CriticalEarly warningRemote code executionUnited states · English
Hackers Actively Exploiting Pre-Auth RCE Flaw in PaperCut Print Software
First seen 27 Aug, 14:00 WIBLatest 12 Sept13 articles · 12 publishers
Confidence index · preliminarycomputed by the pipeline (V0.7)high
Corroborated by distinct domains
Independent sources
Victim identified
Full text available
Clustering consistency
Early warningMachine output from news coverage; not verified by the public or institutions
Preventive steps
- Turn on two-step verification for email, banking, and social media.
- Apply security updates quickly, prioritising flaws that are being exploited.
- Limit services exposed to the internet and follow vendor advisories.
Literacy audienceChatGPT users in IndonesiaSocial media and messaging usersHomemakers
Literacy topics
- Protecting personal data, OTPs, and PINs
- Recognising deepfakes and cloned voices
- System updates and security patches
Report toPatroli Siber Polri
Extracted claims
Victimconfidence 0.60
PaperCutActorconfidence 0.60
LockBit, Clop2 differing values across articles; review needed.Attack typeconfidence 0.90
Ransomware9 differing values across articles; review needed.Event datenot found
not identifiedLocationUnited states
Target groupIndividuals
Status
- D1 Machinehigh trust
Conclusion
- D1 MachineHappened
Source chronology
13 articles, by publication time27 August 20261 articles
- 14:00 WIBFirst reportfull text hashedPaperCut warns of NG, MF flaw exploited in zero-day attacks
bleepingcomputer.comLockBit, Clop
28 August 20266 articles
- 14:00 WIB+24 hfull text hashedHackers Actively Exploiting Pre-Auth RCE Flaw in PaperCut Print Software
itsecurityguru.org
- 14:00 WIB+24 hfull text hashedPaperCut NG/MF Critical Zero-Day Exploited in the Wild
rapid7.comPaperCut
- 14:00 WIB+24 hfull text hashedPaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
thehackernews.comLockBit, Cl0p, Lace Tempest
Show all 13 articlesCollapse
28 August 2026 · continued6 articles
- 14:00 WIB+24 hPaperCut Warns of Active Zero-Day Attacks on Print Management Software
finance.biggo.com
- 14:00 WIB+24 hPaperCut NG/MF Vulnerability Actively Exploited in Attack - All Versions Impacted
cybersecuritynews.com
- 14:00 WIB+24 hfull text hashedPaperCut releases second emergency patch for exploited flaws
30 August 20261 articles
- 14:00 WIB+72 hPaperCut Zero-Day: 2 CVEs, CVSS 9.4, 2nd Patch Ships [2026] - tech-insider.orgGoogle News
31 August 20264 articles
- 14:00 WIB+96 hfull text hashedMore Details Emerge on Exploited PaperCut Vulnerabilities
securityweek.com
- 14:00 WIB+96 hfull text hashedPaperCut NG/MF Zero-Day: CVE-2026-81578, CVE-2026-82078 (Active Exploitation Underway)
watchtowr.com
- 22:02 WIB+104 hfull text hashedPaperCut Issues Second Emergency Patch As Researchers Break Fix For Exploited Zero-Days - The Cyber Express
thecyberexpress.com
12 September 20261 articles
- 14:00 WIB+384 hThe PaperCut Pipeline: How Two Vulnerabilities Became an Automated RCE Factory
cryptorank.io
Relations between articles
78 pairs likely independent
Evidence
Hashes prepared13full text hashed 9
first evidence_uida1e7ebd63ad92a0438beaecb
13 of 13 evidence records are in Merkle batchesFlow comparison D1–D4
each flow's preventive output; this is where they differ · D1 changed 3 times · since 29 Sept| D1Machine12 Oct | D2Public surveynone yetHelp review | D3Institutionnone yet | D4Official recordnone yet | |
|---|---|---|---|---|
| Literacy audience | ChatGPT users in IndonesiaSocial media and messaging usersHomemakers | – | – | – |
| Literacy topics |
| – | – | – |
| Preventive steps |
| – | – | – |
| Institution's reason | – | – | – | – |
Columns D2 to D4 fill in once the public survey and institution statements are running.Summary across incidents