Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide
Attackers used Codex and DeepSeek agents to exploit PaperCut flaws and compromise 440 servers in 48 countries.
82
Product
PaperCut MF
- Mentions · 7d0
- Mentions · 30d2
- All mentions24
- First seenAug 28, 2026
- Last mentioned14d ago
Timeline
24 articles · newest firstHackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials
A threat actor used AI agents to exploit PaperCut, compromising about 440 servers and stealing Windows credentials.
88
Hackers Turned a PaperCut Print Server Into a Path to the Domain Controller
Attackers chained two PaperCut MF zero-days to reach an education customer's domain controller in under two days.
80
PaperCut Flaws Exploited in AI-Powered Attacks
GreyNoise says a Russian-speaking actor used AI to build and deploy exploits hitting 440 PaperCut NG/MF deployments across 395 organizations in 48 countries.
77
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut shipped maintenance releases replacing emergency patches for two actively exploited flaws abused in AI-assisted attacks on 395 organizations.
78
Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
82
AI-powered attack exploited PaperCut flaws to hack 395 organizations
AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.
88
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
76
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
82
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.
82
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.
80
Attackers plant remote access tools on compromised PaperCut servers
Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.
78
CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities
Two chained PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, enable pre-auth RCE, with active exploitation confirmed in customer environments.
88
U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.
72
PaperCut security advisory (AV26-858) – Update 2
CISA added actively exploited PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078 to KEV; Canada's Cyber Centre urges Emergency Patch Release 2 for v24-v26.
72
PaperCut NG/MF vulnerabilities exploited in zero-day attacks
PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.
75
PaperCut NG/MF Zero-day Vulnerability Exploited in the Attacks (CVE-2026-82078 & CVE-2026-81578)
PaperCut NG/MF zero-days CVE-2026-82078 and CVE-2026-81578 are actively exploited, chaining to pre-auth RCE on the Application Server.
84
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 to the KEV catalog, mandating federal patching.
76
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
PaperCut warns of actively exploited zero-day RCE chain CVE-2026-81578 and CVE-2026-82078 affecting all PaperCut NG and MF versions.
78
Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
25
PaperCut Zero-Day Under Active Attack: Emergency Patch Released
PaperCut warns that a zero-day in NG and MF print management products is being actively exploited, shipping emergency patches with no CVE assigned yet.
76
PaperCut warns of hackers using printer management software flaw in attacks
PaperCut warns of active exploitation of CVE-2026-82078 and CVE-2026-81578 in NG/MF print management software used by universities, corporations, and governments.
78
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
PaperCut confirms active exploitation of critical zero-days CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF print management software, with confirmed customer incidents.
86
PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
PaperCut NG/MF hit by a pre-auth RCE zero-day under active exploitation; Huntress reproduced the chain and urged immediate patching.
82
Related CVEs
by mentions- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2023-27350100%9.8Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG
- CVE-2021-4228777%7.5Privilege Escalation in Microsoft Active Directory Domain Services
- CVE-2021-4227873%7.5Privilege Escalation via sAMAccountName Spoofing in Microsoft Active Directory
- CVE-2023-2735178%7.5Authentication Bypass in PaperCut NG/MF Print Management Software
- CVE-2026-6000424%9.8Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
- CVE-2026-7357072%8.9Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
- CVE-2026-84521%8.8Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild
Appears with
- PaperCut NGproduct · 23
- PaperCutvendor · 23
- GreyNoiseorganization · 9
- DeepSeekai model · 8
- PaperCutorganization · 8
- OpenAIvendor · 7
- Huntressvendor · 7
- DeepSeekvendor · 6
- CISAorganization · 5
- watchTowrvendor · 5
- GreyNoisevendor · 4
- Huntressorganization · 4
- DeepSeekorganization · 3
- Cloudflarevendor · 3
- CISAvendor · 3
- Blackpoint Cyberorganization · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.