PaperCut released a security maintenance release that supersedes all previously issued emergency patches for the two flaws under active exploitation in its NG/MF print-management products, with versions 26.0.5, 25.0.13 and 24.1.10 now available. The company states the releases carry every fix from Emergency Patch Releases 1, 2 and 3 plus additional hardening, and that unlike the emergency patches they have been through the full standard QA process. The distinction is the substance of the story: the emergency releases shipped ahead of the normal test cycle to answer an active campaign, and the AI-orchestrated operation documented that week ran hundreds of AI agents against internet-facing PaperCut servers, hitting at least 440 instances across 395 organisations in 48 countries, roughly half of them in education. Unpatched, internet-exposed instances remain the exposure that matters for Australian and New Zealand universities and school systems running PaperCut estates.

Source

• The Hacker News
• Captured via /raw/digests/Cyber-Digest-2026-09-12.md