Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide

Cybersecuritynews •Guru Baran • September 9, 2026

A Russian-speaking threat actor has weaponized artificial intelligence at an unprecedented scale, deploying hundreds of autonomous AI agents to exploit critical vulnerabilities in PaperCut NG/MF print management software and compromise at least 440 servers across 395 organizations in 48 countries. Security researchers at GreyNoise identified the campaign through their Global Observation Grid, a network of […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Driven Exploitation of PaperCut Vulnerabilities Compromises 440 Servers Globally A Russian-speaking threat actor has exploited vulnerabilities CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF software, compromising at least 440 instances across 395 organizations in 48 countries. The campaign began on August 31, 2026, utilizing hundreds of AI agents powered by OpenAI's Codex and DeepSeek models to automate the attack process. The adversary achieved remote code execution (RCE) within four hours of initial exploit development and gained domain administrator access in as little as seven minutes. Most victims are in the education sector, with the United States being the most affected country. Despite attempts to avoid targeting specific countries, some organizations in those regions were still compromised. GreyNoise and Blackpoint Cyber have reported on the incident, emphasizing the rapid scale and sophistication of the attacks. Emergency patches were issued by PaperCut on August 27, 2026, prior to the exploitation. 24 sources 79

Extracted Entities

Platforms (1)

PaperCut Ng/mf