Paper Cut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws

Summary: PaperCut released maintenance releases 26.0.5, 25.0.13 and 24.1.10 that replace its earlier emergency patches for CVE-2026-81578 and CVE-2026-82078, two flaws exploited in the wild to bypass authentication and execute arbitrary code. GreyNoise and Blackpoint Cyber reported a suspected Russian-speaking actor using the flaws to breach at least 395 organizations in 48 countries, mostly in the U.S. education sector, with hundreds of AI agents built on OpenAI's Codex harness and a DeepSeek model, from IP 45.142.193[.]132.
Bottom line: At least 395 organizations across 48 countries were breached through two PaperCut flaws, and the actor behind it ran the campaign with hundreds of AI agents rather than a manual team. GreyNoise said it is unclear whether the access is being sold onward or held for data theft or ransomware, so the exposure may not end with the initial intrusion.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2026-81578 CVE-2026-82078
Related: Paper Cut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions Cyber Risks ·
Attackers Chain Two Paper Cut Flaws to Execute Code Without Authentication Cyber Risks ·
Attackers Exploit Paper Cut Flaws to Steal Credentials From Schools and Universities Cyber Risks ·