A Russian hacker group has harnessed artificial intelligence to exploit vulnerabilities in PaperCut software, impacting hundreds of organizations around the globe. These attacks involve creating and deploying sophisticated exploits that take advantage of specific flaws in the software. PaperCut is widely used for print management, making many businesses vulnerable to these AI-driven attacks. The implications are serious, as compromised systems can lead to unauthorized access to sensitive data and disruption of services. Companies using PaperCut should take immediate action to patch their systems and protect against these evolving threats.
Automox has introduced a new feature called the Mitigation Worklet Pipeline, which uses artificial intelligence to speed up the process of addressing vulnerabilities in software. This innovation significantly reduces the time it takes to respond to newly discovered security flaws, cutting it down from days or weeks to just minutes or hours. Since its launch in 2019, Automox has deployed these automation tools across millions of endpoints, helping to mitigate risks from vulnerabilities that companies may not be able to patch. This is particularly important as the number of vulnerabilities related to advanced AI models continues to grow. Businesses using Automox can expect faster protection against these evolving threats, which is crucial in today’s fast-paced digital landscape.
PaperCut has released a new security maintenance update to address two significant vulnerabilities in its software that were being actively exploited. The updates are available for users of PaperCut NG/MF versions 26.0.5, 25.0.13, and 24.1.10. This move replaces earlier emergency patches that were initially issued to tackle these issues. It's crucial for users running these versions to apply the updates promptly to protect their systems from potential attacks. The vulnerabilities pose risks to the security of printing services and could allow unauthorized access or manipulation of sensitive information.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities are identified as CVE-2026-67277, which involves missing authentication for critical functions, and CVE-2026-86060, which pertains to improper handling of command delimiters. These weaknesses could allow attackers to gain complete control over affected systems, posing significant risks to federal agencies and other organizations that use these routers. CISA emphasizes the importance of promptly addressing these vulnerabilities, especially for federal agencies under its Binding Operational Directive 26-04, which mandates prioritizing the remediation of high-risk vulnerabilities. Organizations are encouraged to adopt similar practices for their own security management.
A suspected Russian-speaking cyber actor has exploited recently discovered vulnerabilities in PaperCut NG and MF software, using artificial intelligence to compromise over 440 instances. The attacks are traced back to a specific IP address linked to this actor, indicating a coordinated effort to take advantage of the security flaws. Organizations using these PaperCut products should take immediate action to secure their systems, as the vulnerabilities are actively being exploited. The incident underscores the need for vigilance in patch management and system monitoring, especially in light of the growing use of AI in cyberattacks. This situation serves as a reminder of the evolving tactics employed by cybercriminals and the importance of timely security updates.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified three serious vulnerabilities affecting products from Cisco, Citrix, and Fortinet. These vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, which means federal agencies are required to patch them by September 12, 2026. One of the vulnerabilities, CVE-2026-20079, has a maximum severity score of 10.0, indicating a critical risk. It's crucial for organizations using these products to prioritize these updates to protect against potential exploitation. Failure to address these vulnerabilities could lead to significant security breaches, putting sensitive data at risk.
Recent reports indicate that several Chinese espionage groups are actively exploiting a series of zero-day vulnerabilities, targeting various organizations. These vulnerabilities are linked in a 'triple-link chain,' which makes them particularly dangerous as attackers can leverage multiple weaknesses simultaneously. Proofpoint has noted that the exploitation is ongoing and anticipates that the scope of these attacks will expand further. Organizations should be vigilant and assess their security measures to protect against these threats, as the risk of data breaches and espionage increases with such active exploitation. The situation underscores the need for enhanced monitoring and prompt patch management to safeguard sensitive information.
The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that these flaws are currently being exploited in the wild. The vulnerabilities include a heap-based buffer overflow in Fortinet products (CVE-2025-25249), an authentication bypass in Citrix NetScaler (CVE-2026-19490), an out-of-bounds write in Google Chromium's V8 engine (CVE-2026-87491), and another authentication bypass affecting Cisco Firewall Management Center (CVE-2026-20079). These vulnerabilities pose significant risks, especially to federal agencies, which are urged to prioritize quick remediation efforts based on a directive from CISA. While the directive primarily affects federal entities, CISA encourages all organizations to adopt similar risk-based practices to address these vulnerabilities effectively. Organizations are also invited to report any exploited vulnerabilities not yet listed in the KEV Catalog for evaluation.
