Cyber Brief: NCSC warns on edge devices, PaperCut under attack

Today's stories reflect the practical reality that security incidents often stem from overlooked fundamentals rather than sophisticated attacks. The NCSC has issued guidance on internet-exposed systems following disruptive activity, a zero-day vulnerability is being actively exploited in widely-used print management software, Manchester Airports Group has confirmed a data breach affecting customer information, and Australian authorities have arrested two alleged members of a prolific supply chain attack group. Each story underscores the importance of visibility, patch discipline, and understanding where sensitive data sits across the organisation.

NCSC warns organisations to review internet-exposed systems after disruptive cyber activity

The National Cyber Security Centre has published new guidance highlighting the risk from internet-exposed systems and edge devices following recent disruptive cyber activity. The NCSC reports that attackers are continuing to exploit vulnerabilities in perimeter infrastructure, including VPNs, firewalls, routers and other edge devices that sit at the boundary of organisational networks. The advisory does not name specific incidents but emphasises that many compromises begin with unpatched or misconfigured devices that are directly accessible from the internet. The NCSC is urging organisations to review their external attack surface, ensure edge devices are patched promptly, and consider whether systems need to be internet-facing at all.

For UK businesses, this is a reminder that perimeter security remains a consistent weak point. Edge devices are often managed separately from core IT infrastructure, patched less frequently, and may run firmware that organisations are unaware is outdated or vulnerable. Attackers know this and routinely scan the internet for exposed management interfaces, unpatched VPN appliances and misconfigured remote access tools. Once an edge device is compromised, it provides a foothold into the internal network, often with privileged access. The operational risk is that these devices are easy to overlook during routine security reviews, yet they represent one of the most common initial access vectors in serious incidents.

Why it matters

For UK businesses, this is a prompt to review what devices sit at the network perimeter, who is responsible for patching them, and whether they genuinely need to be accessible from the internet. Many organisations discover during incident response that edge infrastructure was not included in their patch management process or that default credentials were never changed. Now is a sensible time to audit your external attack surface and ensure edge devices are treated with the same discipline as servers and endpoints.

Source: NCSC UK

PaperCut print management software under active zero-day attack

The Register reports that PaperCut, a widely-used print management platform deployed in schools, universities, healthcare organisations and businesses across the UK, is being actively exploited through a zero-day vulnerability. The flaw allows unauthenticated remote code execution, meaning attackers can take control of PaperCut servers without needing valid credentials. PaperCut has released an unofficial emergency patch, but the company has not yet validated it through its normal quality assurance process. The alternative for organisations is to take PaperCut servers offline until an official patch is available. The vulnerability is being exploited in the wild, and organisations running PaperCut are advised to act immediately.

This matters operationally because PaperCut is often deployed on servers that have network access to printers, file shares, Active Directory and other internal systems. A compromised PaperCut server can provide attackers with a foothold inside the network and access to credentials, print logs and potentially sensitive documents that pass through the print queue. The challenge for many organisations is that print management infrastructure is not always treated as a critical system, so it may not be monitored as closely as other servers or included in incident response runbooks. The fact that the emergency patch is unofficial creates a difficult decision for IT teams: deploy an unvalidated fix or take the system offline and disrupt printing services.

Why it matters

For many organisations, this is a prompt to check whether PaperCut is deployed, who is responsible for patching it, and whether it is being actively monitored for signs of compromise. If you are running PaperCut, you should review the vendor's guidance immediately and decide whether to apply the emergency patch or take the system offline. This is also a useful reminder to ensure that print management infrastructure is included in your patch management process and that you have a plan for responding quickly when zero-day vulnerabilities are disclosed in business-critical software.

Source: The Register

Manchester Airports Group confirms data breach affecting customer information

Infosecurity Magazine reports that Manchester Airports Group has confirmed a cyber incident in which customer data linked to bookings and airport Wi-Fi registrations at Manchester, Stansted and East Midlands airports has been accessed by an unauthorised third party. The breach affects personal information provided by customers when making bookings or registering for Wi-Fi services at the three airports. Manchester Airports Group has not disclosed the scale of the breach, the nature of the attack, or how long the unauthorised access persisted. The organisation has notified affected customers and is working with the Information Commissioner's Office and law enforcement. The incident is a reminder that customer-facing services, including Wi-Fi portals and booking systems, are attractive targets for attackers seeking personal data.

