The Weekly Brief — Issue 015 (31 August 2026)

01 Threat Alert

Two emergency patches in eighteen hours for the print server nobody thinks about

On 27 August the Melbourne software firm PaperCut published an urgent advisory confirming that its print management products, PaperCut NG and PaperCut MF, were being attacked in the wild. Two flaws are involved. CVE-2026-81578 is an access control failure in the web management interface that lets an attacker with no login at all change system configuration. CVE-2026-82078 is unsafe dynamic class loading in the database connection utilities, which allows arbitrary Java bytecode to run. Chain the two and you have full remote code execution on the server, without a password. Every currently supported version is affected.

The discovery says something about how this was found. PaperCut was alerted by a university customer’s own security and forensics team, whose evidence let the vendor reproduce the bug and confirm live abuse; Huntress then independently demonstrated a pre-authentication configuration takeover and a complete code execution chain, and reported seeing exploitation in two customer environments. Emergency out-of-cycle builds for the v25 and v26 branches — Windows, Linux and macOS — went out in the early hours of 28 August. Later the same day PaperCut replaced them with Emergency Patch Release 2, adding hardening developed with Huntress and watchTowr. If you patched on the first day, you are not finished. The vendor also asks that the web interface be restricted to trusted IP addresses and firewalled off from the open internet.

~18 hrsbetween PaperCut’s emergency patch and the second emergency patch that replaced it. Patching once this week was not enough.

Why it mattersPaperCut is one of those products people forget is a server. It gets bought as “the thing that makes staff tap a card at the copier” — follow-me printing, per-department print charging, scan-to-email — and it is very common in schools, councils, law firms, accounting practices and medical centres right across New Zealand. It is usually installed once by the copier supplier, sits on a Windows box in a comms room, and is never thought about again. Worse, it is often deliberately published to the internet so people can print from home or from a phone, which is exactly the exposure this attack needs. Three questions this week: do we run PaperCut (ask your copier company, not just your IT list); is its web console reachable from outside the office; and are we on Emergency Patch Release 2, not the first one. A print server is a soft target with a hard consequence — it sits inside the network, usually with a service account that has more rights than anyone remembers granting it. Managed clients: we are sweeping our estates for PaperCut this week and will come to you directly if yours has it — you don’t need to chase us.

Source: Help Net Security ↗

02 Ransomware

A third of ANZ businesses paid the ransom. A third of those paid for nothing.

Commvault published its State of Data Resilience ANZ 2026 report on 12 August, based on 411 organisations across Australia and New Zealand — CIOs, CISOs, IT leaders and their teams. Of those that suffered a ransomware attack, 34% paid the demand. Of the organisations that paid, 36% reported that the payment failed: the attackers either never restored access to the data, or took the money and came back asking for more.

The more useful finding is the reason people paid. It was not, mostly, a judgement about the attacker. It was a judgement about their own backups — confidence in whether the backups were complete, intact and actually restorable turned out to be a significant factor in the decision. The report found the same gap in planning: 61% of organisations had defined the minimum business functions they must keep running through a cyber crisis, but only 43% had worked out which technology those functions depend on. Knowing that payroll has to keep running is not a plan until you know that payroll needs a particular server, a particular database and a particular file share, in that order.

“True resilience comes from building robust recovery capabilities and regularly testing them well before an attack occurs, not during one.” Martin Creighan, VP Asia Pacific, Commvault

Why it mattersPaying a ransom is not a security decision, it is a recovery decision — and businesses only face it when they don’t trust the alternative. That reframes what to do about it. The lever is not “never pay”; it is being confident enough in your restore that paying never becomes the least-bad option in the room. A backup you have never restored from is a hypothesis, not a backup. Two practical things. First, ask for a test restore — not a green tick in a backup console, but someone actually pulling a real file, a real mailbox and, ideally, a whole machine back from yesterday’s copy while you watch. If nobody can produce one, that is your answer, and it’s better to learn it this week than during an incident. Second, write down the five things your business cannot trade without — and then, next to each, the system it actually runs on. That second column is the one 57% of ANZ organisations haven’t filled in, and it is the difference between a recovery plan and a wish. If we look after your backups, ask us for your last successful restore test; if we can’t show you one, that is on us to fix.

Source: SecurityBrief Australia ↗

03 Microsoft

Windows 11 24H2 has six weeks of security updates left

This one is a date, not a drama, and it is close enough to matter. Microsoft’s lifecycle table shows Windows 11 version 24H2 in the Home, Pro, Pro Education and Pro for Workstations editions receiving its final security update on the October 2026 Patch Tuesday — 13 October, six weeks from now. After that, a machine left on 24H2 keeps working perfectly and stops receiving security fixes, which is the combination that makes this easy to miss.

