Attackers are finding new places to hide and new tools to exploit. |
Today, I’m watching active exploitation, a nation-state infrastructure takedown, and AI reshaping how attacks are launched and where defenders need to look next. - Ken Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
PaperCut RCE Flaw Under Active Attack |
The latest PaperCut RCE flaw concerns me because attackers are already exploiting it in the wild. Huntress observed attacks on two customers, while PaperCut considers all NG and MF versions potentially affected. |
My Take: With active exploitation underway, I’d treat any previously exposed PaperCut server as potentially compromised even after patching. On a lighter note, when I worked in IT, I once had an executive repeatedly click print because the printer was slow, eventually queuing more than 1,900 pages that we had to cancel. Apply PaperCut’s update, remove public access, and preserve logs before restarting or upgrading affected servers. |
FBI Seizes Domains Behind China-Linked Cyberattacks |
The Justice Department seized domains behind QScan and QTRouter, disrupting China-linked attacks on U.S. critical infrastructure. These operators routed attacks through compromised devices and commercial proxies to conceal their origin and blend into legitimate traffic.
My Take: Threat actors have tried to obscure their traffic for years, which is one reason accurate attribution is so difficult. Security teams should hunt for the FBI and NSA’s QTFY indicators and correlate suspicious connections with identity, endpoint, and behavioral telemetry. |
Russian-Speaking Hackers Use Cursor AI in Attacks |
What caught my attention recently is how Russian-speaking hackers allegedly used Cursor’s AI agent to accelerate attacks while posing as legitimate security testers.
Researchers found the agent assisting with scanning, privilege enumeration, VPN configuration, and exploitation, potentially making attacks 30% to 50% faster. My Take: The immediate risk isn’t autonomous AI launching attacks on its own. It’s experienced attackers using AI to remove manual steps and move through an intrusion faster, shrinking the time defenders have to respond.
Organizations should limit AI agent permissions and credentials, segment access, and monitor for anomalous activity. |
|
|
|
Foreign Spies Target More German Companies |
I’m watching the news about the growing role of foreign intelligence services in attacks against German businesses, with 37% of affected companies attributing at least one incident to a foreign intelligence service, up from 28% last year.
At the same time, the share of companies that suspected an attack but could not confirm it nearly tripled from 10% to 29%. |
My Take: The visibility gap concerns me more than the attribution numbers. You can’t contain an intrusion you don’t know happened. Security teams should baseline normal identity, endpoint, and network activity so they can investigate subtle deviations before an intrusion escalates. |
AI Development Tools Become Supply Chain Targets |
We are seeing software supply chain risk expanding beyond dependencies as attackers target developer tools, including IDE extensions, AI agents, and MCP servers. JFrog found 969 malicious AI agent skills, along with malicious models, extensions, and critical MCP vulnerabilities.
My Take: If a developer tool can access your code, credentials, or build pipeline, it belongs in your overall software supply chain security strategy. Organizations should inventory approved developer and AI tools, continuously scan them, and block unapproved tools from development environments. |
|
|
|
Customers are adopting AI faster than many MSPs can secure it. On September 24, 2026 at 12:00 PM ET, Channel Insider and ESET will examine how to uncover shadow AI, address malicious AI activity, and protect customer innovation through stronger security practices and managed detection and response. Turn accelerating AI use into an opportunity to deliver greater resilience. |
|
|
|
Could an Insider Threat Go Undetected? |
Insider threats can involve malicious employees, compromised accounts, excessive privileges, and accidental data exposure. |
How to reduce insider threat risk: |
- Enforce least privilege, require phishing-resistant MFA, and regularly review user permissions.
- Monitor and alert on abnormal downloads, privilege changes, off-hours activity, and access to unfamiliar systems.
-
Use DLP tools to detect and prevent unauthorized data movement, especially during employee offboarding.
|
Use insider threat metrics to identify where privileged access, sensitive data exposure, and detection gaps create the greatest potential for material business impact. |
|
|
|
Security Tools You Can Use |
- Cyber threats move fast—your endpoint management should too. Discover how autonomous endpoint management helps close security gaps and keep endpoints protected with less manual effort.
-
Stay ahead of threats — explore the best cybersecurity tools and lock down your business today.
- Explore the top cybersecurity companies protecting businesses in 2026.
|
|
|
|
How isolated are your print servers? |
|
|
|
Yesterday's Pulse Check Results |
AI Career Check: What’s changing most on your security team? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
