in parallel this week alongside Nutex Health, underscoring how squarely the sector remains in ransomware crosshairs.
What to do: If you're a McKesson customer or partner, watch for breach notification communications and review any shared credentials or API integrations for anomalous activity.
Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys
Attackers are actively exploiting an unauthenticated RCE in Langflow, tracked as CVE-2026-0768, to harvest OpenAI and AWS credentials directly from exposed AI-agent servers. Langflow is a popular low-code builder for LLM and agent workflows, and any internet-facing instance is effectively a credential vending machine for attackers right now — a preview of the class of bugs we should expect more of as AI-agent infrastructure keeps shipping ahead of its security review.
What to do: Patch Langflow immediately, pull management interfaces off the public internet, and rotate any OpenAI/AWS keys that were reachable from an exposed instance.
Recently Patched PaperCut Zero-Days Used in Data Theft Attacks
Attackers exploiting PaperCut NG/MF's auth-bypass and RCE chain — tracked as CVE-2026-81578 and, per this week's Security Corner, the related CVE-2026-82078 unsafe-reflection bug now on CISA's KEV list — have pivoted from deploying payloads to directly dumping database tables. The vulnerabilities were already patched before this campaign, which means unpatched instances are now facing a more surgical, data-focused follow-on attack rather than opportunistic exploitation.
What to do: Confirm PaperCut is fully patched, audit database access logs for bulk export activity, and treat any prior compromise window as a potential data-theft event, not just an availability risk.
FBI Probes Dark Web Service Selling 153M+ Drivers Licenses
A new dark web service called Nexus is selling more than 153 million US and Canadian drivers licenses, reportedly sourced from ID-verification firm idscan.net. The scale puts this among the largest identity-document exposures tracked this year, with direct downstream risk for identity theft, synthetic-identity fraud, and know-your-customer (KYC) bypass at any service that relies on ID-document verification.
Affected? Treat drivers-license-based KYC as weakened industry-wide for the moment — pair it with liveness checks or secondary verification, and watch for a spike in fraudulent account openings using stolen license data.
Aurora Ransomware Operators Use Cursor AI Against 10 Targets
Aurora ransomware operators used Cursor's agentic AI, running on Claude Sonnet, to automate reconnaissance, lateral movement, and Active Directory exploitation across 10 victim organizations. It's one of the clearest documented cases yet of a ransomware crew operationalizing mainstream agentic coding tools inside an intrusion chain, rather than just using AI for phishing copy — a trend worth tracking as agentic tooling keeps getting easier to point at offensive tasks.
What to do: Harden AD attack paths regardless of tooling (tiered admin, LAPS, tight lateral-movement detection), and treat unusually fast, methodical post-compromise activity as a signal worth escalating rather than dismissing as noise.
Security Corner
Notable advisories published this week:
-
CVE-2026-82078 — Critical. PaperCut NG/MF unsafe reflection — lets attackers run arbitrary Java code; now on CISA's KEV list and directly tied to this week's PaperCut data-theft campaign above.
-
CVE-2026-79408 — Critical. MetaGPT OS command injection — an unsanitized path argument in
RepoParser(MetaGPT 0.8.1) lets attackers run arbitrary OS commands, another reminder that AI-agent frameworks are shipping with classic injection bugs. -
CVE-2026-38577 — Critical. Tenda HG21 hardcoded admin credentials baked into firmware let attackers bypass authentication entirely and gain full root access.
-
CVE-2026-75865 — Critical. WPLP Cookie Consent WordPress plugin — unauthenticated arbitrary file upload (≤4.4.1) opens a direct path to remote code execution.
-
CVE-2026-82854 — Critical. Nodemailer SMTP command injection via unsanitized
envelope.size(before 8.0.4) can silently add recipients to outbound mail — a widely used package worth checking across your Node.js estate. -
CVE-2026-82857, CVE-2026-82856, CVE-2026-82855 — Three related critical hulumi / @hulumi/policies flaws (before 1.3.2): IAM privilege escalation, a GitHub OIDC trust-policy bypass, and a cross-resource evidence-validation bypass. Update the full set together.
-
CVE-2026-82610 — High. Unauthenticated SQL injection in itsourcecode's Online Medicine Delivery System 1.0 login — public exploit available.
-
CVE-2026-82593 — Critical. D-Link DIR-825M unauthenticated stack overflow in the LTE firmware-upgrade handler — public exploit available.
Browse the full Security Advisories archive for all active CVEs.
Quick Takes
-
Nutex Health data theft confirmed — The Gentlemen ransomware gang claims it stole patient, employee, and financial data from hospital operator Nutex Health and is threatening a leak (read more).
-
Berlin won't pay Rhysida — Berlin's state government confirmed data theft after a Rhysida ransomware attack and says it will not pay the 30 BTC demand, ahead of its September 20 election (read more).
-
Ransomware crews recruit from within — As MFA and EDR harden perimeters, ransomware groups are increasingly recruiting employees and contractors as insiders to bypass defenses entirely (read more).
-
Breeze Comet targets Brazilian payment rails — Google tracks the financially motivated group manipulating Brazilian banking systems like Pix, STR, and Boleto in hundreds of fraudulent transactions since 2024 (read more).
-
Malicious Chrome/Edge extensions drain crypto wallets — Socket found 19 modules running a shared malware framework across Chrome Web Store extensions that steals browser and wallet data (read more).
-
Infostealers hijacking Claude sessions — Anthropic warns common infostealer malware is stealing active Claude login sessions from infected devices to drain usage credits and payment methods (read more).
-
Five plead guilty in Kansas ATM jackpotting case — Five Venezuelan nationals admitted to a malware-based ATM jackpotting scheme tied to Tren de Aragua funding (read more).
-
TerminalFix reverse-tunnel backdoor spreads via fake CAPTCHAs — A new ClickFix variant tricks victims into running PowerShell through Windows Terminal, sideloading a DLL that opens a persistent reverse-tunnel implant (read more).
-
Cronos blockchain halts after $74M Tectonic exploit — A price-manipulation attack let an attacker borrow $74 million; validators froze the chain and rolled back state to contain it (read more).
Upcoming
Next issue (Issue #34): Watch for McKesson and Nutex Health to disclose fuller breach scope now that ShinyHunters' deadline has passed, and expect more organizations to report PaperCut-linked data theft as defenders dig back through logs from the original patch window. We're also tracking whether the Langflow credential-harvesting campaign expands to other exposed AI-agent frameworks.
On the Labs: Fresh advisories are landing daily in the Security archive, and the howto library continues to grow with practical hardening guides — this week's headlines make a strong case for an internet-exposure audit of any AI-agent or low-code tooling on your network.
Stay sharp. When ransomware crews are using the same agentic AI tools your teams are adopting for productivity, the defensive posture that matters most is knowing what's exposed to the internet before an attacker's automation finds it first.
Issue #33 — September 1, 2026. Published weekly by CosmicBytez Labs. To receive this digest by email, subscribe here.