PaperCut zero-day shows why unpatched internal apps are ransomware's front door

What happened

Serious vulnerabilities in PaperCut's server software were exploited by ransomware operators as an initial way into corporate networks, after which they moved laterally toward more valuable systems. According to a dev.to analysis by security firm SheerSafe, government advisories including one from CISA flagged active exploitation and urged organizations to patch immediately.

PaperCut is print management software, used by thousands of organizations to control who can print what and what it costs. As the dev.to piece frames it, nothing about the product itself is unusual. Print servers, license managers, backup consoles, VPN appliances and internal wikis share the same profile: infrastructure nobody demos to the board, nobody threat-models, and nobody remembers exists until something breaks.

Why unglamorous tools get targeted

The article argues that attackers choose targets based on three properties, not on how interesting the software is:

• Trust level. Internal apps frequently run with elevated privileges. A print server often has domain-level access so it can talk to every printer and print queue on the network.
• Forgotten exposure. Many of these tools were set up years ago by admins who have since left, sometimes with web-based admin consoles left reachable from outside the network on a "temporary" basis.
• Low monitoring, low patching. Nobody reads a print server's logs or schedules its updates. It keeps working fine until a vulnerability is found, and then it keeps working fine while compromised.

Combine a system nobody watches, with more access than it needs, that nobody patched, and you have exactly the profile attackers scan for. The piece calls that pattern, not bad luck.

A practical triage checklist

Rather than a full audit, the dev.to article proposes a one-week exercise:

• List every internal-facing app with an admin web console: print management, backup software, network monitoring, license servers, old intranet portals. If it has a login page, it belongs on the list.
• Check what is actually reachable from outside your network. Anything with a public IP and a login page is a priority.
• Ask who owns each system. If nobody can answer in under a minute, that is a red flag, because unowned systems do not get patched.
• Check each vendor's security advisory page once.
• Apply a decision rule: if a system is both internet-reachable and running with elevated network permissions, patch it within days of a vendor advisory rather than on a normal quarterly cycle.

The article notes that this kind of inventory and triage work is precisely what a structured vulnerability assessment or penetration test is meant to surface, instead of relying on someone remembering to check.

If immediate patching is not possible

Most IT teams are short-staffed, and patching production systems carries its own breakage risk. The piece offers two fallbacks:

• Restrict exposure first, patch second. A vulnerable admin console that cannot be patched today can usually be taken off the public internet today, placed behind a VPN or restricted to internal IP ranges. That closes the most common exploitation path while the patch is planned.
• Shrink the blast radius. If a print server or similar tool does not need domain-admin-level access to do its job, it should not have it. Reducing permissions will not stop an intrusion, but it limits what an attacker can do once inside.

Why it matters

The lesson from PaperCut is not simply "patch PaperCut," the analysis argues. Any internal tool can become the entry point, and the ones most likely to be missed are exactly the ones that feel too unimportant to review. The durable fix is a habit: inventory internal apps, verify exposure, confirm ownership, and treat vendor advisories for infrastructure software with the same urgency as advisories for core business applications. Worth noting for context: the piece was originally published at sheersafe.com and closes by pitching the firm's own review services, so the checklist doubles as marketing, but the underlying argument stands independently.