Security Signal Weekly: August 22-28, 2026

OverviewI spent most of this weekend moving, so Friday’s edition slipped past me. I am publishing it late rather than pretending the week was quiet. PaperCut and NetScaler both moved into active-exploitation territory, Next.js shipped fixes for two critical remote-code-execution flaws, and another trusted npm publishing path was turned against developers.The incident side was just as busy. Two large healthcare companies disclosed disruptions, ATF called an intrusion into a standalone system a major incident, and the FBI and Justice Department shut down infrastructure used to hide attacks against US critical networks. The practical thread is familiar: reduce exposed attack surface first, then verify the trusted systems and third parties that can still reach sensitive data.Reality check: Being late to a patch does not make the exposure disappear. It only makes the verification step more important, because you now have to ask whether the attacker arrived before the fix.Top 10 Security…