PaperCut Zero-Day Hack: Active Exploitation Hits All NG and MF Servers

PaperCut faces active zero-day exploitation impacting every version of its NG and MF print management software. The company issued emergency patches for v25 and v26 after acknowledging confirmed customer incidents. Administrators are urged to instantly restrict internet access to trusted IPs, as details regarding the exploit methods and attackers remain completely undisclosed. A previous critical flaw in the same software carried a 9.8 CVSS score in 2023, ultimately allowing Russian threat actors and Lace Tempest to deploy Cl0p and LockBit ransomware. "Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses," PaperCut said. "Take this action now, even if you have not observed suspicious activity."