Project
Print management software used by organizations to track and control network printing, with a web-based Application Server component.
GreyNoise and Blackpoint Cyber trace the new PaperCut auth-bypass chain to one scanning address running AI agents against schools, which turns an unpatched print server from a maintenance ticket into a credential incident.
Perspective Coverage
6 publishersReality
PaperCut NG/MF 26.0.5, 25.0.13 and 24.1.10 carry every fix from three emergency patch rounds plus two regression fixes, while GreyNoise and Blackpoint Cyber count at least 395 organizations already breached.
Reality
PaperCut told NG and MF customers on August 27 that servers were already being exploited, with no CVE and no fix available. A patch that held arrived on September 1, and Picus Security says that gap is now the normal shape of a zero-day.
Reality
Two unauthenticated Check Point RCEs, a CVSS 10.0 GitLab path traversal and an already-exploited N-able flaw all came due on September 11. How fast each one closes depends on the release you happen to be running.
Reality
PaperCut's founder and CEO says the NG/MF incident is still open. Logs from two customers in the same region let his engineers rebuild most of the exploit chain, and the 2023 aftermath drove the order to unplug.
Reality
Sixteen new modules landed in the framework, ten of them exploits, and Rapid7 counts five of those against CISA's exploited list. The SonicWall entry runs September's zero-day chain from SSRF to root.
Reality
GreyNoise says a likely Russian-speaking actor built and tested PaperCut exploits in a lab, then ran hundreds of agents on a Codex harness with a DeepSeek model against 440 servers in 48 countries. The sending infrastructure was already on its watchlist.
Reality
PaperCut shipped emergency fixes for CVE-2026-81578 and CVE-2026-82078 on Thursday and Friday, and by the weekend Defused was watching honeypot intruders bypass authentication and read database tables instead of running code.
Reality
CISA gives three days to install the fixed build, which is the easy half of the job. In the same week, Dream Security documented eight AI sub-agents running twelve attack waves at Taiwan's government in four days.
Reality