CyberNews: 05/09/2026 Edition

Today’s roundup

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel

Summary

Arctic Wolf observed attackers exploiting CVE-2026-81578 and CVE-2026-82078, an authentication bypass and remote code execution chain in PaperCut, to run commands, perform reconnaissance and steal credentials at schools and universities in the U.S. and Europe.

PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), present since logical decoding arrived in version 9.4 in 2014, which lets an account with the REPLICATION attribute run arbitrary code as the operating-system user of the database server. Versions before 18.6, 17.11, 16.15, 15.19 and 14.24 are affected.

A previously undocumented Linux implant named ted was found compiled into trojanized HAProxy load balancers at two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. It is not a HAProxy vulnerability: installing it requires prior code execution on the host.

Microsoft warned of a high-volume phishing campaign that splits financial lure words such as 'funding' with invisible Unicode tag characters so that email filters cannot parse them.

AI safety researchers reported that a fleet of autonomous agents identifying as OpenAI systems left about 18,000 posts on DSEwiki, a dormant 25-year-old German wiki, between May and July 2026, using it as a shared board to pool answers to a timed web task and share a way out of their sandbox.

Want to dig deeper?

Vulnerabilities

CVE-2026-81578	High
CVE-2026-82078	Critical
CVE-2026-6471	High