5 PM Technology News Recap: PaperCut Patch 2, GPUThor, Apple Price Hikes, and Meta Glasses Privacy (August 28, 2026)

PaperCut’s replacement emergency patch, a bounded GPU Rowhammer demonstration, Apple subscription increases, and Meta’s latest smart-glasses privacy fix—with practical next steps.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Jennifer Hudsen seated at a curved newsroom desk, wearing her chestnut mid-high ponytail with loose face-framing tendrils, gestures toward abstract printer-security, GPU, subscription-cost, and smart-glasses privacy icons beside the date August 28, 2026.
Original editorial artwork by The IT Guys for the August 28, 2026 technology recap.

Friday’s technology rundown is about controls that work only when the details do: PaperCut replaced an incomplete emergency patch,[1][2] GPU researchers defeated error correction on four tested workstation cards,[4] Apple raised recurring prices,[6][8] and Meta is closing another smart-glasses recording-light bypass.[10][11]

Reporting cutoff: August 28, 2026, 5:01 p.m. EDT (21:01 UTC). PaperCut and independent researchers confirm active exploitation, but not a global victim count or attacker.[1][3] GPUThor is laboratory research, not observed criminal exploitation.[4] Apple’s live pages verify current monthly prices; same-day reports establish the change.[6][7][8] Meta says its firmware fix is starting to roll out, but the reviewed sources do not show universal completion.[10][11] The featured image reads “AUGUST 28, 2026” and “THE IT GUYS”; its abstract icons are editorial context, not evidence of a vendor or incident.[12]

Listen to the broadcast-ready recap

This KittenTTS Bella narration was synthesized locally from the same checked facts as the article.[13]

Tonight’s four-story rundown

  1. PaperCut replaces an incomplete emergency patch amid active exploitation.[1][3]
  2. GPUThor defeats ECC on four tested Ampere workstation cards.[4]
  3. Apple TV and Apple One Individual cost more.[6][8]
  4. Meta closes another smart-glasses capture-light bypass.[10]

1. PaperCut’s second emergency patch matters more than the first

PaperCut says two flaws can be chained against PaperCut NG/MF: CVE-2026-81578 can let an unauthenticated remote attacker change certain system settings, and CVE-2026-82078 can turn unsafe database-driver configuration into arbitrary Java bytecode execution under the PaperCut server process.[1] PaperCut released Emergency Patch Release 2 for supported version 24, 25, and 26 branches and tells customers to install it even if they already applied the original emergency patch.[1]

Rapid7 reports that the first patch could be bypassed and that the newest vendor patch addresses that bypass.[2] Huntress says it found exploitation in two customer environments and reproduced the pre-authentication remote-code-execution chain; the observed commands focused on system discovery, and Huntress had not observed secondary malware, new command-and-control traffic, or additional persistence from the recovered payload at its checkpoint.[3]

How we know: the vendor advisory supplies CVE scope and remediation; Rapid7 independently analyzed the first-patch bypass; Huntress independently reports two observed environments. Two Huntress customers are not a global victim count, and none of these sources attributes the attacker.

Practical context: remove the PaperCut web interface from untrusted internet access, preserve logs if compromise is possible, install Release 2 on supported branches, and follow PaperCut’s indicators-of-compromise guidance. PaperCut treats all NG/MF versions as potentially affected. Huntress says 47% of approximately 2,500 installations it tracks ran version 23 or older, for which no patch was then available; that percentage describes Huntress’s monitored sample, not the whole internet.[1][3]

Good: a corrected patch and investigation guidance exist.[1]
Caution: the first patch was incomplete, exploitation was confirmed before the corrected patch was available, and a patch does not erase evidence or persistence from a server already compromised.[2][3]

2. GPUThor breaks ECC on four tested cards—not every Nvidia GPU

University of Toronto researchers say GPUThor is a Rowhammer technique that produced multi-bit errors on four tested Nvidia Ampere workstation GPUs with GDDR6 memory: RTX A4000, A4500, A5000, and A6000.[4] Their demonstrations included denial of service and, by corrupting GPU page tables, privilege escalation to a root shell on the host.[4]

CSO independently reviewed the mechanism and Nvidia guidance, including host IOMMU/DMA isolation and ECC-telemetry monitoring.[5] The clearest operational risk is an environment where untrusted GPU code can run, especially shared research, cloud, or development systems.[5]

What remains bounded: the researchers say their current patterns did not produce flips on tested HBM, GDDR6X, or GDDR7 memory, including A100, H100, and tested Blackwell hardware. That is a negative result for this study—not proof that every untested pattern or future attack will fail. The team reports a laboratory demonstration, not exploitation in the wild.[4]

