AI-Assisted Exploitation and Active MikroTik Threats

This episode examines two critical threats affecting UK small businesses: a Russian-speaking actor’s deployment of AI agents that compromised 440 PaperCut print management servers across 48 countries in 48 hours, and CISA’s addition of two actively exploited MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalogue. Corrine explains how industrialised exploitation through AI automation has collapsed the window between vulnerability disclosure and mass compromise, why background infrastructure like print management software and networking hardware attracts attackers precisely because organisations overlook it, and what specific actions businesses must take within 72 hours. The episode provides concrete guidance on asset identification, patch prioritisation, and vendor accountability, with particular focus on CVE-2026-82078, CVE-2026-81578, CVE-2026-86060, and CVE-2026-67277. This is not theoretical risk assessment; this is operational intelligence from confirmed active exploitation in September 2026.

Chapters

• Introduction Corrine introduces two separate threats that share a concerning pattern: the pace of modern exploitation has fundamentally changed, and background infrastructure remains dangerously overlooked.
• AI Agents Compromise 440 PaperCut Servers in 48 Hours Analysis of a suspected Russian-speaking actor’s deployment of hundreds of AI agents to exploit CVE-2026-82078 and CVE-2026-81578 in PaperCut print management servers, compromising 440 organisations across 48 countries in approximately 48 hours. Includes specific actions for identifying, patching, and confirming remediation.
• Call to Action Corrine invites listeners to follow the show, leave reviews, and share episodes with small business owners who need this intelligence.
• MikroTik RouterOS: Two Actively Exploited Vulnerabilities Examination of CISA’s 10 September addition of CVE-2026-86060 and CVE-2026-67277 to the Known Exploited Vulnerabilities catalogue, covering the specific risks to hospitality and small business environments, and providing a five-point checklist for immediate remediation.
• The Speed of Modern Exploitation Discussion of how AI-assisted exploitation has collapsed the vulnerability-to-exploitation timeline, why monthly patching cycles are no longer defensible for internet-facing infrastructure, and the commercial implications of demonstrable security posture for supply chain relationships.
• Conclusion Corrine summarises the week’s actionable intelligence and reinforces the 72-hour patching requirement for critical vulnerabilities in network-facing infrastructure.