🚨 What Mattered This Week
PaperCut Confirms Active Exploitation and Ships a Second Emergency Patch
PaperCut says it is investigating active exploitation affecting PaperCut NG and MF and has confirmed customer incidents. On August 28, the company published Emergency Patch Release 2 for versions 24, 25, and 26 and told customers to install it even if they had already applied the first emergency patch. The advisory applies to all NG/MF versions.
PaperCut has now disclosed two flaws. CVE-2026-81578 can, under specific conditions, let unauthenticated remote requests modify certain system configurations. CVE-2026-82078 can execute arbitrary Java bytecode under the PaperCut server process if an attacker can manipulate relevant configuration. Those disclosures explain the severity, but PaperCut has not said every observed incident used that exact path.
The company’s updated indicators include suspicious child shells from pc-app, missing or truncated server.log files, and observed installation of SimpleHelp or AnyDesk. Internet-facing Application Servers should be restricted to trusted IPs immediately while Release 2 is installed and compromise is investigated.
Key Takeaway: Treat internet-facing PaperCut Application Servers as potential incident-response cases, not just patch targets: restrict exposure, install Release 2, and hunt for the vendor’s published evidence.
Source: PaperCut security advisory
DOJ and FBI Disrupt QTFY’s QScan and QTRouter Infrastructure
The Justice Department and FBI seized domains used by QScan and QTRouter, two platforms the government says were operated by the China-linked QTFY group to target U.S. critical infrastructure and other sensitive networks. DOJ says QScan scans and infects internet-of-things devices, while QTRouter combines compromised devices, commercial proxies, and leased servers into an obfuscation network that can make intrusion traffic appear to originate outside China—or close to a target.
The seized domains were hard-coded into the platforms, and DOJ says the action made QScan and QTRouter inoperable. A joint NSA/FBI/Cyber National Mission Force advisory says QTFY has targeted defense, telecommunications, local government, higher education, and other sectors and uses both zero-day and known vulnerabilities for initial access.
The wording matters: DOJ revised its release on August 28 to align it with the underlying allegations, so listed organizations should be described as targets, not automatically as confirmed victims. For defenders, the practical lesson is that “local-looking” source infrastructure is not a trust signal; edge devices need isolation, current firmware, and behavioral monitoring.
Key Takeaway: Source geography is weak evidence of trust when compromised edge devices can be used as an obfuscation layer. Segment critical systems from edge infrastructure and hunt behavior, not just IP reputation.
Sources: U.S. Department of Justice · NSA advisory summary
Boston Scientific Outage Shows the Cost of Recovery Dependencies
Boston Scientific is still recovering from a cybersecurity incident it identified on August 25 that caused a global network disruption. Its SEC filing said the event affected IT systems and business applications supporting operations, including the ability to process and ship customer orders. The company’s August 30 update says it has seen no related unauthorized activity since August 25, cloud-based systems and applications are unaffected, and the unauthorized activity identified so far is limited to certain on-premises systems.
The operational impact remains the important part. Boston Scientific says it can accept electronic orders and queue them for later fulfillment, while the company works toward partial restoration of shipping for some products. Earlier updates said access to systems used for manufacturing, order processing, and shipping was affected. The company also says it has found no increased cybersecurity risk to hospital networks from its devices and no known impact to devices not connected to its network, although some new remote-monitoring activations remain disrupted.
This is a recovery story as much as an intrusion story: containment is only one milestone when on-premises business systems sit directly in the path of manufacturing and fulfillment.
Key Takeaway: Recovery architecture belongs in cyber risk analysis. Know which on-premises systems directly gate manufacturing, fulfillment, or other critical business functions before an incident tests the dependency.
Sources: Boston Scientific incident update · SEC Form 8-K
🔎 Other Signals
Next.js Fixes Two Critical RCE Paths
Next.js published two critical remote-code-execution advisories on August 25. CVE-2026-75604 affects certain Windows-hosted applications on versions 13.4 through 15.5.23 and 16.0 through 16.3.2; a separate AVIF image-optimization flaw has no CVE. Both are fixed in 15.5.24 and 16.3.3. No active exploitation is stated in the advisories.
Gitea Tightens Fork-to-Runner Trust Boundaries
Gitea 1.27.3 closes several security gaps around forked pull requests and Actions. CVE-2026-66877 and CVE-2026-71184 could bypass workflow approval and allow fork-controlled code to reach self-hosted runners; CVE-2026-66874 could make a required status check appear satisfied without the workflow running. Gitea recommends upgrading all users to 1.27.3.
Source: Gitea 1.27.3 release
ATF Says a Major Incident Stayed Inside a Standalone System
ATF says an August 26 cybersecurity incident affected a standalone system that operates separately from its enterprise network. The agency terminated connections to the environment, began forensics, and says there is no indication its enterprise network, eForms, or other ATF systems were affected. The event was designated a federal “major incident,” but ATF says its mission was not disrupted.
Source: ATF statement
📈 Defender Trend
This week’s pattern is authority and dependency hiding inside systems that look secondary. PaperCut’s application server can turn configuration control into server-context code execution; QTFY used compromised edge and IoT devices as an obfuscation layer for intrusion activity; and Boston Scientific showed how disruption of on-premises business systems can propagate into manufacturing and order fulfillment even when cloud systems remain unaffected. Next.js and Gitea add the software-development version of the same problem: frameworks and CI runners quietly sit between untrusted input and execution. The defensive question is therefore not only “is it exposed?” but “what can this system cause somewhere else?” Asset criticality should reflect delegated authority, downstream dependencies, and recovery blast radius—not the mundane role printed on the asset record.
⚔️ Actionable Defense Move of the Week
Action: Complete a 24-hour PaperCut NG/MF exposure, patch, and compromise review.
Who runs it: Security engineering coordinates with the print-services/server owner; the SOC owns hunting and evidence review; network security validates exposure controls.
Check these specifically: Inventory every PaperCut NG/MF Application Server and its version; identify any public internet exposure; restrict web access to trusted IPs; install Emergency Patch Release 2 on supported v24, v25, and v26 deployments; review PaperCut server.log for the vendor-published strings and for deletion or unexpected truncation; hunt for pc-app spawning shell processes, SimpleHelp’s “Remote Access Service,” unexpected AnyDesk, and related EDR or network alerts. Treat suspicious systems as incident-response cases rather than patch-only tickets.
Evidence you're done: A version-and-exposure inventory, firewall or ACL proof, patch-status evidence, exported SIEM/EDR hunt results, confirmation that server.log was reviewed, and incident or exception tickets for every system that could not be cleared.
🧠 Final Word
Security inventories still tend to rank the obvious: internet-facing gateways, domain controllers, and production databases. This week argues for a second inventory—systems that inherit authority. Print-management servers, CI runners, edge devices, and business platforms can look mundane until they become a path to execute code, hide origin, or stop fulfillment.
For every service that automates or administers something else, document what it can reach, what identity it uses, and how quickly that trust can be revoked. That inventory will tell you more about blast radius than any product category can.