What Happened?

Cybercriminals are trying to squeeze money out of Britain’s Department for Education (DfE) after breaking into two of its portals. The group behind the attack, calling itself ExfilSquad, claims to have walked away with more than 600,000 pieces of data — names, email addresses, phone numbers.

But here’s the catch: the DfE says that number refers to lines of data, not individuals. So the actual number of people affected could be far smaller. A spokesperson stressed that the risk to individuals is not considered high.

Which Systems Were Hit?

Two portals took the hit: the DfE Help Desk Self-Service Portal and the Turing Scheme Portal. The Turing Scheme, for those unfamiliar, is the UK government’s global exchange program — it funds students and learners to study and work abroad.

ExfilSquad is demanding a ransom in exchange for not releasing the stolen information. Notably, there’s no claim that they encrypted any systems. This is pure extortion — steal, threaten, collect.

Police Data Also Compromised

Separately, the Police National Legal Database (PNLD) was breached, with 135,000 pieces of data potentially identifying the names, forces, and work email addresses of police officers and others in the criminal justice system. The good news? It doesn’t contain protected information from investigations or witnesses.

The Home Office declined to comment. The National Cyber Security Centre, however, said they are “supporting law enforcement colleagues in response to an incident affecting the Police National Legal Database.”

UK Government’s Stance on Ransom Payments

Britain’s government doesn’t pay ransoms. Period. And it’s moving to make that official for the public sector and critical national infrastructure. Last year, it advanced plans to make it illegal for these entities to make ransomware payments — a move designed to choke off the funding that fuels this criminal industry.

That policy is not yet law, but the direction is clear: if you’re a public body in the UK, paying up could soon be a crime.

Ransomware Attacks on Government Are Declining

Here’s a silver lining. According to data from Britain’s privacy regulator, ransomware attacks on central government have dwindled. After 11 incidents in 2023, only four were reported in the two years that followed. More recent data isn’t available yet, but the trend is promising.

Still, this latest breach shows the threat hasn’t disappeared. It’s evolved.

DfE’s Response

A DfE spokesperson said: “We have robust processes in place to protect information and took swift action to contain this incident. The information involved is limited to customer service contact details relating to individuals and organisations. No other data has been accessed.”

That’s the official line. Whether ExfilSquad actually has what they claim — and whether they’ll follow through on their threat — remains to be seen.

For those following cyber crime trends, this is a familiar pattern: steal data, demand payment, threaten exposure. The UK’s refusal to negotiate is a strong deterrent, but it also means the criminals might follow through on their threats. That’s the ugly calculus of ransomware in 2026.

If you’re involved in the education sector or the criminal justice system in the UK, it’s worth checking whether your contact details might be in the wrong hands. And if you’re a policymaker, this is another reminder that the fight against ransomware is far from over.

When the Database Becomes the Weapon

On July 27, security researchers at Huntress noticed something odd. Credential theft alerts fired on a host running an Oracle database server. Digging deeper, they found a post-exploitation toolkit — compiled and stored not as a file on disk, but as schema objects inside the database itself.

That location matters. It’s a blind spot for most endpoint security tools, which typically scan processes, binaries, and files. Java classes and PL/SQL wrappers sitting inside an Oracle instance? Usually invisible.

The entry point was a SQL injection flaw in the autocomplete search feature of a public-facing Java application running on Apache Tomcat. No vulnerability in Oracle itself — just unvalidated input passed over a JDBC connection using an account with permissions to create Java objects.

How the Oracle Database Toolkit Works

Oracle ships with an embedded Java Virtual Machine (JVM) and a statement that stores Java source code as a database object. The attacker fed malicious code through the injection point, and Oracle compiled it into stored schema objects.

They named the toolkit khunt, following a naming convention that ran through its module names and the files it wrote to disk. The components included:

• A module that opened a Windows command shell for arbitrary OS commands
• A credential dumper that read Oracle’s internal user table and wrote usernames and passwords to a file
• Two file explorers for navigating the filesystem
• An unzip utility
• A reachability check to confirm the toolkit was live
• PL/SQL wrappers to call the underlying Java methods

The technique isn’t new — Huntress noted documented cases in the wild are rare, but the concept has been known for years. What’s novel here is the execution.

Pivoting from Database to Operating System

After establishing a foothold, the attacker opened a Windows command shell and confirmed SYSTEM-level privileges. Then came PowerShell. They invoked the Windows registry tool to copy the SECURITY and SYSTEM hives, enumerated running services, and used the Extensible Storage Engine utility to copy the SAM and SECURITY hives.

Huntress assessed the hives were staged for credential dumping and probable exfiltration — though they described it as an attempt rather than confirmed theft. Apache access logs traced the requests back to a single IP address.

