PaperCut has now released fully tested maintenance updates for the affected versions of PaperCut NG and PaperCut MF: 26.0.5, 25.0.13 and 24.1.10. These releases replace Emergency Patches 1, 2 and 3 and include additional security hardening.
PaperCut has also formally disclosed the vulnerabilities involved in the attacks: CVE-2026-82078, a critical vulnerability that can enable remote code execution, and CVE-2026-81578, an authentication-bypass vulnerability affecting administrative functions.
For cybersecurity students, this latest development makes the incident even more useful to follow because we can now see much more of the real vulnerability-management and incident-response lifecycle:
Discovery → active exploitation → emergency containment → evolving attacker behavior → multiple emergency patches → tested maintenance release → continued investigation
Notice what happened. Defenders did not receive a vulnerability notice, install one patch and declare victory. The threat evolved. Attackers changed their activity. Emergency fixes were revised. Additional protections were added. Eventually, tested maintenance releases replaced the emergency patches.
That is how cybersecurity often works outside the textbook. Understand this process and be able to discuss it in an interview setting.
There is another important lesson: installing the final security update does not erase what may have happened before it was installed.
An organization that had a vulnerable, internet-exposed server still has questions to answer:
Was the system actually exposed during the vulnerable period? Did anyone exploit it? What do the logs show? Are there indicators of compromise? Were logs altered or deleted? Did an attacker move beyond the original server? What evidence needs to be preserved?
This is where vulnerability management becomes incident response.
Patching fixes the vulnerability going forward. Incident response determines what may already have happened.
For students interested in networking, system administration, SOC operations, threat hunting, digital forensics or incident response, this is a useful distinction to understand. Technical skills matter, but so do prioritization, evidence preservation, communication, documentation and making defensible decisions while information is incomplete.
Organizations running affected PaperCut NG/MF versions should move to the applicable maintenance release rather than relying on the earlier emergency patches, continue limiting unnecessary internet exposure, and review PaperCut’s current indicators and incident-response guidance.
PaperCut, a print-management platform widely used by schools and other organizations, is responding to active attacks against PaperCut NG and PaperCut MF servers. Attackers are chaining two vulnerabilities to bypass authentication and execute code remotely on vulnerable systems.
PaperCut reports that a second wave of attacks is targeting servers that remain publicly accessible and are not fully patched. This wave includes more sophisticated activity after attackers gain access. PaperCut has released Emergency Patch 3, which replaces its first two emergency patches and adds further protection against attack methods observed during the incident.
This incident shows where vulnerability management becomes incident response.
Installing the newest patch is essential, but patching does not prove that a system was never compromised. Security teams must also determine whether the server was exposed, review logs and security alerts, look for indicators of compromise, preserve evidence, and investigate suspicious activity.
The incident offers several practical lessons:
Students studying networking, system administration, digital forensics, threat hunting or incident response can follow this situation as it develops. Pay attention not only to how the vulnerabilities work, but also to how defenders make decisions when the facts are incomplete and the threat is still changing.