#cve202682078

Read Time:3 Minute, 15 Second

A highly automated cybercrime operation compromised at least 440 internet-facing PaperCut NG and MF servers associated with 395 organizations in 48 countries, according to research summarized by Cyber Security News. The operator combined coding agents, a DeepSeek model and familiar offensive-security utilities to test exploitation paths and then apply them at scale. The incident offers a concrete example of artificial intelligence speeding up an intrusion without replacing the weaknesses, tools and decisions on which the attack depended.

Two flaws opened a path to code executionThe campaign focused on two PaperCut vulnerabilities. CVE-2026-81578 can let an unauthenticated requester modify certain settings, while CVE-2026-82078 concerns unsafe class loading that may permit code execution once those settings can be controlled. Used together against a vulnerable deployment, the issues can take an attacker from an exposed service to executing commands on the server.

PaperCut lists versions 26.0.5, 25.0.13 and 24.1.10 as its current security maintenance releases. Administrators should consult the vendor advisory for the correct supported upgrade route. Public exposure also deserves scrutiny: reducing access to management interfaces and tightly controlling the XML-RPC API can remove opportunities that patching alone may not address.

Automation compressed the attack timelineGreyNoise traced the activity to a self-hosted laboratory used on August 31, 2026, where the actor tested PaperCut and refined exploit code. The operator reportedly reached a real target in less than four hours, gained domain-administrator privileges roughly two hours later, and compromised 11 organizations in 26 seconds after broader automation began. Those measurements describe observed events, not identical outcomes at every scanned server.

A later Hunt.io investigation found exposed attacker directories containing project instructions, exploit variants, target lists, status notes, logs and credential-access tools. The material showed an iterative workflow: agents were instructed to continue testing, change tactics after failures and handle multiple tasks in parallel. Different exploit versions accounted for PaperCut releases and network conditions, while notes described an alternative XML-RPC route where access controls were weak.

The distinction matters. AI did not create an irresistible new vulnerability; it helped an operator organize research and repeat proven steps quickly. Defenders therefore still gain substantial protection from disciplined patching, limited exposure, strong authentication and useful telemetry.

Compromised print servers became network launchpadsThe operation did not necessarily stop at PaperCut. Recovered tooling could gather Windows registry information and service credentials, establish reverse SOCKS tunnels and package details about affected systems. A tunnel allows traffic to pass through the compromised server, giving an intruder a route toward otherwise internal services.

Hunt.io identified 1,005 hosts in the reconnaissance pool across at least 45 countries. That number should not be confused with confirmed compromises: GreyNoise reported 440 compromised instances. At capture time, researchers found 45 targets with functioning reverse tunnels and victim packages referring to 46 Active Directory domains, evidence that some intrusions had progressed well beyond initial access.

Patch, then hunt for persistenceOrganizations running PaperCut should treat remediation as both an update and an incident-review exercise. A newly patched system can still contain accounts, scheduled tasks, tunnels or stolen credentials left behind before the fix was applied.

Upgrade to a supported security maintenance release and validate the installed version.

Remove unnecessary public access to administration services and restrict XML-RPC with authentication and network allowlists.

Review changes to user-lookup.* settings and files created beneath PaperCut’s custom/web/ directory.

Investigate unusual child processes, outbound connections, chisel-like tunneling and cron-based persistence.

Check Active Directory for unexpected accounts, privilege changes and evidence of credential access.

The speed of this campaign changes the margin for delay. Once exploitation becomes repeatable, an exposed service can be discovered, tested and used as an internal foothold in minutes. Prompt patching remains essential, but evidence-led investigation is what establishes whether the organization arrived before or after the attacker.