PaperCut confirmed the active exploitation of two flaws in NG and MF. Emergency Patch Release 2 is also intended for organizations that have already deployed the original emergency patch.
Wiz honeypot telemetry showed persistent attempts to exploit AI and MCP services. Researchers also recorded attacks targeting two LiteLLM vulnerabilities for which fixes are available.
Security bulletin QSB-118 warns of a flaw when transferring a file from dom0 to a malicious qube. Under certain conditions, it allows an arbitrary command to be executed in dom0.
PaperCut confirmed incidents affecting customers and the active exploitation of an as-yet-unspecified flaw in PaperCut NG and PaperCut MF. The risk affects all versions.
On August 27, 2026, CISA added CVE-2026-66384 in JFrog Artifactory to the KEV catalog. Operators of self-hosted instances should verify their version and deploy available patches.