For UK businesses, this highlights the operational risk associated with customer data held in ancillary systems that may not receive the same security attention as core business applications. Airport Wi-Fi registration systems and booking platforms often collect names, email addresses, phone numbers and payment information, and they are frequently managed by third-party suppliers or sit outside the main IT estate. When these systems are compromised, organisations face regulatory reporting obligations under GDPR, reputational damage, and the operational burden of notifying potentially large numbers of customers. The challenge is that many organisations do not have full visibility of where customer data is stored, who has access to it, or how well it is protected.

Why it matters

For UK businesses, this is a prompt to review where customer data is held across your organisation, including in booking systems, CRM platforms, Wi-Fi portals and other customer-facing services. Consider whether these systems are included in your security monitoring, whether access is appropriately restricted, and whether you have a clear plan for responding to a data breach that involves customer information. This is also a useful moment to review your GDPR breach notification procedures and ensure you know who is responsible for coordinating the response if customer data is compromised.

Source: Infosecurity Magazine

Australian authorities arrest two alleged TeamPCP hackers behind supply chain attacks

The Register and Krebs on Security report that Australian Federal Police have arrested two men, aged 21 and 23, believed to be members of TeamPCP, a cybercrime group responsible for one of the longest-running software supply chain attack campaigns on record. The group is alleged to have created malicious open-source software packages and libraries that were downloaded by thousands of organisations globally, allowing the attackers to steal credentials, exfiltrate data and maintain persistent access to victim networks. The arrests followed a joint investigation with the FBI and other international law enforcement agencies. TeamPCP's activity represents a significant supply chain threat because the group embedded malicious code in legitimate-looking software components that developers unknowingly incorporated into their applications.

This matters for UK businesses because software supply chain attacks are difficult to detect and can affect organisations that have otherwise strong security controls. When developers download open-source libraries or dependencies from public repositories, they are often trusting that the code is safe. Groups like TeamPCP exploit this trust by publishing packages with names similar to legitimate libraries or by compromising existing packages. Once the malicious code is included in an application, it can run with the same privileges as the application itself, often providing attackers with access to internal systems, databases and credentials. The operational challenge is that many organisations do not have visibility of the open-source components used in their software, making it difficult to identify and remove compromised dependencies.

Why it matters

For UK businesses, this is a prompt to review your software supply chain security practices, including how developers vet open-source libraries, whether you maintain a software bill of materials, and whether you have processes in place to respond when a compromised package is identified. Consider whether your development teams are aware of supply chain risks and whether you have tools in place to scan for known malicious packages. This is also a useful reminder that supply chain attacks are not just a theoretical risk but an active and persistent threat that has affected thousands of organisations globally.

Source: The Register

Today's Key Actions

• Review your external attack surface and identify all internet-exposed edge devices, including VPNs, firewalls and routers. Ensure these devices are included in your patch management process and that access is restricted to only those who need it.
• Check whether your organisation uses PaperCut print management software. If so, review the vendor's guidance immediately and decide whether to apply the emergency patch or take the system offline until an official fix is available.
• Audit where customer data is held across your organisation, including in booking systems, CRM platforms and Wi-Fi portals. Ensure these systems are included in your security monitoring and that you have a clear GDPR breach notification plan.
• Review your software supply chain security practices, including how developers vet open-source libraries and whether you maintain a software bill of materials. Consider implementing tools to scan for known malicious packages.
• Ensure there is clear ownership across the organisation for edge device security, print infrastructure, customer data protection and software supply chain risk. These areas are often overlooked but represent significant operational risk when incidents occur.

Secarma Insight

Today's stories reflect a common theme: many security incidents stem from overlooked fundamentals rather than sophisticated attacks. Edge devices that are not patched, customer data held in systems that are not monitored, and open-source libraries that are not vetted all represent practical risks that mature organisations address through clear ownership, routine discipline and consistent processes. The organisations that respond most effectively to incidents are those that already know what they have, where it sits, and who is responsible for it. Good security is not about reacting to every new threat with urgency, but about building habits and visibility that make it harder for incidents to take hold in the first place.