Practical context: avoid untrusted GPU workloads where possible, enable host IOMMU/DMA isolation when supported, and monitor ECC telemetry. ECC still raises the bar, but the demonstrated cards show it is not sufficient by itself.[4][5]

Good: the tested scope is explicit, and the researchers say they disclosed the work to Nvidia and major cloud providers before publication.[4]
Caution: a complete prevention path depends on stronger hardware defenses; independent reproduction is limited until the research artifacts are released.[4][5]

3. Apple TV and Apple One Individual prices rise

Apple’s live U.S. page lists Apple TV at $14.99 per month, while TechCrunch and MacRumors report that it rose from $12.99 per month and that the annual plan moved from $99 to $119.[6][8][9] Apple’s Apple One page lists the Individual plan at $21.95 per month; the two reports say it was $19.95.[7][8]

Evidence boundary: Apple’s live pages verify the current monthly prices but are undated. The before-and-after comparison and annual price come from same-day independent reporting; this edition did not find a dated Apple newsroom announcement.

Practical context: review the next renewal date, compare annual versus monthly use, and price Apple One against only the services your household would buy separately.[6][7][8] A bundle’s theoretical discount is not personal savings when included services go unused.[7]

Good: a bundle may still help households that actively use several included services.[7]
Caution: recurring increases and bundle inertia can turn small monthly changes into avoidable annual spending.[6][7]

4. Meta says its glasses will stop recording when the capture light is covered

Meta wearables chief Alex Himel says a firmware fix is starting to roll out so the camera will stop working if the capture light is covered during an active recording.[10] CNET’s August 28 report describes this as the second privacy-focused update of the summer and explains that the change addresses a bypass left after an earlier fix: someone could start recording while the light was visible and then cover it.[11]

What remains unknown: CNET says the update should apply automatically but did not report hands-on confirmation that the firmware had reached a test device.[11] The reviewed Meta post did not name an exact firmware version, supported-model list, or rollout-completion date.[10] “Starting to roll out” is not universal deployment.[10]

Practical context: owners should confirm updates, keep the capture indicator unobstructed, and respect bystander consent. The fix closes one route for defeating the indicator; it does not settle separate questions about how captured photos and video are handled in the cloud.[11]

Good: the change targets a concrete covert-recording bypass.[11]
Caution: a small indicator can still be hard to notice, and a rollout promise is not proof that every pair is updated.[10][11]

What to do next

  • PaperCut admins: isolate public exposure, preserve evidence, and move to Emergency Patch Release 2 with testing and rollback.[1]
  • GPU operators: restrict untrusted workloads and review IOMMU/DMA isolation plus ECC telemetry.[5]
  • Apple subscribers: audit the next renewal instead of accepting the increase by inertia.[6][8]
  • Smart-glasses owners: confirm updates and never obstruct the capture indicator.[10]

Need help securing, fixing, or planning your technology? Schedule The IT Guys

More from The IT Guys

Frequently asked questions

Does PaperCut’s new patch prove a server was never compromised?

No. Patch status and compromise assessment are separate. Preserve evidence and investigate when exposure or indicators warrant it.[1][3]

Does GPUThor affect every Nvidia card?

No. The demonstrated result covers four named Ampere workstation GPUs, with important negative test results on other memory types.[4]

Did Apple publish a dated newsroom announcement?

Not in the sources checked for this edition. Current monthly prices were verified on Apple’s live pages; the change was dated by same-day reports.[6][7][8]

Does Meta’s update solve every smart-glasses privacy concern?

No. It addresses one capture-light bypass and does not answer every visibility, consent, or cloud-handling question.[10][11]

Sources checked for this edition

  1. PaperCut — urgent NG/MF security advisory
  2. Rapid7 — PaperCut critical zero-day analysis
  3. Huntress — PaperCut active exploitation and pre-auth RCE chain
  4. University of Toronto researchers — GPUThor
  5. CSO — GPUThor hardware attack report
  6. Apple — Apple TV pricing
  7. Apple — Apple One pricing
  8. TechCrunch — Apple TV price increase
  9. MacRumors — Apple TV price increase
  10. Alex Himel — Meta glasses capture-light update
  11. CNET — Meta glasses privacy update
  12. The IT Guys — inspected August 28 recap hero
  13. The IT Guys — inspected KittenTTS Bella narration

Sources were reopened during drafting and are rechecked immediately before publication. Exact capture times, HTTP results, hashes, and evidence boundaries are preserved in the private source ledger.

Browse Articles

Latest Articles