#incident-response — insecure by design

high2 sources

Boston Scientific Grapples with Global IT Outages Following Cyberattack

Medical technology giant Boston Scientific disclosed that a cyberattack hit several of its IT systems on August 25. The disruption triggered widespread network outages across the company's global operations. Long story short, the incident severely degraded access to internal operating systems and vital enterprise applications. Crucially, the operational bottleneck has impaired the company's capability to process and dispatch customer device shipments. Following detection, the manufacturer activated its incident response protocols and onboarded third-party cybersecurity specialists for triage and containment. The Massachusetts-based firm produces critical clinical equipment, ranging from pacemakers and defibrillators to catheters and stents. Boston Scientific disclosed the event to the US Securities and Exchange Commission, noting that the full scope and financial fallout remain uncertain. As of now, the company has not established an estimated timeline for the complete restoration of its impacted environments. The regulatory filing left the specific threat vectors, initial access mechanisms, and potential data exfiltration unconfirmed. Furthermore, no ransomware or extortion syndicate has claimed credit for the intrusion.

critical4 sourcesCVE-2023-27350 CVE-2023-27351 +2

Active Zero-Day Attacks Chain Auth Bypass and Dynamic Class Loading in PaperCut NG/MF

PaperCut Software has issued an urgent advisory warning of zero-day exploitation against its PaperCut NG and PaperCut MF print management software. The attacks target internet-exposed Application Servers across all versions of the software. Threat actors are chaining two distinct vulnerabilities: `CVE-2026-81578`, an improper access control flaw in the web management interface, and `CVE-2026-82078`, an unsafe dynamic class loading issue in the database connection utilities. Together, these flaws allow unauthenticated remote attackers to modify system configurations and execute arbitrary Java bytecode. Security researchers at Huntress observed limited in-the-wild exploitation involving base64-encoded reconnaissance commands, such as `whoami` and `ver`, spawned from the primary application process `pc-app.exe`. PaperCut initially released a fix based on telemetry from an impacted university customer, but subsequently published an updated Emergency Patch (Release 2) following collaborative analysis with Huntress and watchTowr. The vendor strongly urges administrators to immediately restrict web interface access using network access controls or firewalls. Key indicators of compromise include missing or truncated `server.log` files and specific log entries such as `ERROR No suitable driver found for jdbc:no:x` or `ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST`. Administrators are instructed to apply Release 2 immediately, even if the initial emergency patch was already deployed.