--- title: "PaperCut Ships Tested Fixes After AI Agents Breach 395 Organizations" date: 2026-09-11 author: "Sofia Ramirez" featured_image: "https://sqmagazine.co.uk/wp-content/uploads/2026/09/papercut-ships-tested-fixes-ai-attacks.jpg" categories: - name: "Cybersecurity" url: "/cybersecurity.md" tags: - name: "News" url: "/tag/news.md" --- # PaperCut Ships Tested Fixes After AI Agents Breach 395 Organizations PaperCut on 10th September, 2026 released PaperCut NG/MF maintenance builds 26.0.5, 25.0.13 and 24.1.10, replacing three emergency patches for two flaws that one attacker has already used to breach at least 395 organizations. ## What to Know? - PaperCut says the new maintenance releases include every fix from Emergency Patch Releases 1, 2 and 3, plus extra hardening. - CVE-2026-81578 and CVE-2026-82078 let attackers bypass authentication and run arbitrary code on unpatched PaperCut NG/MF servers. - GreyNoise tracked one campaign across 48 countries, and schools and universities made up the largest group of victims. - The attacker directed hundreds of AI agents built on OpenAI’s Codex harness and a DeepSeek model. - PaperCut customers still running an emergency patch build should move to one of the new maintenance releases. ## How It Happened? The two bugs work as a chain. **CVE-2026-81578 (CVSS 8.8)** is an improper access control flaw in the web management interface, while **CVE-2026-82078 (CVSS 9.4)** is an unsafe dynamic class loading bug in database connection utilities. An attacker skips the login with the first flaw, edits a configuration file, and then abuses the second to execute code. CISA has added both CVEs to its Known Exploited Vulnerabilities catalog, and the [CISA KEV tracker](https://sqmagazine.co.uk/kev-tracker/) lists the pair with a federal fix-by deadline. PaperCut’s third emergency release also had to fix two regressions. ## Hundreds of AI Agents, One Operator GreyNoise traced the campaign to a suspected Russian-speaking actor working from the IP address **45.142.193\[.\]132**. The operator compromised **440** PaperCut instances, education accounted for **204** of them, and **98** victim organizations sit in the U.S. The operator told the agents to avoid Russia, China, Hong Kong, Thailand, Iran and 23 other countries, yet GreyNoise found some of them hitting organizations on that exclusion list anyway. It is one more data point in the move toward [AI-assisted zero-day attacks](https://sqmagazine.co.uk/google-first-ai-assisted-zero-day-cyberattack/). Blackpoint Cyber, which observed the same campaign, described the attacker using AI to research the flaws, write and test exploits, and troubleshoot failures. “**It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses to achieve follow-on objectives such as data theft or ransomware deployment**,” GreyNoise said. ## What the Maintenance Releases Change? PaperCut positions the builds as the stable replacement for its emergency fixes. “**These are Regular Maintenance Releases (MR) that have gone through complete QA testing**,” the company said in its [security bulletin](https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/). The 26.0.5 release notes also state that the version does not contain a database upgrade, which removes one common reason to delay a server update. Patching closes the entry point, but it does not evict anyone already inside. Arctic Wolf researchers saw attackers at schools and universities search PaperCut configuration files for strings such as “**password**“, “**ldap**” and “**token**“. The public research does not yet say how many compromised servers have since been cleaned up. ## SQ Magazine’s Takeaway One operator directing AI agents turned a two-step exploit chain into hundreds of breaches, echoing the UK NCSC’s warning about an [AI-driven patch wave](https://sqmagazine.co.uk/ncsc-warns-prepare-vulnerability-patch-wave-ai/). PaperCut boxes make attractive targets because their configuration can hold directory and service credentials, and the Arctic Wolf findings show attackers went looking for exactly that. **What’s next**: federal civilian agencies face a CISA remediation deadline of 14th September, 2026, and other organizations have good reason to match it. Admins who ran an internet-facing PaperCut server should upgrade, restrict the server’s internet exposure, look for unfamiliar admin accounts, check for cmd.exe or powershell.exe launched by pc-app.exe, and rotate LDAP and service credentials, steps that help reduce risk. Definition of AI Agent. Link to full glossary entry follows the description.**AI Agent**An AI agent is a software system that uses an AI model to plan, pick tools and take actions toward a goal on a user's behalf, with limited human oversight. [Read more](https://sqmagazine.co.uk/glossary/ai-agent/)