CVE Tools
Track your stack

Хакер использовал сотни ИИ-агентов для атак на PaperCut

Хакер (xakep.ru)By Мария Нефёдова

Reported exploitedPaperCut NGPaperCut MF

Our summary

An attacker used hundreds of AI agents to exploit CVE-2026-81578 and CVE-2026-82078 in PaperCut NG and PaperCut MF, compromising at least 440 instances across 395 organizations in 48 countries. The flaws allow authentication bypass and remote code execution, letting the operator steal credentials, extract domain secrets, and obtain Domain Admin access at 12 organizations. Education organizations accounted for the largest share of victims, underscoring the need to apply PaperCut's emergency fixes.

Read at Хакер (xakep.ru)

Хакер (xakep.ru) publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker News⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and RootkitsCVE-2026-81578, CVE-2026-82078
  2. Help Net SecurityAI agents exploited PaperCut flaws to breach 395 organizationsCVE-2026-81578, CVE-2026-82078
  3. SecurityWeekPaperCut Flaws Exploited in AI-Powered AttacksCVE-2026-81578, CVE-2026-82078
  4. The Hacker NewsPaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited FlawsCVE-2026-81578, CVE-2026-82078
  5. The Hacker NewsPaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ InstancesCVE-2026-81578, CVE-2026-82078
  6. The Hacker NewsAttackers Exploit PaperCut Flaws to Steal Credentials From Schools and UniversitiesCVE-2026-81578, CVE-2026-82078
  7. BleepingComputerRecently patched PaperCut zero-days used in data theft attacksCVE-2026-81578, CVE-2026-82078
  8. SecurityWeekPaperCut Exploitation Escalates to Active IntrusionsCVE-2026-81578, CVE-2026-82078
  9. Help Net SecurityAttackers plant remote access tools on compromised PaperCut serversCVE-2026-81578, CVE-2026-82078
  10. The Hacker News⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and MoreCVE-2026-81578, CVE-2026-82078

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store