Schneider Electric and Siemens have released important patches to address critical vulnerabilities in their industrial control systems. These updates come as part of the regular security maintenance from these companies, which also includes patches from AVEVA and Rockwell Automation. The vulnerabilities could potentially allow attackers to exploit system weaknesses, which is particularly concerning given the critical role these systems play in managing infrastructure and industrial operations. Organizations using affected products are urged to apply these patches promptly to safeguard their systems against potential attacks. Ensuring these updates are implemented can help prevent unauthorized access and maintain operational safety.
Google has released updates to address 230 security vulnerabilities in Chrome, including a medium-severity bug known as CVE-2026-87491. This vulnerability is an out-of-bounds issue in V8, the JavaScript and WebAssembly engine used by Chrome. Notably, it is currently being exploited in the wild, which raises concerns for users and organizations that rely on this browser. This kind of vulnerability could allow attackers to execute arbitrary code within the browser's sandbox environment, potentially leading to unauthorized access or data breaches. Users and administrators are strongly advised to update their Chrome installations to the latest version to mitigate this risk.
Onapsis has issued a warning about a severe security vulnerability in SAP systems known as the 'Overpass' flaw, which has received a maximum CVSS score of 10.0. This vulnerability could allow attackers to exploit SAP applications, potentially leading to unauthorized access and data breaches. SAP customers are strongly advised to apply the necessary patches to protect their systems from this risk. The urgency is heightened as the flaw poses significant threats to the integrity and confidentiality of sensitive business data. Organizations using affected SAP products must act quickly to mitigate potential exploitation.
A security researcher known as Chaotic Eclipse has released a proof-of-concept for a new zero-day vulnerability in Microsoft Defender, dubbed ShieldCrash. This flaw is a bypass of a previously reported vulnerability known as ShieldBreak (CVE-2026-69414), which had a CVSS score of 7.8. The researcher claims that Microsoft did not adequately patch the earlier vulnerability, leaving users at risk. This situation is concerning for organizations relying on Microsoft Defender for endpoint protection, as it could allow attackers to exploit the bypass and gain unauthorized access to systems. Companies using Microsoft Defender should monitor for updates and consider additional security measures until a proper fix is implemented.
On Patch Tuesday, Microsoft addressed a record-breaking 974 vulnerabilities across its software, including two that are currently being exploited. The vulnerabilities include 723 in Windows, 111 in Office, 62 in SQL, and 22 in Developer Tools. Over 110 of these flaws are classified as critical, meaning they could allow attackers to gain significant control over affected systems. The fact that two of these vulnerabilities are actively exploited in the wild raises serious concerns for users and organizations using these products. It is crucial for users to apply the patches as soon as possible to protect their systems from potential attacks.
The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating that these flaws are actively being exploited in the wild. The vulnerabilities include CVE-2026-75650 affecting Adobe Commerce and Magento, CVE-2026-81963 and CVE-2026-85880 impacting Microsoft Windows, and CVE-2026-86218 concerning N-able N-central. These vulnerabilities are particularly concerning for federal agencies, as they could allow attackers to gain total control over compromised systems. CISA's Binding Operational Directive 26-04 emphasizes the need for federal agencies to promptly address high-risk vulnerabilities, and while it specifically applies to federal entities, CISA encourages all organizations to adopt similar practices for managing and mitigating risks associated with these vulnerabilities.
MikroTik has issued patches to address serious vulnerabilities in their routers, collectively referred to as MikroTrick. These flaws allow attackers to bypass authentication and overwrite configuration files, potentially enabling them to take complete control of affected devices. The vulnerabilities can impact various MikroTik router models, posing risks for users who rely on these devices for internet connectivity. This situation underscores the need for users to apply the latest security updates promptly to protect their networks from unauthorized access. Ensuring that devices are updated not only safeguards individual users but also helps maintain the overall security of the internet infrastructure.