PaperCut releases second emergency patch for exploited flaws

Live updates

1. 32d ago

   AI agent swarms compromised 440 PaperCut servers

   A threat actor used hundreds of AI agents to exploit PaperCut NG/MF vulnerabilities, compromising at least 440 servers across 395 organizations in 48 countries. The attack, occurring August 31, 2026, utilized OpenAI Codex orchestration and a DeepSeek model to bypass content-safety restrictions. PaperCut has issued second emergency maintenance releases, including versions 26.0.5, 25.0.13, and 24.1.10, to replace earlier patches. Security teams must install these updates and limit application-server web access to trusted networks to prevent further breaches.

   Why it matters

   These vulnerabilities allow rapid server compromises, sometimes in under 30 seconds. The shift toward AI-driven exploitation indicates an industrialization of attacks against print management software. Operational challenges persist as remediation advice changes and integrations face disruption.

   What is confirmed

   • At least 440 PaperCut servers across 395 organizations in 48 countries were compromised.
   • The attacks occurred on August 31, 2026.
   • Attackers deployed hundreds of AI agents to exploit the vulnerabilities.
   • PaperCut released maintenance versions 26.0.5, 25.0.13, and 24.1.10 to address the flaws.

   Still unconfirmed

   • The DeepSeek model was selected due to weaker content-safety restrictions.

   What to watch next

   • Evidence of other software vendors targeted by similar AI agent swarms
   • Official confirmation of the threat actor's identity
   • Reports of further integration disruptions following the latest patches
   Sources used for this update (3)

   1. www.techrepublic.com — AI Agents Help Hackers Compromise 440 PaperCut Servers
   2. tech.yahoo.com — Third Time’s the Swarm: How AI Agent Swarms Industrialized Exploitation Across 48 Countries
   3. www.teiss.co.uk — PaperCut attacks show why patching is not the end of an incident
   confidence 90%
2. 37d ago

   PaperCut Issues New Fixes Following Exploits

   PaperCut has released fresh security maintenance releases to replace prior emergency patches addressing two actively exploited vulnerabilities. The updated versions, including PaperCut NG and MF versions 26.0.5, 25.0.13, and 24.1.10, underwent complete quality assurance testing and include additional security hardening. Concurrently, researchers report that hundreds of servers across 395 organizations in 48 countries faced compromises through the vulnerability chain, with some breaches occurring in under 30 seconds. Customers must download the latest maintenance releases and restrict application-server web access to trusted networks.

   Why it matters

   Attackers previously targeted schools across the United States and Europe using the PaperCut flaws to steal credentials and gain privileged access. Nearly half of all enterprise installations remained exposed due to failures in securing internet-facing management tools. The United States Cybersecurity and Infrastructure Security Agency cataloged these issues as known exploited vulnerabilities before this latest software update.

   What is confirmed

   • PaperCut released a new security maintenance release on Thursday to replace all previously published emergency patches addressing two actively exploited security flaws.
   • The new maintenance releases are available in PaperCut NG/MF versions 26.0.5, 25.0.13, and 24.1.10.
   • GreyNoise reports that AI agents compromised 440 PaperCut servers across 48 countries.

   Still unconfirmed

   • IT Security News reported that a Russian-speaking threat actor used hundreds of autonomous AI agents to exploit PaperCut NG/MF flaws, breaching 395 organizations in 48 countries.

   What to watch next

   • Verification of the AI orchestration claim by independent researchers.
   • Adoption rates of the new PaperCut maintenance releases among enterprise installations.
   Sources used for this update (6)

   1. www.bleepingcomputer.com — Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
   2. securityaffairs.com — StyleSmuggler: The Magento Zero-Day Behind New Store Attacks
   3. letsdatascience.com — Threat Actor Reportedly Deploys AI Agents Against PaperCut
   4. thecyberexpress.com — AI Agents Compromised 440 PaperCut Servers, Researchers Say
   5. thehackernews.com — PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
   6. www.helpnetsecurity.com — AI agents exploited PaperCut flaws to breach 395 organizations
   confidence 85%
3. 41d ago

   PaperCut exploits target US and EU schools; 70,000 organizations impacted

   Attackers are using two PaperCut vulnerabilities to steal credentials and obtain privileged access, specifically targeting schools across the United States and Europe. The exploit chain allows for remote code execution in approximately two minutes. Nearly half of all enterprise installations remain exposed due to failures in securing internet-facing management tools. This follows the release of an emergency patch for CVE-2026-82078 and CVE-2026-81578, which the CISA has already cataloged as known exploited vulnerabilities.

