PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws

Summary

PaperCut released maintenance releases replacing emergency patches for two actively exploited vulnerabilities (CVE-2026-81578, CVE-2026-82078). These flaws allowed authentication bypass and arbitrary code execution. A Russian-speaking actor exploited them against 395 organizations, primarily in the U.S. education sector, using AI agents.

Key Takeaways

1. PaperCut released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation.
2. The vulnerabilities, CVE-2026-81578 and CVE-2026-82078, have come under active exploitation in the wild to bypass authentication and execute arbitrary code on susceptible instances.
3. In light of active exploitation efforts, it's imperative that users apply the latest fixes for optimal protection.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents factual information about software security updates and vulnerabilities. It cites specific CVE numbers and details the actions of threat actors, lending it a high degree of credibility. The information is presented objectively, focusing on technical details and reported events.

Bias assessment: Technical Reporting. The article's primary focus is on technical security details and reported exploits. It avoids emotional language or partisan framing, presenting information in a straightforward, informative manner. The bias is minimal, leaning towards a neutral, factual reporting style common in cybersecurity news.

Note: This article provides technical details on security vulnerabilities and patches. While generally reliable, always cross-reference critical security information with official vendor advisories.

Credibility flag: Technical, Verified

Claimed Facts (8)

• This is a direct statement of fact regarding the release of a security update.
• This provides specific version numbers and availability, presented as factual information.
• This is a direct quote from PaperCut about the nature and testing of the releases.
• This is a direct quote from PaperCut detailing the contents of the new releases.
• This states specific CVE numbers and the known impact of the vulnerabilities as factual.
• This presents findings from security firms as factual reporting on threat actor activity.
• This describes the methodology and scope of the attacks, attributed to threat actors.
• This provides a specific technical detail about the origin of the attacks.

Opinions (2)

• This is a speculative statement from GreyNoise about the threat actor's motives.
• The phrase 'it's worth noting' introduces a point of emphasis that leans towards an editorial observation rather than a strict fact.

Claims (1)

• While presented as fact, the claim of 'hundreds of AI agents' and the specific avoidance of numerous countries is a highly detailed assertion that, without further independent verification, could be considered a strong claim that requires more substantiation to be definitively classified as a 'claimed fact'. The article does not provide direct evidence of these AI agents or the precise avoidance patterns.

Key Sources

• GreyNoise — Cybersecurity Intelligence Firm
• Blackpoint Cyber — Cybersecurity Firm
• OpenAI — Artificial Intelligence Research Company