The MSP Security Gap
The patch came from the vendor. Almost.
The scenario:
The update notification looked exactly like every other one that month, same vendor, same signed installer, same routine Tuesday patch window.
The IT admin at a 40-person logistics firm approved it without a second look, because that was the entire point of buying a management platform in the first place.
How it unfolds:
The attacker had not touched the logistics firm at all. They had compromised the software vendor's build pipeline weeks earlier, inserting a small piece of code into an otherwise legitimate update before it was signed and pushed to every customer running that platform.
The signature was real. The vendor's own signing key made it real. What shipped inside the update was not what the vendor's developers had written.
By the time anyone noticed unusual outbound traffic three days later, the payload had already mapped the internal network and set up a second point of access that did not depend on the software at all.
The warning signs:
The management platform started making outbound connections to a domain nobody recognized, shortly after the update installed
A new scheduled task appeared on several machines with a name designed to look like a routine maintenance job
Antivirus flagged nothing, because the file itself carried a valid signature from a trusted vendor
Stop it:
Treat vendor updates as a change to monitor, not only a change to approve, with baseline network behavior checked in the days after any major platform update
Segment management and monitoring tools onto their own network zone so a compromised agent cannot freely reach everything else
Keep an inventory of exactly which third-party platforms have privileged access to client environments, since that access is what an attacker is buying when they compromise a vendor
-
P.S. A signed update from a legitimate vendor is one of the hardest things to treat with suspicion, because everything about it is designed to be trusted automatically. The clients running this were relying on a platform that had broad reach into their network by design. Full spectrum coverage that watches for unusual behavior after a trusted change, not only before one, is the layer most stacks are still missing.
Patch first this week:
Three vulnerabilities went from "patch eventually" to "patch today." Here is what to check across your client base.
1. PaperCut NG/MF: unauthenticated remote code execution
Product: PaperCut NG/MF print management software.
Who runs it: any client with a shared print environment. Schools, healthcare, local government, and professional offices are the heaviest users.
The action: update to the patched build now. Two flaws chain together (CVE-2026-81578 and CVE-2026-82078) to let an attacker with no credentials execute code on the PaperCut server.
The urgency: PaperCut confirmed active exploitation and customer incidents in its August 27 security bulletin. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on August 31, with a federal patch deadline of September 14. PaperCut has been a ransomware entry point before. Do not wait for a client to ask.
2. Citrix NetScaler ADC and Gateway: heap overflow now full RCE
Product: Citrix NetScaler ADC and NetScaler Gateway.
Who runs it: any client using Citrix for remote access, SSL VPN, or ICA proxy.
The action: update to build 14.1-73.32 or 13.1-63.21 or later, or the matching FIPS and NDcPP builds.
The urgency: Citrix first described this as a denial-of-service bug in June. Researchers showed in mid-August it can be pushed to unauthenticated remote code execution, and attackers are now dropping web shells on unpatched appliances. CISA added it to the KEV catalog on August 26. The federal deadline was August 29 and has already passed. If you have not patched, you are past due, not early.
3. Microsoft SQL Server: a seven-year-old bug just got weaponized
Product: Microsoft SQL Server 2014 (SP2/SP3), 2016 (SP1/SP2), and 2017.
Who runs it: any client running an on-prem SQL Server instance behind a line-of-business app, especially older, rarely-touched boxes.
The action: confirm the July 2019 security update is installed. If a server predates it, patch now.
The urgency: Microsoft fixed this remote code execution flaw in 2019. CISA only confirmed active exploitation and added it to the KEV catalog on August 26, 2026, seven years later. Old boxes that were never patched are the ones being hit. A published federal deadline for this entry was not available from the sources checked in this run.