   Why it matters

   These flaws enable authentication bypass and remote code execution on servers exposed to the internet. A Metasploit Framework module by Stephen Fewer increased the accessibility of the exploit chain for threat actors. Attackers have previously used these gaps for data theft and installing remote access software.

   What is confirmed

   • Attackers are exploiting PaperCut flaws to steal credentials and gain privileged access in US and EU schools.
   • The vulnerabilities enable remote code execution and authentication bypass.

   Still unconfirmed

   • The exploit chain hits 70,000 organizations.
   • Nearly half of enterprise installations are exposed.
   • The remote code execution chain takes two minutes.

   What to watch next

   • Reports of patch adoption rates across the education sector
   • Evidence of data exfiltration from the 70,000 targeted organizations
   Sources used for this update (5)

   1. thecyberexpress.com — Pegasus, New NoviSpy Variant Found on Serbian Students and Opposition Figures
   2. thecyberexpress.com — CBI Searches 89 Locations Across 20 States in Digital Arrest Cases, Arrests Three
   3. securityaffairs.com — PaperCut Flaws Exploited in Attacks on U.S. and European Schools
   4. www.helpnetsecurity.com — Week in review: Claude accounts compromised through infostealer, Patch Tuesday forecast
   5. forkast.news — PaperCut’s Authentication Gap Returns: Two-Minute RCE Chain Hits 70,000 Organizations
   confidence 80%
4. 45d ago

   PaperCut releases second emergency patch for exploited flaws

   PaperCut has issued a second emergency patch to address CVE-2026-82078 and CVE-2026-81578. These zero-day vulnerabilities enable attackers to bypass authentication and execute remote code. Threat actors are currently utilizing these flaws for data theft and hands-on-keyboard activity, which includes installing legitimate remote access software on servers exposed to the internet. The U.S. Cybersecurity and Infrastructure Security Agency has listed these vulnerabilities in its Known Exploited Vulnerabilities catalog. A Metasploit Framework module created by Stephen Fewer has made the exploit chain more accessible to attackers.

   Why it matters

   The vulnerabilities allow unauthorized remote access to server environments. This increases the risk of persistent network intrusion and sensitive data exfiltration. The availability of public exploit modules accelerates the pace of potential attacks.

   What is confirmed

   • PaperCut issued a second emergency patch for CVE-2026-82078 and CVE-2026-81578.
   • The flaws allow attackers to bypass authentication and execute remote code.
   • The U.S. Cybersecurity and Infrastructure Security Agency added these flaws to its Known Exploited Vulnerabilities catalog.
   • Stephen Fewer submitted a Metasploit Framework module that increases accessibility of the exploit chain.

   Still unconfirmed

   • Hackers are using these vulnerabilities for data theft and installing remote access software on internet-facing servers.

   What to watch next

   • Reports of successful exploitation following the second patch
   • Updates on the number of affected organizations
   • Further additions to the Metasploit Framework regarding these CVEs
   Sources used for this update (4)

   1. www.securityweek.com — Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products
   2. www.bleepingcomputer.com — HPE patches critical ArubaOS-CX remote code execution flaw
   3. www.bleepingcomputer.com — Plex warns users to patch security vulnerabilities immediately
   4. thecyberexpress.com — SonicWall Warns of Two Actively Exploited SMA1000 Zero-Days, One Rated Maximum Severity
   confidence 100%
5. 48d ago

   PaperCut releases second patch as hackers deploy remote access tools

   PaperCut has issued a second emergency patch for vulnerabilities CVE-2026-82078 and CVE-2026-81578. These zero-day flaws allow attackers to bypass authentication and execute remote code. Hackers are now using these vulnerabilities for data theft and hands-on-keyboard activity, including the covert installation of legitimate remote access software on internet-facing servers. The U.S. Cybersecurity and Infrastructure Security Agency has added these flaws to its Known Exploited Vulnerabilities catalog. A new Metasploit Framework module submitted by Stephen Fewer further increases the accessibility of this exploit chain for attackers.

