Welcome to Threat Thursday, Galactic’s weekly threat intelligence roundup.
Every Thursday, we cover the cybersecurity stories that matter most for protecting organizations from emerging threats, and we break each one down into what happened, what it could mean for your organization, and what to do about it.
Emergency patches, BGP-hijacked update infrastructure, an AI development framework being actively mined for cloud credentials, and a pharmaceutical company's patient records claimed by the same group that tried the same trick last week and walked away with nothing.
This week has no single story. It has several, with response priorities that look different from one to the next: some require a patch today, some require investigating whether a backdoor is already present, and at least one requires searching your codebase for credentials that have been sitting in public view.
This Week’s Cycle
1. Langflow CVE-2026-0768 Is Being Exploited to Harvest OpenAI and AWS Credentials
CVE-2026-0768 (CVSS 9.8) is an unauthenticated remote code execution flaw in Langflow, the open-source platform used to build AI agents and automate workflows, now owned by IBM following its acquisition of DataStax. The flaw sits in the code validator of Langflow's custom component editor, which runs user-supplied Python without validation, as root, on any internet-exposed instance. VulnCheck observed exploitation beginning August 29, logging 360 attempts in under 72 hours from roughly 20 source IPs, primarily Russian. Attackers targeted OpenAI API keys, AWS credentials, SSH keys, and environment variable files, then attempted lateral movement via SSH. VulnCheck reports roughly 11 additional Langflow flaws exploited in the wild this year, which says something about the state of the platform's security.
Potential impact: AI tooling accumulates credentials for every platform it connects to. An attacker who compromises a Langflow instance does not just own that server; they collect API keys for cloud accounts, model providers, and data pipelines. That access persists after the Langflow instance is patched unless the credentials are rotated.
What to do: Identify every Langflow instance in your environment, including any deployed by development or data teams outside the standard IT process. Upgrade to the current release, 1.11.6, which covers all known flaws rather than just this one. Restrict the instance from external network access, and rotate any OpenAI, AWS, or other service credentials it could have reached. Review local secret files and environment variables for access going back at least 30 days.
Source: BleepingComputer
2. ShinyHunters Vished McKesson Employees, Reached Okta, and Left With 1TB of Patient Data
McKesson, a major US pharmaceutical distributor supplying hospitals, pharmacies, and oncology clinics, disclosed a cybersecurity incident in an SEC 8-K filing on August 28, three days after detecting unauthorized access. ShinyHunters told BleepingComputer it gained initial access through voice phishing calls targeting McKesson employees, compromising multiple employees' Okta accounts, which the group then used to access McKesson's Salesforce and Snowflake environments. Approximately 1TB of data was exfiltrated over four days. ShinyHunters claims the haul includes roughly 284 million records, a figure reflecting database rows rather than unique patients, covering patient identifiers, medical details, billing information, and employee records. The group demanded $55 million and gave McKesson 72 hours to respond. McKesson did not respond. McKesson's 8-K states the investigation is in its early stages and that the company has not yet determined the full scope of affected data. It reported no material impact to its distribution operations.
Potential impact: Once vishing produced valid Okta credentials, the path to Salesforce and Snowflake was open. The reach of a compromised Okta session depends entirely on which applications it is trusted to access and whether device trust enforcement prevents unmanaged devices from using it. When that enforcement is absent, a phone call and a fake login page are sufficient to reach a company's customer and patient databases.
What to do: If your identity platform supports device trust, confirm it is enforced and verify it is functioning. A valid credential used from an unmanaged device should produce no access. Organizations with connections to McKesson's Oncology or Medical-Surgical business units should monitor for breach notification and any downstream patient data obligations.
Source: BleepingComputer
3. PaperCut NG/MF Zero-Days Confirmed Exploited, Emergency Patch Shipped Three Times: CVE-2026-81578
PaperCut NG and PaperCut MF, print management platforms used across schools, hospitals, and enterprise environments, had two zero-days confirmed under active exploitation on August 27. CVE-2026-81578 lets an unauthenticated attacker modify server configuration through a flaw in PaperCut's access control: the platform validates the page it displays while the action that page invokes executes separately, without the same check. Chained with CVE-2026-82078, an unsafe reflection vulnerability, that configuration access becomes remote code execution. CISA added both to its Known Exploited Vulnerabilities catalog on August 31 and set a September 14 federal deadline. A Metasploit module is now publicly available. PaperCut shipped an initial emergency build on August 28, a second release later that same day, and a third on September 1.
