Print management outfit PaperCut is under 0-day attack, and it’s drawing customers’ blood
The fix is either an unvalidated and unofficial emergency patch or taking the server offline
PaperCut, a print management software provider, is currently facing a zero-day attack due to its web interface being exposed to the internet. This attack was brought to the company's attention by a university's security team. PaperCut's NG and MF products, which manage printer access, usage tracking, and remote printing, are affected.
The company has issued a security advisory, emphasizing that it is addressing the issue with the utmost priority but refrains from disclosing the specific vulnerability and its risk. The web interface of PaperCut's products allows access to deeper network areas, leading to indicators of compromise such as altered log files and alerts from various security tools.
In response to the attack, PaperCut has released an emergency patch for customers with publicly accessible PaperCut servers, who are unable to implement other mitigations. However, the patch is not officially released as it bypasses the standard release process. The advisory warns customers to either apply the patch or shut down their servers immediately.
PaperCut is actively working on a more robust fix and plans to inform users once it is available. The Register suggests that users may prefer shutting down their servers, as the patch's use of unvalidated software poses concerns.
Written by urgent.news from The Register Software's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