   Why it matters

   The vulnerabilities affect PaperCut NG and MF print management software. The company previously faced a wave of attacks in 2023 that targeted higher education customers. Current exploitation involves chaining two separate flaws to gain unauthorized server access.

   What is confirmed

   • PaperCut released a second emergency patch for vulnerabilities CVE-2026-82078 and CVE-2026-81578.
   • The vulnerabilities allow for authentication bypass and remote code execution.
   • CISA added the PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog.
   • Attackers are using these flaws to perform data theft and hands-on-keyboard activity.

   Still unconfirmed

   • Threat actors are installing legitimate remote access software on compromised internet-facing PaperCut Application Servers.
   • Stephen Fewer submitted pull request #21842 to the Metasploit Framework to make the zero-day chain more accessible.

   What to watch next

   • Updated patching rates for the 47% of installations previously reported as vulnerable.
   • Reports of specific data sets stolen during the active intrusions.
   Sources used for this update (10)

   1. www.macworld.com — iOS 27 beta 4 is out now with further refinements and fixes
   2. www.securityweek.com — More Details Emerge on Exploited PaperCut Vulnerabilities
   3. www.cybersecuritydive.com — PaperCut issues emergency patches as threat actors target chained vulnerabilities
   4. cyberpress.org — Metasploit Exploit Targets Actively Exploited PaperCut NG/MF Zero-Day RCE Chain
   5. dailytechnewsshow.com — The EU Regulates ChatGPT Like a Search Engine – DTNS 5343
   6. www.helpnetsecurity.com — Attackers plant remote access tools on compromised PaperCut servers
   7. securityaffairs.com — U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
   8. www.securityweek.com — PaperCut Exploitation Escalates to Active Intrusions
   9. www.bleepingcomputer.com — Recently patched PaperCut zero-days used in data theft attacks
   10. www.securityweek.com — WatchGuard Patches Critical Vulnerabilities
   confidence 90%
6. 49d ago

   PaperCut Issues Second Emergency Patch for Exploited Vulnerabilities

   PaperCut released a second emergency patch to address security flaws that allow attackers to execute code without authentication. These vulnerabilities, categorized as critical and high, are under active exploitation by hackers targeting PaperCut servers. Despite the availability of fixes, 47% of tracked installations remain unpatched and vulnerable to remote code execution. The attack involves chaining two separate flaws to gain unauthorized access, prompting urgent warnings for administrators to update their systems immediately to prevent server compromise.

   Why it matters

   PaperCut software manages print services across many corporate networks. Remote code execution allows external actors to take full control of a server. This vulnerability is particularly dangerous because it does not require valid user credentials.

   What is confirmed

   • PaperCut released a second emergency patch for exploited flaws.
   • Attackers are chaining two PaperCut flaws to execute code without authentication.
   • PaperCut servers are under active attack.

   Still unconfirmed

   • 47% of tracked installations still run unpatched versions vulnerable to RCE.
   • The vulnerabilities are categorized as critical and high.

   What to watch next

   • Reports of successful breaches resulting from the chained flaws
   • Confirmation of the total number of compromised servers
   • Further patches addressing remaining high-risk vulnerabilities
   Sources used for this update (6)

   1. The Hacker News — Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
   2. SecurityWeek — PaperCut Releases Emergency Patch for Exploited Zero-Day
   3. Printweek — PaperCut targeted by hackers
   4. BleepingComputer — PaperCut releases second emergency patch for exploited flaws
   5. CCB Belgium — Warning: Critical and High vulnerability in PaperCut, Patch Immediately!
   6. securityaffairs.com — Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch
   confidence 80%