PaperCut NG/MF Zero-Day Under Active Exploitation
PaperCut Software issued an urgent security advisory after confirming active exploitation of a vulnerability affecting all versions of its widely used PaperCut NG and PaperCut MF print-management software.
The company became aware of confirmed customer incidents and treated the matter as highest priority. The flaw enables unauthenticated remote configuration takeover that can lead to arbitrary Java code execution inside the application process. Huntress and others observed limited post-exploitation activity (including base64-encoded reconnaissance commands) in customer environments.
Immediate actions: Restrict any internet-facing PaperCut Application Server web interfaces to trusted IPs only. Apply the emergency patches PaperCut released for the v25 and v26 branches (Windows, Linux, and macOS). Monitor for indicators such as anomalous activity from pc-app.exe, truncated or missing server.log files, and specific database-related error strings. Organizations that cannot immediately isolate or patch should treat exposed servers as high-risk.
This is a classic reminder that print-management systems remain high-value targets—especially when left internet-facing.
Manchester Airports Group Breach Exposes Data of 8.7 Million Customers
Manchester Airports Group (MAG)—operator of Manchester, London Stansted, and East Midlands airports—disclosed a cyber security incident in which unauthorized actors accessed data belonging to approximately 8.7 million customers.
The compromised information primarily came from in-airport Wi-Fi sign-ups plus car-park, lounge, and Fast Track bookings. Exposed data included email addresses (the vast majority of cases), phone numbers, vehicle registration numbers, and postcodes. No bank or payment-card details were stored on the affected system, and MAG stated that passenger safety, aviation security, and airport operations were never compromised.
Hackers demanded a ransom; MAG refused to pay. The group contained the incident after discovery, notified authorities, and is working with specialists. Affected customers have been advised to watch for phishing that leverages the stolen contact details.
Large-scale airport/travel-related data remains attractive for social-engineering campaigns even when financial credentials are absent.
Critical cPanel/WHM Flaw Enables Authenticated Root Takeover
cPanel released patches for a critical vulnerability (tracked as CVE-2026-65643) in domain-parking and addon-domain functionality across cPanel & WHM. An authenticated account holder with permission to add parked or addon domains can create arbitrary files on the server, ultimately achieving code execution as root.
The issue affects all currently supported versions. Successful exploitation on a shared-hosting server can compromise every site, database, and email account on that machine. Patched builds are available across active release tiers (e.g., 11.110.0.141+, 11.134.0.53+, 11.136.0.37+, 11.138.0.2+, and corresponding WP Squared builds).
Priority action for hosting providers and administrators: Force updates immediately (upcp --force or via WHM) and review recent domain-addition activity. Shared-hosting environments are especially exposed because low-privilege customer accounts are common.
OpenAI and 100+ Organizations Warn of Imminent AI-Enabled Cyberattack Surge
OpenAI, Anthropic, Google, Microsoft, and more than 100 technology, cybersecurity, and financial firms published an open letter warning that AI-enabled cyberattacks are poised to become significantly more widespread and sophisticated within months.
The letter emphasizes a narrowing defensive window for critical infrastructure (hospitals, water systems, internet backbone, etc.). Signatories call for AI labs to make frontier models available for defensive testing, stronger government coordination and funding of cyber defenses, continuous testing against advanced AI capabilities, and broader use of AI to harden existing tools. The warning follows recent high-profile incidents involving autonomous AI agents (including the Hugging Face event).
Organizations should accelerate defensive AI adoption, reduce attack surface (longstanding bugs, excessive permissions, weak authentication), and treat AI-augmented threat modeling as an immediate priority rather than a future concern.
These four stories illustrate the day’s dominant themes: actively exploited enterprise software flaws, large-scale consumer data exposure, privileged hosting-control-panel risks, and the accelerating AI threat landscape. Patch where possible, restrict exposure, rotate credentials after any potential compromise, and treat AI-driven offense as an operational reality today.