Post-quantum DNSSEC rolls out on 1.1.1.1 as VPN certificate and print-server flaws draw mass exploitation

Post-quantum DNSSEC goes live at the edge of the resolver

1 resolver now validates DNSSEC signatures using NIST's ML-DSA-44 post-quantum algorithm, with the company publishing engineering details for handling the full 2,420-byte signature size and managing downgrade risk at scale. The change shifts the cryptographic baseline that every recursive lookup inherits, so operators whose authoritative servers still sign with classical algorithms will see a working chain as long as both ends speak post-quantum, and operators whose tooling cannot parse a 2,420-byte RRSIG will see validation fail.

Practitioners verifying hashes locally can confirm a chain with a SHA256 Hash Generator or, where longer outputs are required, a Sha512 Hash Generator, without exposing lookups to a third party.

Critical VPN certificate handling flaws in Check Point

8-rated vulnerabilities in how its firewall and Security Management products parse VPN certificates, both rated severe enough that an unauthenticated remote attacker could run code. The vendor stated this is possible only "under specific conditions" it has not publicly described, which leaves defenders with a patch-now obligation but no clean way to model exposure from a configuration alone. One flaw is scoped to Security Gateways and the other to the gateways plus the management plane, so certificate-handling paths across both tiers are in scope.

Any operator touching these appliances should treat certificate validation paths as a first-class asset on the patch list, not as a configuration footnote.

AI-orchestrated exploitation sweeps PaperCut NG/MF

A suspected Russian-speaking threat actor used hundreds of AI agents to develop and run an exploitation campaign against recently disclosed PaperCut NG/MF flaws, breaking into more than 440 instances according to one telemetry source, while a second outlet counted 395 compromised organizations from the same activity. ]132, and frame the operation as an example of agent-driven exploit development at scale rather than a single hand-crafted intrusion. The lesson for print-server operators is that the window between public flaw disclosure and mass exploitation has collapsed into days, so exposure scoring and patch cadence for print management software should match the pace seen for internet-facing VPN and edge appliances.

Distribution abuse shifts to Google Play Early Access

Threat actors are abusing Google Play's Early Access program to distribute deceptive Android apps that promise money, rewards, casino winnings, and premium content before those apps ever reach the official marketplace review path. Because Early Access apps sit outside the standard listing flow, users and enterprise mobility teams cannot rely on the usual storefront signals to triage them. Mobile and MDM administrators should treat Early Access enrollment as an untrusted source for now and revisit allow-lists once Google describes how the program is being policed.

What to verify on Monday morning

]132 and unusual AI-cadence outbound traffic from print servers. Where local integrity checks are useful, a Checksum Calculator or a CRC32 Calculator can confirm artifact hashes during incident response.