PaperCut flaws exploited in credential-theft attacks on schools

Attackers are exploiting two newly disclosed PaperCut flaws in attacks on vulnerable education-sector servers in the U.S. and Europe, according to Arctic Wolf. The security firm described the flaws as an authentication-bypass and remote-code-execution chain, and said observed activity included command execution, reconnaissance, privileged-account creation and tools to collect Windows registry hives. It said the targets ranged from K-12 schools to major universities. Users are advised to restrict PaperCut servers from internet exposure and monitor suspicious command execution.