Why Endpoint Tools Miss It

Here’s the crux: storing the toolkit as a database object rather than a file or memory-resident payload puts it outside the scope of most security tooling. Endpoint products focus on processes, binaries, and files. They don’t inspect Java classes and PL/SQL wrappers inside Oracle.

That turns the database from something attackers query for data into a foothold they can operate from. It’s a subtle but significant shift in how we think about database security.

Related reading: Oracle WebLogic RCE attacks show how quickly attackers weaponize critical vulnerabilities. And if you’re wondering about SQL injection prevention best practices, the basics still apply.

Mitigation: It’s Not About the Database Alone

Huntress offered straightforward advice in their analysis: “To avoid these types of attacks, it’s important to ensure the forms aren’t injectable. Practice proper input sanitization and query parameterization for any inputs. It’s also important to ensure that users with the ability to execute queries aren’t overprovisioned.”

That means:

• Validate and parameterize all inputs at the application layer
• Restrict database accounts to the minimum privileges needed
• Monitor for unusual JDBC activity or Java object creation
• Consider extending visibility beyond traditional endpoint tools to include database-level auditing

The attack was detected because of credential theft alerts — not because the toolkit itself was spotted. That’s a lesson in layered defenses. Endpoint tools are necessary, but they’re not sufficient when attackers find creative hiding spots.

As databases become more capable — with embedded JVMs and procedural languages — they also become more attractive as attack platforms. The Oracle database toolkit is a reminder that security teams need to think beyond the file system.

Paperclip AI Flaws Open Door to Unauthenticated Command Execution

Three vulnerabilities in the open-source AI orchestration platform Paperclip have left servers and developers’ machines exposed to unauthenticated command execution. Two of the flaws carry critical ratings, and one holds a perfect CVSS score of 10.0. Researchers at Oasis Security published their findings on August 4, revealing how attackers could exploit these weaknesses to run arbitrary commands and access sensitive data.

The flaws affect Paperclip, a control plane designed for operating what its developers call zero-human companies. Oasis Security uncovered all three bugs during an assessment of the platform’s authenticated and local deployment modes. The disclosure follows a string of similar incidents, including a critical Flowise flaw and a Langflow bug exploited within 20 hours of disclosure.

From Self-Registration to Code Execution: CVE-2026-41679

The most severe vulnerability, CVE-2026-41679 (CVSS 10.0), affects authenticated deployments. Paperclip allowed self-registration without email verification. Its CLI authorization flow let a new user approve their own credential challenge, turning that account into a persistent board-level API key. No separate approver was needed.

That key could then reach the company import route. Paperclip restricted direct company creation to instance administrators, but the equivalent import path checked only for board-level access. An attacker could use this to introduce a bundle containing an agent configured with the process adapter—a legitimate feature that launches a specified command as a child process. Waking that agent ran the attacker’s command with the server’s operating-system privileges.

Second Flaw: Missing Access Checks (GHSA-xfqj-r5qw-8g4j)

A second finding, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), covered several routes that omitted access checks entirely. These exposed heartbeat data, agent documentation, and health information. While less severe than the command execution flaw, this still leaked sensitive operational details to unauthenticated attackers.

A Developer’s Browser as an Attack Path: DNS Rebinding Flaw

The third vulnerability, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), reached the same execution sink from the opposite direction. Paperclip’s local development mode binds to loopback and treats every request as an implicit instance administrator. That assumption holds for local clients but not for browsers.

DNS rebinding let an attacker-controlled webpage cross that boundary. Once the attacker’s server became unreachable, the browser retried the hostname against loopback while still treating the connection as same-origin. Paperclip accepted the rebound requests as administrator actions. The page then imported and woke a malicious agent, executing commands on the developer’s machine.

Industry Reaction: A Systemic Failure in Identity Boundaries

Darren Guccione, CEO at Keeper Security, called the findings “a systemic failure in how AI agent control planes handle identity boundaries.” An attacker controlling an agent configuration does not merely reach data, he said, but can direct privileged action across every system that agent touches. This highlights the growing risk as AI agents gain more access to enterprise systems.

Patches Released: What You Need to Do

All three vulnerabilities were patched after disclosure. The two authenticated-mode findings were fixed in Paperclip 2026.416.0, which now requires instance administrator privileges for new-company imports. The rebinding flaw was addressed in version 0.3.1, which enables hostname validation in local mode.

If you’re running Paperclip, update immediately:

• For authenticated deployments, upgrade to version 2026.416.0 or later.
• For local development mode, upgrade to version 0.3.1 or later.
• Review your existing agents and imports for any suspicious bundles.
• Check logs for unexpected command executions or agent activations.

The rapid exploitation of similar AI platform flaws underscores the urgency. Attackers are actively scanning for vulnerable AI orchestration tools. The AI agent security landscape is evolving fast, and patching is only the first step. Organizations should also audit their identity boundaries and access controls across all AI-related infrastructure.