Archive

An AI-orchestrated attack against PaperCut servers has compromised systems in multiple countries. For defenders, the immediate issue is exposure in widely deployed print-management software and the need to check for compromise, isolate affected servers, and harden access to administrative tools.

Attackers appear to have used a large number of AI agents to scale a campaign against PaperCut-related targets, with some of the agents behaving unpredictably. For defenders, the main issues are faster attack automation, wider exposure across many organizations, and the need to monitor for AI-assisted abuse that can drift from the operator’s intended playbook.

PaperCut MF/NG is being actively targeted through known flaws, and the use of large numbers of AI agents suggests the exploitation effort is being automated at scale. Defenders running PaperCut should treat this as a prompt to verify patch status, review exposed instances, and look for signs of attempted exploitation rather than waiting for confirmed compromise.

PaperCut flaws are being used against school environments in the U.S. and Europe, which raises exposure for organizations that run the print-management software and have not patched it. Defenders should treat this as a vulnerability-driven intrusion risk affecting education networks and prioritize patching, exposure review, and monitoring for follow-on access.

Attackers are using compromised PaperCut servers to drop remote access tools, which turns a printer-management foothold into broader network persistence. Defenders should treat exposed PaperCut systems as a priority because compromise can lead to long-lived access beyond the initial exploit.

Hong Kong CERT is flagging multiple PaperCut vulnerabilities. For defenders, this is a product exposure issue that can affect print management servers and should move to patching, version inventory, and exposure review.

PaperCut server exposure remains a live defender issue because attackers are actively scanning for unpatched systems. The immediate priority is patch verification and inventory review, since unpatched print management servers can become an entry point for compromise.

PaperCut NG/MF is a vendor product security advisory, so defenders should treat it as an exposure and patch-management issue. Organizations that rely on the software need to check their deployment, review exposure, and prioritize mitigation or updates.

PaperCut print software is reportedly being exploited in the wild through a pre-authentication remote code execution flaw. Defenders should treat this as a high-priority exposure because unauthenticated exploitability can let attackers reach internal systems through a widely deployed business application.

PaperCut has pushed an emergency fix for a zero-day that is already being exploited, which makes this a direct exposure issue for organizations running the affected software. Defenders should treat this as a patching and asset-inventory priority, with added attention to any signs of compromise before and after remediation.

PaperCut NG/MF is being actively exploited, which makes this an immediate exposure issue for organizations running the affected print management software. Defenders should treat this as a patching and hunting priority, especially where the product is internet-facing or used for privileged print workflows.