ServiceNow CVSS 10.0 Flaws, PaperCut Zero-Day, and New Tortoiseshell Malware

ServiceNow Patches Three Perfect-10 Vulnerabilities in Its AI Platform

ServiceNow has patched four vulnerabilities in its AI Platform, three of which received the maximum possible severity score. Here's what happened, who's exposed, and what to do about it.

What You Need to Know

ServiceNow has released security updates for four vulnerabilities affecting the ServiceNow AI Platform, three of which the company rated a maximum CVSS 10.0. Under certain conditions, all three could let a remote, unauthenticated attacker compromise confidentiality, integrity, and availability without any user interaction. Organizations that rely on ServiceNow for IT service management, security operations, customer workflows, HR, or other business-critical functions should treat this as a high-priority patching target, whether they run ServiceNow-hosted instances or self-hosted environments.

What's Vulnerable

The three maximum-severity issues are tracked as CVE-2026-18883, CVE-2026-18884, and CVE-2026-18885. ServiceNow assigned each a CVSS v4.0 vector indicating network-based exploitation with low attack complexity, no required privileges, and no user interaction, about as close to worst-case as a rating gets. Successful exploitation could let an attacker execute code or conduct SQL injection, opening paths to unauthorized data access, workflow manipulation, service disruption, and broader platform compromise.

A fourth vulnerability, CVE-2026-18886, was rated 9.5 and could allow arbitrary code execution in the Now Platform. ServiceNow's description says an unauthenticated user can exploit it, but the associated CVSS vector actually identifies low privileges as a prerequisite, a detail organizations should account for when scoping their risk assessment.

This disclosure follows CVE-2026-6875, a pre-authentication sandbox escape ServiceNow patched in July 2026. A threat intelligence company initially reported observing exploitation activity tied to that flaw, then clarified the observed payload matched a publicly released proof-of-concept. ServiceNow says it hasn't seen evidence connecting that activity to its hosted instances. None of the four newly disclosed vulnerabilities have known public exploit code or confirmed exploitation as of this writing, but their severity and remote attack potential make prompt remediation essential regardless.

Why This Matters

ServiceNow sits at the center of IT service management, security operations, HR, and customer workflows for a lot of organizations, so a platform-level compromise doesn't stay contained to one system. An unauthenticated, no-interaction-required path to code execution or SQL injection is the kind of flaw that gets weaponized fast once technical details circulate, even without a known exploit today.

What to Do

ServiceNow has already applied the updates to its hosted instances, but self-hosted deployments require direct administrator action. Identify your platform release, confirm exposure against ServiceNow's affected-version list, and apply the relevant patch level as soon as your change-control process allows.

Beyond patching, review privileged ServiceNow accounts, integrations, API credentials, MID Servers, outbound workflows, and database-connected processes for signs of unexpected changes. Check logs for anomalous requests, unauthorized script execution, suspicious SQL-related activity, new administrator accounts, altered access-control rules, or unexpected changes to business workflows. Update asset inventories and fold ServiceNow exposure into ongoing vulnerability-management and threat-hunting work.

A CVSS 10.0 doesn't leave much room for interpretation. Patch this one on the fast track.

A PaperCut Zero-Day Is Being Actively Exploited Right Now

PaperCut has confirmed active exploitation of a 0-day vulnerability affecting every version of PaperCut NG and MF, with emergency patches out for two release lines and internet exposure the most urgent fix.

What You Need to Know

PaperCut has warned that threat actors are actively exploiting a zero-day vulnerability affecting all versions of its PaperCut NG and PaperCut MF print-management software. The company has confirmed customer incidents, released emergency updates for versions 25 and 26, and its investigation is ongoing. Technical details of the vulnerability, the initial access method, and the actors responsible haven't been publicly disclosed yet, but the immediate concern is clear: any PaperCut NG/MF Application Server exposed to the public internet is at risk right now.

What Happened

PaperCut has advised customers to restrict access to trusted IP addresses using firewall rules, network-access controls, or equivalent measures, even organizations that haven't identified suspicious activity. Because all NG and MF versions are affected, including unsupported or legacy installations, this isn't a narrow patch-and-move-on issue. Organizations need to validate whether their PaperCut administration and web interfaces are reachable through direct public IP addresses, reverse proxies, VPN pathways, or overly broad allowlists, and treat any internet-accessible instance as an urgent attack-surface problem.

This isn't PaperCut's first time in this position. In 2023, attackers exploited CVE-2023-27350, a critical authentication-bypass vulnerability in PaperCut MF and NG, to facilitate ransomware activity tied to Russian threat actors and the financially motivated Lace Tempest group. That history underscores the risk of externally exposed print-management infrastructure, particularly where the application carries elevated privileges, directory-service access, or connectivity to sensitive internal systems.

Why This Matters

Print-management servers don't always get the same security attention as more visible infrastructure, but they often carry elevated privileges and deep connections into identity, file, and network systems, exactly what makes them valuable as an initial foothold. With active exploitation already confirmed and technical details still under wraps, organizations are working with limited visibility on detection while the exposure window stays open.

