This week’s TL;DR features two main stories that focus on infrastructure that organisations often trust without much scrutiny. PaperCut servers are being actively targeted, while backdoors discovered in widely rebranded routers show how difficult it can be to assess the technology sitting at the network edge. Here is what you need to know.
Attackers Chain PaperCut Flaws for Remote Code Execution
Attackers are exploiting two vulnerabilities in PaperCut NG and MF, according to The Hacker News.
CVE-2026-81578 allows unauthenticated requests to reach administrative functions before access checks are completed. Attackers can then use CVE-2026-82078 to load malicious Java code and execute commands through the PaperCut application.
Huntress observed exploitation in two customer environments. The attackers gathered information about user accounts, operating systems, running processes and stored files. Their code also deleted application logs and other evidence after execution.
PaperCut released a second emergency update after researchers found weaknesses in the original fix. However, patching alone may not be enough for systems that were exposed before the update. Organisations should remove PaperCut administration interfaces from the public Internet, restrict access to trusted IP addresses or a VPN, and investigate the published indicators of compromise.
PaperCut is particularly attractive because it can provide both a route into the corporate network and access to sensitive printed documents. Previous PaperCut vulnerabilities have also been used by ransomware groups.
PaperCut Zero-Day – TL;DR
Attackers are chaining two PaperCut flaws to bypass authentication and run code remotely. Apply the latest update, remove public exposure and treat previously vulnerable servers as potential incidents rather than routine patching jobs.
White-Label Routers Found With Root-Level Backdoors
Researchers have discovered several command-and-control implants in routers manufactured by Shenzhen Zhibotong Electronics, or ZBT, Dark Reading reports.
ZBT equipment is sold internationally under numerous third-party brands. Consequently, an organisation may be using affected hardware without recognising the underlying manufacturer.
The implants, named EndlessDoors, SpeakingStone and DarkLantern, appeared across different generations of ZBT firmware. They can provide root-level access and support capabilities such as command execution, credential theft, traffic monitoring and DNS manipulation.
Some variants initiate their own outbound communications. This means they can operate behind NAT and may pass through firewalls that block unsolicited inbound connections. Researchers estimated that the most widespread implant could affect devices numbering into six figures, although white-label distribution makes the true number difficult to establish.
ZBT reportedly issued updated firmware, but a researcher later purchased another rebranded device that still contained an implant. Organisations should therefore identify routers by hardware manufacturer and MAC address information, inspect unexpected outbound traffic and replace affected devices. Checking only the brand printed on the casing is unlikely to provide an accurate inventory.
Backdoored Routers – TL;DR
ZBT routers sold under multiple brand names have been found with implants capable of providing root access. Identify the real manufacturer behind network equipment, monitor outbound connections and replace affected hardware rather than relying solely on firmware updates.
Conclusion
Both stories expose the risk created by trusted infrastructure at the edge of the organisation. Internet-facing software needs rapid patching and active threat hunting, while hardware inventories must record what devices actually are, not simply the name under which they were sold.
ThinScale helps organisations strengthen and manage the endpoint layer across remote, on-site and hybrid environments. Get in touch to learn more.
