[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6bIllIItxD0tbeb7x6S4h-5rYk8OoUVYvbC7rwO9dkQ":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"efe4748d-4b2c-4a04-b251-28169c967d6c","Recently patched PaperCut zero-days used in data theft attacks","recently-patched-papercut-zero-days-used-in-data-theft-attacks-6440af","Two security vulnerabilities in the PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being abused in data theft attacks. [...]","Two critical vulnerabilities in PaperCut NG and MF print management software, previously exploited as zero-days and recently patched, are now being actively abused for data theft. Attackers are chaining these flaws to bypass authentication, gain remote code execution, and dump database tables, specifically targeting data rather than just system compromise. PaperCut Software has released emergency patches and indicators of compromise, but the full scope and attribution of the ongoing attacks remain unclear.","Two patched PaperCut zero-days are now being abused in data theft attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Frecently-patched-papercut-zero-days-used-in-data-theft-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F31\u002FPaperCut.jpg","2026-09-01T07:48:24+00:00","2026-09-01T08:00:20.055251+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"PaperCut NG","product",{"name":21,"type":19},"PaperCut MF",{"name":23,"type":24},"PaperCut Software","vendor",{"name":26,"type":27},"LockBit","threat_actor",{"name":29,"type":27},"Clop",{"name":31,"type":27},"MuddyWater","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2026-81578","PaperCut NG\u002FMF vulnerability, chained for auth bypass and RCE.",{"type":57,"value":61,"context":59},"CVE-2026-82078",[23,18,21],{"controls":64,"vendors":151},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":54,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[152],{"slug":136,"name":137,"logo_path":138,"roles":153},[154],"reported_by",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":172},"papercut-zero-days-chained-for-data-theft-before-patches-applied","PaperCut Zero-Days Chained for Data Theft Before Patches Applied","Attackers exploited two critical zero-day vulnerabilities in PaperCut print management software to bypass authentication, execute remote code, and exfiltrate database contents before patches were available. The chaining of these flaws demonstrates how sophisticated threat actors can combine vulnerabilities to maximize impact, moving beyond simple system compromise to targeted data theft. Print management software is often overlooked in security programs despite having broad network access and storing sensitive user and configuration data. This incident underscores that any internet-facing or internally accessible application — even peripheral management tools — must be included in vulnerability management and rapid patching programs.",[160,161,162,163,164,165,166,167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 3: Data Protection","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-3: Access Enforcement","NIST AU-12: Audit Record Generation","NIST IR-4: Incident Handling","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ITIL: Change Management \u002F Emergency Change Process",{}]