What to Do

Apply PaperCut's emergency update for supported version 25 and 26 deployments as soon as possible under your established change-control procedures. Where immediate patching isn't feasible, restrict inbound connectivity to known administrative networks and trusted IP ranges as a compensating control. Identify any unsupported or legacy PaperCut installations and assess whether upgrade, isolation, or retirement is the right call.

Threat hunting should focus on the PaperCut Application Server and adjacent identity, file, and print infrastructure. Review administrative activity for new or modified accounts, changes to authentication settings, unexpected configuration updates, suspicious web requests, and abnormal application-server process execution. On the endpoint side, look for suspicious child processes launched by PaperCut services, new scheduled tasks, persistence mechanisms, credential-access activity, and unusual outbound connections from print-management servers. Preserve application, web-server, endpoint, network, and authentication logs before remediating, since that evidence matters if this turns into a full incident response.

Until PaperCut releases more technical detail, exposure reduction is the best lever every organization running NG or MF has.

19 Malicious Browser Extensions Were Draining Crypto Wallets

Researchers uncovered a campaign that turned everyday browser extensions, some with tens of thousands of existing users, into a modular wallet-draining and credential-theft framework.

What You Need to Know

Socket researchers identified 19 malicious browser extensions, 18 for Chrome and one for Microsoft Edge, delivering an adaptable malware framework built to steal cryptocurrency assets, account credentials, session tokens, and browsing data. The campaign, tracked as Superior, is notable less for its scale than for its method: several of the extensions were legitimate tools with real user bases that threat actors acquired and then turned malicious through routine updates, with no new install and no clear warning to existing users.

What Happened

The extensions presented themselves as ordinary utilities: SEO tools, crypto-price monitors, screen-search tools, PDF utilities, and ad-spying extensions. The most significant example was "Enable Right Click & Copy, Smart Unlock + OCR," which had roughly 70,000 Chrome users and about 10,000 Edge users, around 80,000 total, when malicious code was added. The Chrome version has since been removed from the Chrome Web Store, but researchers found the Edge version still active, and it received an updated command-and-control (C2) domain as recently as August 14, 2026.

Once installed, the extensions establish persistent WebSocket connections to attacker infrastructure, receive encrypted JavaScript modules, and execute them dynamically within the sites a victim visits. The malware strips Content Security Policy headers from visited pages, disabling a browser-level defense meant to limit untrusted script execution, then injects malicious code into the main webpage context where it can interact with active sessions, form fields, wallet applications, and page content. That modular design lets the operator swap payloads, rotate C2 infrastructure, and add exfiltration channels without ever replacing the base extension.

Observed payloads included multi-chain wallet drainers targeting Ethereum-compatible, Solana, and Tron wallets; seed-phrase phishing content impersonating Ledger and Trezor recovery or update flows; and session-hijacking modules aimed at Coinbase, Binance, Kraken, KuCoin, OKX, MEXC, Bybit, and MetaMask. Other modules captured text, password, and email field input across websites, harvested Facebook access tokens and business-account data, collected browser history, and delivered ClickFix-style fake update prompts designed to get victims to copy and run attacker-supplied commands.

Why This Matters

Browsers update extensions automatically by default, which means a tool that looked trustworthy at install time can become malicious months later with no new permission prompt and no indication to the user that anything changed. That makes extension risk an ongoing property of software already running in your environment, not a one-time vetting decision made at install. For any organization where employees access financial platforms, corporate applications, or cryptocurrency assets from a browser, that's a live and recurring exposure.

What to Do

Treat browser extensions as managed software rather than personal-choice add-ons, especially on systems with access to corporate applications, financial platforms, administrative portals, or cryptocurrency assets. Inventory installed extensions, restrict installation to approved catalogs where possible, monitor for ownership and permission changes, and review browser telemetry for unusual connections to extension-associated domains. Individual users should remove extensions they don't need, scrutinize permission requests, and never enter a wallet recovery phrase into a browser prompt or website overlay.

Extension risk doesn't end at installation. A routine update is all it takes for trusted software to become a delivery channel for theft.

Tortoiseshell Adds SSH Tunneling and a New Backdoor to Its Toolkit

The Iranian-nexus group Tortoiseshell has rolled out new tooling built for quiet, persistent access inside compromised networks, disguised as a legitimate Windows library.

What You Need to Know

Tortoiseshell, an Iranian-nexus cyberespionage group also tracked as Nimbus Manticore, has expanded its malware capabilities with a reverse SSH tunneling utility and an updated C++ backdoor linked to the TWOSTROKE family. Group-IB identified the tooling while investigating Tortoiseshell infrastructure spanning Europe and the Middle East. Organizations with operations, partners, or personnel in those regions, especially in government, telecommunications, defense, technology, or regional business, should assess this activity against their threat model now.

