PaperCut says attackers are actively exploiting an unknown vulnerability in its PaperCut NG and PaperCut MF print management software, and some customers have already been compromised. The company says all versions are affected, especially Internet-exposed Application Servers, but it has not yet published a CVE or technical details; PaperCut released emergency patches and advised restricting web interface access to trusted IP addresses and checking logs and pc-app.exe activity for signs of compromise.
Ionut Arghire
2026.09.11
97% relevant
This directly updates the same underlying event: exploitation of the August 2026 PaperCut NG/MF zero-days. It adds concrete attribution to a Russian-speaking threat actor, says AI was used to build and deploy the exploits, and provides scope and impact details including 440 compromised deployments, 395 named organizations in 48 countries, credential harvesting, NoPac abuse, and 12 domain-admin outcomes.
info@thehackernews.com (The Hacker News)
2026.09.11
95% relevant
This updates the same underlying event by saying PaperCut has replaced its earlier emergency mitigations or temporary patches with full product fixes for the two actively exploited flaws, giving defenders the next concrete remediation step.
2026.09.10
97% relevant
This article clearly updates the same underlying event: exploitation of the two PaperCut NG/MF flaws first disclosed by PaperCut in late August. It adds scope and operational detail, including GreyNoise’s estimate of at least 395 organizations and 440 instances compromised across 48 countries, heavy concentration in U.S. education, and that the attacker used hundreds of AI agents to develop exploits and scale the campaign.
Bill Toulas
2026.09.10
98% relevant
This article updates the same PaperCut NG/MF exploitation event with concrete scope and tradecraft: GreyNoise says a likely Russian-speaking actor used AI agents to exploit CVE-2026-81578 and CVE-2026-82078, compromising 440 instances at 395 organizations in 48 countries, with credential theft, domain escalation, and education-sector concentration.
info@thehackernews.com (The Hacker News)
2026.09.10
93% relevant
This appears to update the same PaperCut active-attack event by adding that the attacker used hundreds of AI agents and compromised more than 440 exposed PaperCut NG and MF instances, expanding understanding of scope and tradecraft even if the flaw remains unnamed or unpatched.
info@thehackernews.com (The Hacker News)
2026.08.28
96% relevant
This appears to add the technical detail that attackers are chaining two PaperCut flaws to achieve unauthenticated code execution, updating the same active-attack event affecting PaperCut NG and MF servers.
2026.08.28
96% relevant
This source updates the same PaperCut NG/MF active-exploitation event with added specifics: the flaws are tracked as CVE-2026-82078 and CVE-2026-81578, PaperCut confirmed customer incidents, Huntress saw at least two impacted customers, and an initial patch was incomplete before a revised fix was released with help from Huntress and watchTowr.
Eduard Kovacs
2026.08.28
97% relevant
This source directly updates the same event by reporting that PaperCut has now released emergency patches, reiterated mitigations such as removing internet exposure and restricting access to trusted IPs, and shared indicators of compromise including the suspicious file pc-app.exe and signs of tampered server.log files.
info@thehackernews.com (The Hacker News)
2026.08.28
98% relevant
This article appears to cover the same underlying event: PaperCut's warning that an actively exploited zero-day affects all supported and unsupported versions of PaperCut NG and MF print servers, reinforcing the breadth of exposure and urgency to isolate or patch when guidance becomes available.
2026.08.28
98% relevant
This article is a report on the same event and adds that a university security team alerted PaperCut to the attacks, notes the advisory is still withholding technical flaw details, and highlights the choice between an unofficial emergency patch and removing the web interface from the public internet.
Lawrence Abrams
2026.08.27
100% relevant
This article establishes a new tracked story because it reports a newly disclosed, actively exploited zero-day affecting all versions of PaperCut NG and MF, with emergency patches and mitigation guidance but no matching existing SecLog story for this 2026 event.