September 1, 2026 opens with a dense threat landscape that touches enterprise print infrastructure, browser security, decentralized finance, and software supply chains simultaneously. For defenders, the common thread running through today's items is the speed at which attackers move from vulnerability disclosure to active exploitation — and the organizational blind spots that let threats persist undetected. Here is what your team needs to know and act on today.

PaperCut NG and MF: Two Critical Vulnerabilities Under Active Exploitation

CISA has added CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog, confirming that threat actors are actively leveraging both flaws in PaperCut NG and MF print management software. CVE-2026-81578 is a missing authentication vulnerability for a critical function, meaning an unauthenticated remote attacker can interact with privileged application functionality without presenting any credentials. CVE-2026-82078 involves unsafe reflection, a class of vulnerability that can allow attackers to manipulate object instantiation at runtime, often leading to remote code execution or privilege escalation depending on the application context.

PaperCut is widely deployed in enterprise, education, and government environments, frequently running on servers with broad network access and elevated privileges. Successful exploitation of either flaw could give an attacker a foothold from which to move laterally, exfiltrate data, or deploy ransomware. PaperCut has been a repeated target for ransomware groups in prior years, and the pattern is consistent here.

Defensive priorities for PaperCut:
- Apply vendor patches immediately; both CVEs carry CISA's Binding Operational Directive deadline for federal agencies, but all organizations should treat this as an emergency change.
- Restrict access to the PaperCut admin web interface at the network layer — it should never be exposed to the internet and ideally limited to dedicated management VLANs.
- Review PaperCut server logs for unexpected authentication attempts, unusual API calls, or new admin account creation.
- Audit service account privileges associated with PaperCut and apply least-privilege principles.
- If patching cannot happen immediately, consider temporarily isolating PaperCut servers from internet-facing segments and monitoring all outbound connections from those hosts.

Malicious Chrome Extensions Targeting Crypto Wallets and Credentials

Researchers have identified malicious extensions in the Chrome Web Store that deploy stealer malware capable of harvesting cryptocurrency wallet data, stored browser credentials, and session cookies. These extensions also inject ClickFix-style social engineering lures — fake error prompts that trick users into executing attacker-controlled commands or granting additional permissions. This is a significant threat vector because browser extensions run with elevated trust inside the browser context and are often overlooked in endpoint security reviews.

Defensive priorities for browser extension threats:
- Audit all installed Chrome extensions across your fleet using endpoint management tooling; remove any extension that is not explicitly approved.
- Implement a browser extension allowlist policy through Google Workspace admin controls or equivalent MDM/EDR policy.
- Educate users to recognize ClickFix lures — legitimate software never asks users to paste commands into a terminal or browser console to fix an error.
- Monitor for credential stuffing attempts or anomalous logins that may indicate harvested session tokens are being replayed.
- For high-risk roles such as finance, executive, and IT admin staff, consider hardware security keys and session-binding controls that reduce the value of stolen cookies.

TeamPCP Arrests and the Supply Chain Threat Backdrop

Australian Federal Police have arrested two alleged members of TeamPCP, described as responsible for the longest-running software supply chain attack spree on record. While arrests are a positive development, defenders should not treat this as a signal to stand down. Supply chain intrusions often have long dwell times, and compromised packages or build pipelines may still be active. Organizations should review their software bill of materials, audit third-party dependencies for unexpected changes, and verify the integrity of build artifacts.

Cronos and Tectonic: A $74 Million DeFi Price Manipulation

The Cronos blockchain was forced to restart after attackers exploited a price-manipulation vulnerability in the Tectonic lending protocol, draining approximately $74 million. For organizations with treasury exposure to DeFi platforms or that custody digital assets, this is a reminder that smart contract risk is financial risk. Security teams should ensure that any DeFi integrations are subject to the same vendor risk management scrutiny as traditional financial counterparties, and that exposure limits and monitoring alerts are in place for on-chain positions.

Defensive Priorities Summary

Today's threat picture demands immediate action on PaperCut patching above all else given confirmed active exploitation. Simultaneously, a browser extension audit should be initiated as a parallel workstream. Supply chain hygiene reviews and DeFi exposure assessments can follow on a slightly longer timeline but should not be deferred beyond this week.

- Patch CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF immediately.
- Audit and restrict Chrome extensions enterprise-wide.
- Review software supply chain integrity in light of TeamPCP activity.
- Assess and limit DeFi and digital asset exposure.
- Increase logging and alerting sensitivity across print servers, browser endpoints, and any crypto custody infrastructure.

This briefing is informational and does not replace official vendor advisories or guidance from CISA and your organization's security operations team.