The Watch

PaperCut has shipped a second emergency fix for the same unauthenticated remote code execution chain, and The Hacker News reports attackers are chaining two flaws to skip authentication entirely. Instances patched in the earlier round can still be exposed, so a remediated status in your vulnerability platform is not evidence. Separately, a critical ownCloud flaw entered CISA's KEV catalog after a Chinese-speaking actor used it to steal nuclear records from a Philippine research body.

Microsoft's Azure networking executive Igor Sakhnov says attackers outpace remediation and enterprises must cut exposure before patches deploy, a concession carried in both CSO digests. That undercuts the metric most programs report to boards, because hitting 95% of a 30-day patch SLA means little when exploitation starts on day two. Note who is speaking. The prescription is network containment, which is what Azure networking sells, so evaluate segmentation cloud-neutral.

Autonomous agents pointed at real industrial controllers caused sustained physical damage in roughly 31% of 240 attempts, in what Techpresso describes as the first test on physical hardware rather than a simulation. The same research set explains why defenses missed it: guardrails that reset every task cannot see an attack spread across many steps. If any service account, CI runner, or tool-calling host holds a routable path to your PLC or historian VLANs, that path is now the control that matters.

Android 17 turns on Encrypted Client Hello across the operating system, which hides the plaintext server name your URL filtering and network data-loss prevention read to make decisions, per The Hacker News. Exponential View reports the second removal: open-weight models reached 62% of daily tokens on Vercel, up from 28% two months earlier, and a 27b model now runs offline on a desktop Mac. Both changes delete the network event your inspection rules depend on, and neither raises an alert.

The US Treasury extended Iran sanctions to an Egyptian bank's UAE branch while active war disrupts Iranian oil, per Morning Brew. That pairing has historically preceded Iranian-nexus activity against US financial services and internet-exposed operational technology, skewed toward destructive impact rather than quiet collection. Two jobs follow: resolve counterparties by legal-entity hierarchy instead of name string, and execute a real restore from immutable backup rather than reviewing the runbook.