TL;DR
A new zero-day in a vendor’s print management software is being exploited, and it’s a reminder that AI is helping attackers find flaws faster than ever while print remains one of the most overlooked parts of the network. Real protection comes down to the basics: minimal data retention, encryption where the customer holds the keys, no servers exposed to the internet, and a vendor that builds security in rather than bolting it on.
Print security is back in the headlines
If you caught the recent news, PaperCut disclosed that a vulnerability affecting its NG and MF print management software is being actively exploited. The company confirmed real customer incidents, pushed out emergency patches, and is urging anyone with an internet-facing PaperCut server to lock down access immediately.
I want to use this moment to talk about two things I think are underappreciated right now: how AI is changing the zero-day game, and why print keeps ending up in the headlines.
What actually is a zero-day, and why does it matter
A zero-day is a flaw in software that nobody, including the vendor, knows about yet. There’s no patch, no advisory, no warning. An attacker who finds it first can use it quietly, sometimes for months, before anyone notices something is wrong. The name comes from the fact that the vendor has had “zero days” to fix it once it’s discovered being used in the wild.
Historically, finding these flaws took real expertise and a lot of tedious manual work: combing through code, fuzzing inputs, testing edge cases. That’s changing fast.
AI is shrinking the time it takes to find a flaw
AI models are increasingly good at reading code, spotting patterns, and flagging the kind of subtle logic errors that used to take a skilled researcher weeks to find. That’s genuinely useful when it’s a security team using AI to harden their own software. It’s a serious problem when it’s an attacker doing the same thing, at scale, against every piece of software they can get their hands on.
The uncomfortable truth is that AI doesn’t care who’s using it. The same capability that helps a vendor’s security team catch a bug before release can help an attacker catch it first. And once a flaw is found, there’s no fix waiting on the shelf. Someone has to build one from scratch, test it, and ship it, all while the flaw is potentially already being used against real customers.
That’s the world we’re operating in now. The volume of zero-days being discovered and exploited is going up, and AI is a big part of why.
Print is a bigger target than people think
When security teams think about their attack surface, they usually think about email, endpoints, cloud apps, maybe VPNs. Print servers rarely make the list, and that’s exactly why attackers like them.
A few reasons print keeps getting overlooked:
- It’s treated as “boring” infrastructure. Nobody gets excited about patching a print server, so it often falls to the bottom of the priority list.
- It touches sensitive documents. Contracts, medical records, financial statements, and HR files. A lot of what gets printed is exactly the kind of data attackers want.
- Organizations sometimes open it up more than they should for the sake of convenience. On-premises print software should never be directly reachable from the open internet, but it happens more often than you’d think, usually because someone wanted remote access to be easy and didn’t lock it down afterward.
- It sits deeper in the network than people realize. A compromised print server isn’t just a print problem. It can become a launching point to move laterally across the rest of the environment
How we think about this at Pharos
I’ll be honest, there’s no such thing as a system that’s immune to zero-days. Anyone who tells you otherwise is selling you something. What we can control is how much damage a flaw can do if one is ever found, and how quickly we can respond.
Here’s how that shows up in our approach:
We scan our own network constantly. We’re not waiting for a researcher or an attacker to tell us where our weaknesses are. Continuous scanning against our own infrastructure means we’re finding and fixing issues before they become someone else’s opportunity.
Our cloud environment runs on layered, current security. We don’t rely on a single control to keep people out. We use multiple layers of defense, kept up to date against the latest threats, so that no single point of failure can expose the whole system.
We minimize what there is to steal. A lot of security is just not having valuable data sitting around in the first place. We keep the footprint of sensitive data as small as we reasonably can, so that even in a worst-case scenario, there’s less for an attacker to actually do anything with.
Documents are encrypted in a way we can’t undo (also called “zero knowledge encryption”). When a document is stored in our cloud, it’s encrypted at the client level. Even if someone downloaded a batch of those files, they couldn’t decrypt them, because we don’t hold the key. We don’t store usernames and passwords that could be used to break that encryption either. This isn’t a setting you can misconfigure. It’s built into how the system works.
Our recommended practice is that on-prem servers should never be exposed to the open internet. This one sounds obvious, but it’s where a lot of print security incidents start. We design our systems around that principle and guide our customers, including universities running Uniprint, to keep that exposure closed off entirely. That said, we can’t enforce a customer’s network configuration. If an institution chooses to expose a server despite our recommendation, that decision sits outside what we can control. It’s why we pair that recommendation with server updates and patching on our end, so the risk stays as low as possible even when our guidance isn’t followed.
The theme across all of this is that security isn’t a feature we bolt on. It’s a design decision we make upfront, and a process we maintain every single day.
What security questions should you ask your print management software provider
If this story has you taking a second look at your own print environment, here’s a simple checklist:
- Is the server ever exposed directly to the internet? It shouldn’t be. If remote access is needed, it should go through a properly secured gateway, not a direct connection.
- Where do encryption keys live? If your vendor holds the keys to your documents, ask what happens if their systems are ever breached. Client-side encryption, where the vendor genuinely cannot decrypt your files, is a meaningfully stronger position.
- How much data does the platform actually retain, and for how long? Less stored data means less to lose.
- How fast does the vendor patch, and how do they communicate when something goes wrong? A vendor that’s transparent and fast during an incident is worth a lot more than one with a shinier feature list.
- Is security something they talk about as a feature, or as how the company actually operates? Ask about their internal practices, not just their marketing page.
The bottom line
Zero-days aren’t going away, and AI is only going to make them more common. What organizations can control is reducing their exposure and choosing partners who treat security as a foundation, not an add-on. Print has been an overlooked risk for too long. Incidents like this one are a good reminder to take a closer look at it before someone else does.