What Happened

The findings align with recent reporting on the group's use of NightLedger, BridgeHead, and ArcBridge against organizations in the Middle East, Africa, and South Asia, indicating continued investment in persistent access and internal-network reachability. The newly identified tunneling tool masquerades as the legitimate Windows Terminal Server SDK API library, wtsapi32.dll, forwarding legitimate DLL functions to reduce suspicion while using the native Windows OpenSSH client to establish an outbound connection to attacker infrastructure over port 443. The reverse SSH tunnel routes traffic sent to a local port on the C2 server back into the victim environment, giving operators a covert pathway to reach systems and services that aren't otherwise exposed externally. Because it relies on common administrative tooling, DLL masquerading, and outbound encrypted connections, this activity can be hard to distinguish from routine system or remote-management traffic.

Researchers also identified a C++ backdoor with functional similarities to TWOSTROKE. Like the tunneler, it impersonates wtsapi32.dll and appears designed for execution through DLL search-order hijacking. The backdoor establishes HTTPS communications with hard-coded C2 servers, creates a unique identifier from the victim system's fully qualified hostname, and waits for operator commands. Its functionality includes host reconnaissance, directory enumeration, file upload and download, file deletion, shell-command execution, in-memory DLL loading, binary execution, and persistence support, giving the actor a flexible way to collect data, deploy follow-on malware, and sustain access after initial compromise.

Why This Matters

Tortoiseshell's latest tooling reflects a broader shift toward modular, dual-use techniques built specifically to blend into legitimate network activity. A reverse SSH tunnel riding over port 443, wrapped in a DLL that impersonates a real Windows library, is designed to look exactly like the traffic your remote-management tools already generate. That makes detection a matter of specific indicators and behavioral baselining, not just perimeter defense.

What to Do

Detection efforts should prioritize suspicious DLL loading involving wtsapi32.dll, unexpected use of ssh.exe by applications that don't normally require remote tunneling, outbound SSH connections over TCP port 443, and persistent HTTPS communication with unrecognized infrastructure. Endpoint telemetry should also be reviewed for DLL search-order hijacking indicators, anomalous child processes from legitimate applications, command-shell execution, new persistence artifacts, and unexpected file-transfer behavior. Combine network exposure management, application allowlisting, endpoint detection, and threat hunting to identify any systems that may already be serving as a foothold for reverse tunneling or remote operator activity.

Tortoiseshell keeps building tools designed to look boring, which makes disciplined baselining more valuable than any single signature.

Critical cPanel Flaw Lets One Hosting Customer Take Root on a Shared Server

A newly patched cPanel and WHM vulnerability could let a single authenticated hosting customer escalate to full root control of a shared server, putting every other tenant on that box at risk.

What You Need to Know

cPanel has released security updates for CVE-2026-65643, a critical vulnerability in cPanel & WebHost Manager (WHM) that could let an authenticated hosting customer execute code as root. The issue affects domain parking and addon-domain functionality across all supported cPanel & WHM versions, which makes it a serious problem for shared-hosting environments where multiple customer accounts run on the same physical or virtual server. cPanel issued patched builds on August 27, 2026, and hosting providers should act on this immediately.

What's Vulnerable

According to cPanel, an account holder with permission to add parked or addon domains can exploit the flaw to create arbitrary files on the server. Successful exploitation can lead to root-level code execution, handing a lower-privileged tenant full administrative control of the underlying hosting system. From there, an attacker could access other customers' hosted content, databases, credentials, mailboxes, backups, application configurations, and service accounts, establish persistence, alter web content, deploy malware, or pivot into connected management and backup infrastructure.

At the time of disclosure, cPanel had not provided a CVSS score, mitigation guidance, evidence of active exploitation, or indicators administrators can use to determine whether a server was previously compromised. The vulnerability also wasn't listed in CISA's KEV catalog as of August 27. None of that should slow down remediation, particularly for internet-facing shared-hosting servers where customers can manage parked or addon domains.

Why This Matters

Shared hosting is built on the assumption that one tenant's account can't reach into another's, or into the host itself. A flaw that lets any customer with addon-domain permissions escalate to root breaks that assumption completely, and on a multi-tenant server, that's not a single-customer incident, it's a platform-wide one.

What to Do

Patched builds are available for the 110, 134, 136, and 138 release branches, as well as WP Squared. Servers configured for automatic daily updates should receive the fix automatically. Administrators can also force the update from a root shell with /scripts/upcp --force, or install it through WHM using the Upgrade to Latest Version function, then confirm the installed build through WHM's Update Preferences under Server Configuration. Systems running end-of-life releases need to upgrade to a supported cPanel version first before the fix can be applied.

Hosting providers and managed-service operators should immediately identify servers running affected cPanel & WHM builds, prioritize public-facing and multi-tenant systems, and check whether customer accounts have addon-domain or parked-domain permissions. Before and after patching, preserve and review Apache, cPanel, WHM, authentication, process, and file-integrity logs for suspicious file creation, unexpected privilege changes, anomalous root processes, altered virtual-host configurations, unfamiliar cron jobs, new SSH keys, or unauthorized account modifications. Patching stops future exploitation, but it can't undo an existing compromise, so treat any suspicious activity on a potentially affected system as a possible root-level incident.

On a shared server, one tenant's permissions shouldn't be a path to everyone else's data. This patch closes that gap.