PaperCut zero-days hit in the wild again, fueling data theft after patches
Two newly patched PaperCut NG/MF flaws (CVE-2026-81578 and CVE-2026-82078) are being exploited to bypass authentication and remotely execute code, with attackers now dumping Derby DB tables to steal data. PaperCut released multiple emergency patches (including Release 3) and urges internet-facing servers to apply them; over 800 PaperCut servers are exposed online per Shadowserver. While attribution is unclear, this follows a history of targeted PaperCut exploits by ransomware and state-backed groups and underscores ongoing risk from misconfigured or exposed deployments.