Harden your printers against modern threats: RAT malware, driver vulnerabilities, unsecured SMB shares, and printer-based phishing. Expert guidance for SMBs.
Showing 16 articles
Security researchers discovered that 689 Brother printer models use the serial number as the default admin password. Brother says it can't be fully fixed through firmware. Here's what to do.
On September 17, HP Wolf Security reported phishing emails with PDF "invoices" blurred behind a QR code that tells staff to scan it with their phone, leading to a fake Microsoft sign-in page. Tell accounts-payable staff never to scan QR codes in unexpected invoices, verify invoices by phone, and protect Microsoft 365 with MFA.
Microsoft's September 8, 2026 Patch Tuesday fixed a Critical (CVSS 9.8) Windows HTTP Print Provider flaw, CVE-2026-69769, that needs no sign-in or click, plus Print Spooler privilege bugs. None were exploited, and the month's zero-days weren't print-related. Test the September cumulative update on one PC, then install it everywhere.
On August 27, PaperCut warned that attackers were exploiting flaws in its NG and MF print-management software, and on August 31 CISA listed both chained bugs as actively exploited. Ask your copier dealer whether you run PaperCut, restrict its admin page to trusted addresses, patch versions 24 to 26, and upgrade anything older.
On July 31, Sharp and Toshiba Tec disclosed three flaws in their office MFPs, and NIST's vulnerability database published them August 3. The most practical one: affected models built for markets outside Japan, including the US, shipped with user authentication turned off. Turn it on, and ask your dealer for the firmware that fixes the other two.
Microsoft's record July 14, 2026 Patch Tuesday fixed CVE-2026-58608, a Critical Windows Print Spooler flaw that any logged-in, low-privilege user could exploit over the network. It wasn't exploited at release. Confirm July's update is installed on every PC, especially the one that shares your printers, and protect staff accounts from phishing.
On July 6, 2026, CERT/CC disclosed CVE-2026-13753: HP DeskJet 2800 series printers on firmware TBP1CN2612AR or earlier let anyone on the network read sensitive settings, including the Wi-Fi Direct password in plain text, without logging in. No fix was available at disclosure. Find these printers, turn off Wi-Fi Direct and SNMP if unused, and keep them off guest Wi-Fi.
Security researchers keep proving the same point in 2026: a multifunction printer with a default admin password can be tricked into handing over the Windows credentials it stores. Here's how pass-back attacks work, why leased copiers are the worst offenders, and the 20-minute audit that shuts the door.
Most Sherman Oaks medical offices are paying $600-900/month for printers that don't even meet basic HIPAA hardening standards. Here's how to exit the lease and end up more compliant, not less.
67% of organizations had a printer security incident last year, but most cyber insurance policies have exclusions for unsecured devices. Here's what you need to know before your next breach — or your next renewal.
Three major RAT malware campaigns are hitting small businesses in early 2026. Learn how Remote Access Trojans can infiltrate through your printer network and what to do about it.
A critical Canon vulnerability scores 9.8/10 severity while Microsoft begins phasing out legacy printer drivers. Two urgent issues every small business needs to address this month.
Get valuable printer industry insights, cost-saving tips, and practical business advice delivered monthly. No spam, ever.