PaperCut warns that a zero-day in NG and MF is being exploited. The company already release emergency patches to address it. PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products. The flaw has no CVE yet, and the company has not released technical details. PaperCut issued emergency patches on Friday and urged customers to install them immediately. It also recommends disconnecting application servers from the internet and limiting access to trusted IP addresses. “If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).” states the advisory. “Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.” The company confirmed incidents affecting customers and said its investigation is still underway. “PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.” reads the advisory. “We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.” PaperCut has not yet disclosed details about the vulnerability, the attack method, or the attackers behind the campaign. So far, the company has identified several indicators of compromise: Intrusion-detection, endpoint-security, or network-monitoring tools may flag suspicious activity involving the PaperCut Application Server, especially activity linked to pc-app.exe. Attackers may delete, truncate, or alter PaperCut server.log files to hide their activity. The server.log file may contain these entries: ERROR No suitable driver found for jdbc:no:x ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST Users running PaperCut should check their systems for these signs of compromise. In May 2023, Microsoft warned that Iran-linked APT groups were exploiting another flaw, tracked as CVE-2023-27350, in attacks against PaperCut MF/NG print management servers. The CVE-2023-27350 flaw is a PaperCut MF/NG Improper Access Control Vulnerability. PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of SYSTEM. In April 2023, Microsoft linked the attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to a financially motivated threat actor tracked as Lace Tempest (formerly DEV-0950). The group is known to be an affiliate of the Clop ransomware RaaS affiliate, it has been linked to GoAnywhere attacks and Raspberry Robin infection. Since April 13, 2023, Lace Tempest added the PaperCut exploits to its arsenal. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Zero-Day)
The Manchester Airports Group (MAG) disclosed that hackers breached its systems and stole customer data, including Wi-Fi sign-ups from Manchester, Stansted, and East Midlands airports. The intruder did not access customer payment details, and the attack had no impact on airport operations, the company said. A statement from the company today notes that the exfiltrated data also "relates to car park, lounge and Fast Track bookings." The list of compromised details includes customers' email addresses, phone numbers, vehicle registration numbers, and postcodes. “The incident has not resulted in any operational disruption,” assured the organization, adding that “Airport operations remain unaffected and customer parking services continue to operate normally.” Out of an abundance of caution, MAG has temporarily suspended its online “Manage My Booking” service and is instead directing travelers to use its phone line.
Threat research gives security teams insight into how attackers operate, while MDR turns that intelligence into faster detection and response. ESET explains how combining threat intelligence, continuous monitoring, and human expertise can help SMBs strengthen their defenses.
Australian authorities have arrested and charged two young men accused of being part of the TeamPCP hacking group linked to a string of far-reaching developer supply chain attacks. TeamPCP is a hacking group known for widespread supply-chain attacks over the past year that targeted open-source software and developer platforms to steal credentials, authentication secrets, and source code. High-profile attacks attributed to TeamPCP have impacted Trivy, LiteLLM, Telnyx, SAP, and TanStack packages, while the group has also breached the European Commission, Mistral AI, OpenAI, and GitHub. To carry out their attacks, the threat actors injected malicious code into software hosted on open-source repositories, which developers then unknowingly incorporated into their own applications on systems used by government, academic, and private-sector organizations.
The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retailer giant Carhartt earlier this month, according to data breach notification service Have I Been Pwned. Founded in 1889, Carhartt is an American apparel company with workwear and streetwear manufacturing facilities in Kentucky and Tennessee and more than 3,000 employees in the United States and Europe. While Carhartt has yet to confirm the extortion group's claims or issue a statement about the breach, ShinyHunters claimed the attack on August 13 and said they allegedly stole more than 50GB of documents containing a wide range of customer, employee, and corporate data. "Millions of records of customer data and vast amount of sensitive information and PII containing employee, customer, customer metadata (royalty info), and other internal corporate data was compromised," the cybercrime gang said.
