PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut shipped maintenance releases replacing emergency patches for two actively exploited flaws abused in AI-assisted attacks on 395 organizations.
PaperCut released PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10, superseding Emergency Patch Releases 1-3 for CVE-2026-81578 and CVE-2026-82078, which enable authentication bypass and arbitrary code execution on susceptible instances. GreyNoise and Blackpoint Cyber reported a suspected Russian-speaking actor weaponizing both flaws against at least 395 organizations in 48 countries, concentrated in the U.S. education sector. The campaign used hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model, originating from IP 45.142.193.132, and avoided organizations in Russia, China, Hong Kong, Thailand and Iran.
- Maintenance releases 26.0.5, 25.0.13 and 24.1.10 replace emergency patches and add security hardening.
- CVE-2026-81578 and CVE-2026-82078 enable authentication bypass and arbitrary code execution.
- At least 395 organizations across 48 countries were targeted, mostly in the U.S. education sector.
- Attack automation used hundreds of AI agents via OpenAI Codex harness and a DeepSeek model.
- Unclear whether the actor sells access or plans data theft or ransomware follow-on.
- Vendors
- PaperCut
- Products
- PaperCut NGPaperCut MF
- Threat actors
- Suspected Russian-speaking access broker
- Victims
- U.S. education sector
- Organizations
- PaperCutGreyNoiseBlackpoint CyberOpenAIDeepSeek
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
1 min read at thehackernews.com
PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation. The software development company said PaperCut NG/MF versions 26. 0.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.