PAPERCUT ACTIVE EXPLOITATION
A patch is not an all-clear.
PaperCut Release 3 remains the priority. CISA refreshed catalog metadata without adding entries. Microsoft’s TerminalFix analysis documents fake CAPTCHA instructions leading to user execution, persistence and a reverse tunnel; the full brief contains safe detection and containment guidance.
ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505 Server Software Component.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Restrict PaperCut management access and install Release 3; hunt before closure. Isolate HPC control planes, harden identities and scheduler APIs, sign software artifacts, monitor storage/fabric egress, and validate power, cooling, provider and model continuity.