Recently patched PaperCut zero-days used in data theft attacks
Cybersecurity teams worldwide scramble to mitigate ongoing PaperCut zero-day exploits.
Evidence dossier
Intelligence passport
Measured timeline
📍 The outcome
PaperCut exploitation escalated to active intrusions as threat actors targeted chained vulnerabilities in data theft attacks. The company released a third emergency patch with fixes only for versions 25 and 26.
Following these developments, the U.S. CISA added the flaws to its Known Exploited Vulnerabilities catalog.
Epilogue added 53d ago, after coverage quieted.
Momentum
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
The story so far
- Velocity & Diffusion: Coverage exploded across 7 distinct news outlets with 7 published articles, achieving a live velocity of 5.
- Primary Driver: Cybersecurity teams worldwide scramble to mitigate ongoing PaperCut zero-day exploits.
- Predictive Outlook: Archynetys algorithmic models forecast this story will fade from trending status over the next 24 hours.
- Source Integrity: Verified strictly against primary headline reporting under zero-hallucination protocols.
PaperCut NG/MF software has been under active exploitation since the beginning of September. The initial attacks targeted zero-day vulnerabilities in the print management software.
The company responded by releasing emergency patches for versions 25 and 26. However, the exploitation has escalated to active intrusions, with threat actors chaining vulnerabilities to steal data.
Cybersecurity and Infrastructure Security Agency (CISA) has added the flaws to its Known Exploited Vulnerabilities catalog, urging organizations to apply the patches immediately. The situation is critical, with ongoing efforts to mitigate the threats and protect sensitive information.
Synthesized by Archynetys from the headlines below under a strict no-invention contract. ✓ fact-checked: all claims supported by sources Updated 55d ago.
Who reported it (7)
-
PaperCut exploitation continues to worsen as company releases third emergency patchCyber Daily · 57d ago
-
PaperCut Exploitation Escalates to Active IntrusionsSecurityWeek · 57d ago
-
PaperCut Zero-Day: Patches Only for Versions 25 and 26quasa.io · 57d ago
-
U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · 57d ago
-
PaperCut NG/MF Critical Zero-Day Exploited in the WildRapid7 · 57d ago
-
PaperCut issues emergency patches as threat actors target chained vulnerabilitiesCybersecurity Dive · 57d ago
-
Recently patched PaperCut zero-days used in data theft attacksBleepingComputer · 57d ago
The obvious questions
What is PaperCut NG/MF?
PaperCut NG/MF is a print management software used by organizations to monitor and control printing activities.
What versions of PaperCut are affected?
The emergency patches are available for versions 25 and 26. Coverage does not yet specify whether other versions are affected.
What actions has CISA taken?
CISA has added the PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog, indicating the severity of the threat and the need for immediate action.
How do you expect this trend to evolve over the next 24 hours?
Cast your vote to register reader intelligence on the velocity and trajectory of this coverage.
Topics
Related trends
Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed
Volt Typhoon’s new ‘Silent Train’ network deploys four zero‑day attacks, raising the stakes for U.S. cyber defenses.
Google announces Gemini 4 Carbon with ‘significant gains across coding and agentic tasks’
Google launches Gemini 4 Carbon with AI model that excels in coding and cybersecurity.
Japan's GMO urges customers to shut down PCs amid ransomware threat
Japan's GMO urges customers to shut down PCs amid ransomware threat
DoD’s reasons for CMMC pause falling apart in face of RFI responses
DoD's CMMC pause faces scrutiny as RFI responses reveal discrepancies in its justification
'Our Immediate Priority Is to Secure Our Systems' — Kingdom Come: Deliverance Developer Hit by 'Serious' Cybersecurity Incident
Warhorse Studios, Kingdom Come: Deliverance developer, hit by serious cybersecurity incident.
AI Agents Are Breaking the Internet. 5 Things You Should Do Right Now to Protect Yourself
AI agents are being weaponized for large‑scale cyberattacks, forcing immediate shifts in security habits and industry guidance
Open prediction lab
Can you beat the machine?
Pick tomorrow's top trend, then compare your result with Archynetys's self-graded forecast.
📬 The daily trend digest
The world's top trends, once a day. No spam, one-click unsubscribe.