The fix is free and undramatic: move to 25H2, which is supported until October 2027, or 26H1, supported into 2028. Both are feature updates delivered through Windows Update, and on most machines 24H2 to 25H2 is an enablement package — a small download and one restart rather than a full reinstall. Two wrinkles worth knowing. Enterprise and Education editions of 24H2 are on a different clock and run until October 2027, so a mixed fleet will have machines with very different deadlines sitting side by side. And the machines most likely to be stranded are the ones nobody logs into often: the reception PC, the machine driving a screen in the workshop, the laptop in the drawer for contractors, the till in the back office.

13 Octthe last Patch Tuesday for Windows 11 24H2 Home and Pro. Enterprise and Education editions of the same version have another year.

Why it mattersDeadlines like this rarely bite the main fleet — they bite the edges. The staff laptops in daily use will update themselves. What gets left behind is anything that is off more than it is on, anything a supplier installed and manages loosely, and anything running an old application somebody once told you “doesn’t like updates”. Those are also, reliably, the machines with the weakest passwords and the least monitoring on them. The other trap is assuming an edition you don’t have: the 2027 date applies only if the machine is genuinely running Windows 11 Enterprise or Education, and the overwhelming majority of small-business PCs in New Zealand run Pro. The edition is written on the same Settings → System → About screen as the version, and it is that line, not your Microsoft 365 subscription, that decides which deadline you are on. The whole job is a five-minute inventory, and the tip below is how to do it. If we manage your devices, we already have the version of every machine we can see and will be moving them well before October — and we’ll tell you about anything we can’t see, which is the part that matters.

Source: Microsoft Lifecycle ↗

04 New Zealand

One NZ and 2degrees want to merge the towers — and share the failure points

On 27 August One NZ and 2degrees announced a proposal to combine their radio access networks — the antennas and base stations bolted to the cell towers — into a single, jointly owned wholesale company. Everything that lets the two compete stays separate: spectrum rights, core networks, fibre backhaul, satellite and retail. Both would keep selling their own plans and chasing the same customers; they would simply buy their radio coverage from the same shared business. The deal needs approval from the Commerce Commission and the Overseas Investment Office, and the parties are aiming to complete in the first half of 2027.

The case being made is coverage and cost. Sharing the physical layer means less duplicated steel in the same paddock, which the companies argue frees up investment for reach and for newer technology — incoming One NZ chief executive Nick Judd pointed to faster access to 6G and better network resilience. Network sharing of this kind is routine overseas. For a business in the Bay of Plenty or the central North Island the plausible upside is real: where one of the two networks has a site and the other doesn’t, both sets of customers should end up covered. Nothing changes for at least a year, and possibly not at all — the Commerce Commission has to be persuaded that three retail brands sharing two networks is still a competitive market.

“This proposal would deliver real benefits for customers by enabling us to deliver better connectivity… including faster access to new technologies such as 6G, and improving overall network resilience.” Nick Judd, incoming CEO, One NZ

View from hereNothing to do today — this is a proposal, not a change, and it has two regulators to get past first. But it is worth filing away for the next time you renew a mobile plan or design a failover, because of one detail: the shared part is the physical layer. Plenty of New Zealand businesses have quietly built redundancy by splitting vendors — fibre from one provider, a 4G or 5G backup on a different network, EFTPOS on a third SIM — on the reasonable assumption that two networks won’t fall over together. If One NZ and 2degrees end up sharing towers and radios, then a tower, a power failure or a fibre cut at that site can take out both at once, even though the core networks stay separate. That doesn’t make it a bad deal; better rural coverage is worth a lot, and a well-run shared network can be more resilient than two thin ones. It just means the old shortcut of “we’re on two different networks, so we’re covered” is worth re-checking when the detail lands. If your continuity plan depends on a mobile backup, note which network it actually rides on.

Source: RNZ ↗

Tip of the week

Find out which Windows your machines are actually on — including the ones nobody logs into

The Windows deadline above is only a problem for machines you have lost track of, so the job is an inventory, not a project. On a single PC: press Windows key + R, type winver and press Enter. A small box tells you the version. You want to see 25H2 or later; 24H2 means it needs moving before 13 October. If you prefer menus, it is Settings → System → About, under “Windows specifications”. The build number is the giveaway too: 26100 is 24H2, 26200 is 25H2. Across a fleet: if your devices are managed in Intune, Devices → All devices has an OS version column you can sort and export in about a minute; in the Microsoft 365 admin centre, the device list shows the same thing. Sort by version and look at the bottom of the list — that is where the stragglers live. Then do the part everybody skips: walk around and count the Windows machines that are not on that list at all. The reception PC, the screen in the workshop, the old laptop kept for contractors, the till, the machine that runs one piece of specialist software and was never enrolled in anything. Those are the ones that will still be sitting on 24H2 in November, and they are usually the least protected devices you own. Anything you find that cannot be updated is not a Windows problem, it is a business decision — replace it, isolate it on its own network segment, or accept the risk deliberately and write down why. The one option that is not available is forgetting about it. If we manage your devices we will send you the version list for everything we can see — and, more usefully, keep asking about the things we can’t.

Node-Red

Want all of this handled for you?

We keep an eye on the threats, the updates and the fine print so you don't have to. Book a free, no-obligation IT checkup.

Book your free IT checkup