GreyNoise says an attacker built and tested exploits for PaperCut NG/MF vulnerabilities in a private lab, then used AI agents to automate mass compromise efforts against organizations worldwide. The campaign led to at least 440 compromised PaperCut instances across 395 organizations in 48 countries, with education as the most affected sector. #PaperCut #GreyNoise #CVE-2026-81578 #CVE-2026-82078
Keypoints
- An attacker developed working exploits for PaperCut vulnerabilities in a private lab.
- AI agents using OpenAI’s Codex harness and a DeepSeek model automated much of the intrusion work.
- The campaign compromised at least 440 PaperCut instances across 395 organizations in 48 countries.
- Education was the hardest-hit sector, followed by retail, professional services, and hospitality.
- GreyNoise observed rapid escalation, including some cases reaching domain admin within minutes.
Read More: https://www.helpnetsecurity.com/2026/09/11/ai-agents-papercut-ng-mf-attack-campaign/