PaperCut Releases Permanent Fixes as Russian-Linked Hackers Breach Hundreds of Organizations Globally

A suspected Russian-speaking threat actor has exploited two critical PaperCut vulnerabilities to infiltrate at least 395 organizations across 48 countries — prompting the software company to replace emergency patches with fully tested maintenance releases.

PaperCut's latest security update closes the door on a sprawling cyberattack campaign that researchers say used artificial intelligence at an unprecedented scale. For IT administrators still running temporary emergency patches, the clock is ticking.

What the New PaperCut Patches Fix

PaperCut released its security maintenance updates on September 11, 2026, making versions 26.0.5, 25.0.13 and 24.1.10 available for immediate download. The company was clear about what sets these apart from the emergency releases that preceded them.

"These are Regular Maintenance Releases that have gone through complete QA testing," PaperCut said in its announcement. "They contain all of the security fixes issued in Emergency Patch Releases 1, 2 and 3, plus additional security hardening, and they have been through our standard release testing process."

The new releases address two actively exploited vulnerabilities tracked as CVE-2026-81578 and CVE-2026-82078. Both flaws allowed attackers to bypass authentication and execute arbitrary code on vulnerable PaperCut instances. The updates also resolve two previously introduced regressions and include broader hardening measures designed to neutralize potential attack chains.

Customers running any version of PaperCut NG or MF with an emergency patch applied are strongly advised to migrate to the new maintenance release immediately for full protection.

Why the Distinction Between Emergency Patches and Maintenance Releases Matters

Emergency patches are designed for speed — they are issued to stop active exploitation as rapidly as possible, often before full regression testing has been completed. Maintenance releases, by contrast, undergo PaperCut's complete QA process, which means they address not only the original vulnerabilities but also any unintended side effects introduced by the earlier rapid-response fixes. Organizations that remain on emergency patch builds are, in effect, running partially validated code in a production environment — an unnecessary risk given that fully tested alternatives are now available.

AI-Powered Attacks Hit the Education Sector Hardest

The scale and sophistication of the exploitation campaign has raised serious alarms across the cybersecurity community. According to joint findings from GreyNoise and Blackpoint Cyber, a suspected Russian-speaking threat actor weaponized both vulnerabilities to breach at least 395 organizations spread across 48 countries.

The majority of victims were concentrated in the United States education sector — a pattern consistent with previous ransomware and data-theft campaigns targeting resource-constrained institutions. The attacks originated from the IP address "45.142.193[.]132."

How AI Agents Were Used to Automate the Campaign

What made this campaign particularly notable was its use of artificial intelligence to automate attacks at scale. Hundreds of AI agents — powered by OpenAI's Codex platform and a DeepSeek model — were deployed to systematically target organizations. The use of AI agents to conduct coordinated cyberattacks at this scale represents an operational reality that defenders must now reckon with as a baseline threat, not an exception.

Tellingly, the threat actor programmed its AI agents to avoid targeting entities in Russia, China, Hong Kong, Thailand, Iran and 23 other countries — a geographic exclusion list that researchers say points strongly toward a state-aligned or Russian-speaking origin.

Understanding why robust cybersecurity measures are critical for every organization has never been more pressing — campaigns of this nature demonstrate that no sector or region is beyond reach when attackers can deploy automated agents at scale.

"It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses to achieve follow-on objectives such as data theft or ransomware deployment," GreyNoise said in its analysis.

That ambiguity is itself alarming. Whether the breached access is being stockpiled for resale on dark web markets or held in reserve for a coordinated ransomware strike, the 395 confirmed victim organizations remain at significant risk until they apply the new fixes and conduct thorough forensic reviews of their environments.

The Broader Implications for Defenders

The deployment of hundreds of AI agents to automate exploitation across nearly 400 organizations in under 50 countries represents a scalability that human-operated attack teams cannot match. This campaign marks a meaningful inflection point: AI-accelerated threat actors can now probe, exploit and pivot across global targets faster than traditional detection and response workflows can track. Security teams must evaluate whether their tooling and processes are calibrated for this new tempo. For a structured approach to identifying and prioritising exposure before attackers do, reviewing a comprehensive guide to conducting a vulnerability assessment provides a practical foundation.

What Organizations Should Do Now

The combination of actively exploited vulnerabilities, AI-assisted attack automation and an unresolved threat actor motive creates an urgent remediation priority for any organization running PaperCut software. Security teams should treat this as a critical incident response scenario rather than a routine patch cycle.

PaperCut has made the maintenance releases available for download now and confirmed they supersede all previously issued emergency patches. Organizations that have not yet applied any patch are at the highest risk and should act immediately.

For institutions in the education sector — which bore the brunt of this campaign — the urgency is compounded by limited IT security resources and the high value of student and faculty data to criminal and state-aligned actors alike.

Immediate Steps for Affected Organizations

Affected organizations should cross-reference their network logs against the known malicious IP address "45.142.193[.]132" and assess whether any unauthorized access occurred during the exploitation window. Given the unclear end objective of the threat actor, proactive threat hunting is warranted even for organizations that have since applied the emergency patches.

Establishing a repeatable vulnerability management process to systematically reduce security risk is an important longer-term step — incidents like this one expose the cost of reactive postures when patches are available but deployment is delayed. The CISA Known Exploited Vulnerabilities Catalog is also a valuable reference for tracking actively weaponized flaws and prioritizing remediation timelines accordingly.

Specific actions security teams should prioritize:

• Apply PaperCut maintenance releases 26.0.5, 25.0.13 or 24.1.10 immediately and do not rely on emergency patch builds for long-term protection.
• Audit network logs for connections to "45.142.193[.]132" and investigate any anomalous authentication activity on PaperCut instances going back to the initial exploitation window.
• Treat AI-powered attack automation as an emerging baseline threat and review whether your organization's detection tools can identify high-volume automated exploitation attempts in real time.
• For education sector organizations with constrained IT resources, consider engaging a managed detection and response provider to augment in-house capacity during the post-breach investigation window.