Potential impact: A compromised PaperCut server holds print jobs, user authentication data, and document workflows, enough to serve as a foothold into the broader network. Print management infrastructure typically receives less scrutiny than perimeter-facing systems, which makes it a clean pivot point for lateral movement after an initial compromise.
What to do: Apply release 3 of PaperCut's emergency patch, which shipped September 1. Confirm the management interface is not internet-facing. If the server was exposed before patching, treat it as potentially compromised and check it against PaperCut's published indicators of compromise rather than assuming the patch is sufficient on its own.
Source: Rapid7
4. Attackers Hijacked BGP Routing to Push Malicious Virtualizor Updates for 33 Hours
Between August 28 and August 30, attackers hijacked BGP routing for the Hetzner-hosted IP block belonging to Softaculous, the maker of Virtualizor, a VPS management panel used by hosting providers. For roughly 33 hours, traffic bound for Virtualizor's update servers was redirected to attacker-controlled infrastructure. Because Virtualizor did not sign its packages cryptographically, any update arriving over HTTPS was accepted without question. The attackers obtained a valid Let's Encrypt certificate during the redirection window, so no certificate error appeared on downstream servers. Backdoors were planted on host machines. The hijacked route was visible across the RIPE RIS pool of 368 collector peers, peaking at roughly 266. Softaculous released version 3.2.9.9 with a Security Analyzer tool on September 1 and confirmed plans to implement package signing going forward.
Potential impact: A backdoor installed on a VPS host sits above the virtual machines running on it. Organizations that use Virtualizor-managed infrastructure and received updates during the affected window may have a persistence mechanism that the new version does not remove.
What to do: Update to Virtualizor 3.2.9.9 and run the Security Analyzer. If updates were applied between August 28 and August 30, investigate the host machine for backdoor indicators — the update itself was the delivery vehicle, so patching to the new version does not clear anything the malicious update already installed.
Source: BleepingComputer
5. Manchester Airports Group Lost 8.7 Million Customer Records to an API Key Left in Public JavaScript
The extortion group FulcrumSec disclosed to BleepingComputer on August 30 that it pulled approximately 86GB of data from Manchester Airports Group's Iterable marketing platform using API credentials the company had left embedded in publicly visible JavaScript code, readable by any visitor who opened a browser's developer tools, with no login or exploit required. FulcrumSec claims 8.7 million customers were affected across car park, lounge, Fast Track, and in-airport Wi-Fi systems; MAG, which operates Manchester, London Stansted, and East Midlands airports, confirmed the breach on August 27 but has not disclosed a victim count. No server was compromised, no vulnerability was exploited, and according to MAG no payment data was accessed.
Potential impact: API credentials in client-side JavaScript are readable by anyone without authentication, specialized tools, or technical sophistication. The credential gave FulcrumSec a direct channel into a marketing platform holding customer data at scale. Third-party marketing and CRM platforms frequently accumulate more customer information than the organizations using them realize, and the access those platforms grant through their APIs is often broader than what the use case requires.
What to do: Search your codebase, build artifacts, and deployed web properties for embedded API keys. Any credential exposed in client-side code should be treated as compromised and rotated immediately. Review the permissions attached to third-party marketing platform credentials and scope them to what the integration actually needs.
Source: BleepingComputer
The Big Picture
Five stories, five different response priorities, and no single lesson tying them together. That's the useful thing about this week.
The Langflow and PaperCut stories need a patch today. The Virtualizor and McKesson stories need someone to go looking for what's already inside. And the Manchester Airports breach needs nothing patched at all, because no vulnerability was involved. An API key sat in publicly readable JavaScript, and 8.7 million customer records left through a door that was never locked.
That last one is the story most likely to describe an organization reading this. Nobody exploited anything. Somebody found a credential in plain view and used it as intended. The Langflow attackers were after the same thing from the other direction, harvesting API keys for cloud accounts and model providers from compromised AI tooling, which persist long after the flaw itself is closed.
The work this week splits cleanly. Patch what's under active attack, investigate the systems where an update was the delivery mechanism, and search your own codebase for credentials that never needed to be there. The first two are familiar. The third is the one nobody has on a schedule.
Check back next week for another Threat Thursday. See you then!