Meta will pay up to $18B and cap teen Facebook and Instagram use at two hours daily after nearly all US states sued over child safety. Meta will pay up to $18 billion over the next decade and impose real usage limits on teenagers using Facebook and Instagram, settling claims that the company deliberately designed its platforms to addict children. The deal ended a federal trial mid-stream, right as Instagram head Adam Mosseri had begun testifying and Mark Zuckerberg was expected to take the stand next. The timing made sense given the huge potential penalties. Four states, California, Colorado, Kentucky, and New Jersey, were seeking up to $200 billion in damages. Before the trial, Meta said they could demand as much as $1.4 trillion. Against those figures, the $18 billion settlement looks relatively small, although it still equals about three to four months of Meta’s profits. The most important part of the deal is what Meta agreed to change. Teenagers will be limited to two hours a day on Facebook and Instagram. Meta will also block access between midnight and 6 a.m. unless a parent gives permission, and it will turn off most push notifications during school hours. “The focus of this case was to protect our kids,” Colorado Attorney General Phil Weiser said in a statement reported by Reuters. “The relief we are getting in this settlement is very meaningful and well beyond what any court has ordered or is likely to order.”” What the settlement leaves unchanged matters too. Meta does not have to stop using personalized recommendations or targeted ads for teenagers. It also does not have to remove specific types of content that researchers have linked to negative effects, such as posts that can make users feel worse about their bodies. A two-hour limit is still a meaningful restriction, but Meta can continue trying to maximize engagement during those two hours. The deal also creates an interesting financial incentive. Of the roughly $16.7 billion going to 47 states, Washington D.C., Puerto Rico and other territories, about $12.7 billion is guaranteed. The remaining $5 billion depends on whether Snapchat, TikTok and YouTube introduce similar protections for teenagers. This gives Meta a financial reason to push its competitors to adopt the same rules, which is why the company reportedly plans to use newspaper ads to encourage TikTok and YouTube to follow suit. Separately, Wednesday’s settlement also resolved lingering state privacy claims tied to the Cambridge Analytica scandal, with Meta agreeing to pay $459 million on top of everything else. That’s an old wound getting stitched up alongside a much newer one, in the same afternoon. Not every state joined the settlement. New Mexico stayed out after winning a $567 million public nuisance ruling against Meta earlier this month, on top of a separate $375 million jury verdict. Attorney General Raul Torrez said the settlement didn’t include some changes his case had pushed for, including stronger protection against adults targeting children and a ban on sexualized AI chatbot interactions with minors. Still, he called the deal a step forward. Florida rejected the settlement altogether. Attorney General James Uthmeier said the payouts amount to “peanuts” compared with the harm caused and said Florida would take Meta to trial instead. Legal experts already see the settlement as a possible model for future cases. Northwestern law professor James Speta said Meta and other tech companies faced growing pressure to change anyway, from Congress, state lawmakers and the public. That makes the settlement more than a single case: it could set a standard that courts and regulators use when judging other platforms. Thousands of similar lawsuits from individuals, school districts and municipalities are still moving through courts across the U.S. If those cases follow the same pattern, we haven’t seen the last of these headlines. “Today, we are announcing an agreement with a bipartisan group of 52 attorneys general across US states, territories, and the District of Columbia, building on our longstanding efforts to empower parents and support teens.” reads the statement published by Meta. “Over the years, we have consistently partnered with parents and experts — listening, learning, and building. That’s why we launched Teen Accounts in 2024, to bring automatic protections to teens, and more control for parents.” The agreement aims to push YouTube, TikTok and other platforms to adopt similar protections for teenagers. “While this is an important step, the fact is that teens move fluidly between dozens of apps a day. All platforms should empower parents and support teens by putting the same measures in place, because we know that when teens are restricted on one app, they simply move to another.” concludes Meta. “For meaningful progress to happen, we urge TikTok and YouTube to join us and state attorneys general in adopting this new standard, to ensure teens use social media in a healthy and responsible way.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Facebook)
ATF, the regulatory agency that enforces federal laws governing firearms and explosives in the United States, has confirmed that one of its systems was compromised after breach claims made by the Qilin ransomware gang. This follows Qilin adding the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives to its dark web data leak portal on Wednesday, without saying whether it had stolen files from ATF's systems or demanded a ransom. The same day, the ATF published a press release saying that a standalone system was breached in what it described as a "major incident," which is now being investigated in collaboration with the Department of Justice. "The impacted system operates separately from the ATF enterprise network, and there is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system," the federal law enforcement agency said.
Medical technology company Boston Scientific has been targeted in a cyberattack that disrupted some of its IT systems, causing operational disruptions globally. The company detected the incident on August 25 and says in an announcement today that it caused a network outage and "impacted access to certain operating systems and business applications, including the ability to process and ship customer orders." After identifying the intrusion, Boston Scientific activated its incident response procedures and contracted external cybersecurity experts to investigate the impact and help with containment efforts. The company said it does not yet know when all affected systems will be restored. “The incident has caused, and is expected to continue to cause, disruptions and limitations of access to certain of the Company’s information systems and business applications that support aspects of the Company’s operations, including the ability to process and ship customer orders,” Boston Scientific states.
Snowflake is ending password authentication for legacy service accounts, forcing organizations to migrate them to passwordless methods. Token Security explains why the harder challenge is identifying what uses each account, who owns it, and how much access it still needs.
Attackers are actively exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Like cloud-hosted GitHub or GitLab SaaS (Software as a Service) platforms, Gitea provides a full suite of DevOps tools, but it is designed to be used as a self-hosted software development platform. Tracked as CVE-2026-60004 and reported by Salesforce security researcher Shai Rod, this code injection security flaw allows an authenticated user with repository write access to repositories hosted on vulnerable servers to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint. However, default-configured Gitea instances have self-registration enabled, allowing unauthenticated attackers to register an account, create a new repository, and trigger the vulnerability without prior credentials.
Confirm this action.
Leaving now will discard your changes.