PaperCut Software reports active exploitation of a critical zero-day affecting PaperCut NG and PaperCut MF, issuing emergency patches for versions 25 and 26. The issue involves an authentication bypass that lets attackers invoke privileged components, then manipulate an external database lookup to execute malicious SQL—ultimately enabling remote code execution. Even without publicly released CVE details and indicators, the vendor emphasizes that internet-exposed PaperCut Application Servers should be treated as high risk immediately.
Key takeaway for defenders: if PaperCut is reachable from the public internet, remediation and exposure reduction (IP allowlisting/firewall/reverse proxy controls) should happen urgently, not after an incident or after CVE publication.
Source: Rapid7
Hugging Face Attack Highlights “AI Agent Swarms” as a Practical Threat Model
Malwarebytes frames the Hugging Face incident around an “AI agent swarm” concept—suggesting that coordinated automated agents can automate reconnaissance, exploitation, and follow-on actions at scale. While the specifics of any one attack vary, the broader warning is consistent: adversaries are operationalizing agentic workflows rather than relying solely on manual tradecraft.
Key takeaway for security teams: prioritize controls that limit tool/function abuse and reduce the blast radius when automated activity begins (e.g., tightened auth, scoped credentials, egress restrictions, and stronger detection for multi-step agent behavior).
Source: MalwareBytes Blog
Manchester Airports Group Breach: Data Access Confirmed for 8.7 Million Customers
Manchester Airports Group (MAG) confirmed unauthorized access to customer data across three UK airports, with approximately 8.7 million people affected. Reporting indicates exposure includes personal information such as emails and other account-related data tied to airport services. As with many breach disclosures, the operational risk extends beyond data—potentially enabling credential-stuffing, phishing, and social engineering.
Key takeaway: treat large-scale identity leakage as an extended risk timeline—accelerate password/2FA checks where relevant, strengthen phishing defenses, and monitor for follow-on account abuse.
Source: Help Net Security
Android 17 Network Privacy Moves: Encrypted Client Hello and Reduced Visible Tracking Surface
Google is adding network security changes in Android 17 aimed at reducing what network operators and eavesdroppers can infer, even when traffic is protected by HTTPS. Updates include protections like Encrypted Client Hello (ECH), which helps hide the hostname portion of the TLS handshake that previously enabled traffic profiling and user tracking. The goal is to make it harder for “sneaky” tracking actors to map user browsing activity to identities.
Key takeaway: privacy improvements shift the defensive landscape—security teams should validate how monitoring, TLS inspection, and network telemetry are expected to work with ECH-capable clients.
Source: Help Net Security
North Korea’s Remote-Worker Strategy Expands Beyond IT: Social Engineering at the Hiring Layer
Huntress reports North Korean (DPRK) remote workers are broadening job searches beyond IT into roles such as sales, marketing, and even medical professions. Instead of traditional intrusions, the operational pattern highlighted is “tricking companies into remotely hiring them,” often while the actors perform legitimate work—making detection harder for defenders. This reframes the threat as insider-like presence created through recruitment and remote work workflows.
Key takeaway: strengthen remote-access and data-access governance for contractors and hires, enforce least privilege by role, and add behavioral/verification layers beyond typical security perimeter controls.
Source: Help Net Security
Trump Admin Executive Order Targets “Risky” Foreign Technology for the U.S. Power Grid
A new executive order is reported to target hardware, software, and remote-access services deemed risky for the U.S. power grid, potentially requiring operators to isolate or replace equipment already in use. The order’s framing focuses on cyber, sabotage, and supply-chain disruption risks—signaling tighter scrutiny of dependencies in critical infrastructure environments. For grid operators and vendors, this increases the compliance pressure around provenance, remote management, and security assurances.
Key takeaway: inventory your grid-adjacent assets and remote-access pathways now—policy shifts like this can translate quickly into audit and remediation requirements.
Source: NextGov Cyber
Signal Research: Contact Discovery Service Flaws Could Enable Privacy-Impacting “Enclave Escape” Paths
Researchers identified two flaws in Signal’s Contact Discovery Service (CDSI), a feature intended to help users find contacts without exposing their address book to the service. The reporting describes vulnerabilities that could allow an “enclave escape” style outcome—meaning the security boundaries meant to protect sensitive contact privacy might be undermined. While the impact depends on exploitation context, any weakness in a privacy-preserving workflow warrants urgent attention.
Key takeaway: privacy features are still attack surfaces—security teams and product owners should treat edge-case interactions and boundary assumptions as first-class risk areas.
Source: SCMagazine
You May Also Be Interested In... PaperCut Releases Emergency Patch for Exploited Zero-Day
AI “Kill Switch” Legislation Proposed Amid Concerns Over Rogue Agents
U.S. Insider-Leak Case Highlights Ongoing Insider Threat Risk