decrypted · 28 august 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

The PaperCut zero-day that skipped the login screen entirely

PaperCut, the print management software that sits behind quota systems and shared printers in thousands of UK schools, universities, NHS trusts and councils, spent the last two days pushing emergency patches for a zero-day already being used against its customers. Two flaws, chained together, let an attacker with no credentials at all reach an administrative function and then hand the server code to run. PaperCut confirmed customer incidents, Huntress logged live intrusions within hours, and by the following day the vendor had shipped a second, hardened patch because the first one was not enough. If your organisation runs PaperCut NG or MF and exposes it to the internet, this is not a bulletin to file for Monday.

Two bugs, one door

The vulnerability that got attackers in is CVE-2026-81578, an access control flaw in PaperCut's web management interface. According to Huntress's analysis, the flaw works by asking the server to render one page while quietly executing an action through a different, less-guarded component: think of it as showing a receptionist a visitor's badge for the lobby while actually walking through the door marked "staff only", because the same badge check never runs on that door. No login required.

Once inside, the second flaw, CVE-2026-82078, does the damage. It is an unsafe dynamic class loading bug in PaperCut's database connection utilities, which in plain terms means the server will take a piece of Java code handed to it and run it. Huntress's incident write-up shows attackers doing exactly that: reconnaissance commands such as whoami and tasklist, then hex-encoded Java classes dropped into PaperCut's own library folders, then logs quietly deleted to cover the tracks.

PaperCut released emergency, out-of-cycle builds for its v25 and v26 branches at 2.10am AEST on 28 August, then a "Release 2" the same day with extra hardening after working with Huntress and watchTowr, and is telling customers to install it even if they already patched once. Anyone on an older, unsupported branch has no fix coming and should pull public internet access to the management interface now.

The Secure by Design lesson

The design failure here is a familiar one: an administrative interface that was reachable from the network at all. Secure by Design does not mean "patch the access control bug quickly", it means the admin console should never have been answering requests from an unauthenticated visitor in the first place, whatever the intended check was supposed to do. PaperCut's own guidance, to restrict the web interface to trusted IP addresses, is the right instinct, but it is also an admission that the product shipped without that boundary built in.

For UK organisations, particularly the schools, universities and NHS trusts that make up a large share of PaperCut's customer base, the practical lesson is to stop treating print management as boring infrastructure that does not need the same network segmentation as anything else holding credentials and access to internal systems. An unauthenticated path to code execution on a server that talks to Active Directory is not a print problem, it is a domain problem.

Also this week

A UK accounting firm learned what an infostealer on one laptop can cost. CRASL Accounting Services, a small firm in Saxmundham, Suffolk, was listed by the "Thegentlemen" ransomware crew, which claims an attack dated 18 August. Monitoring service Ransomware.live records the entry point as a single employee compromised through infostealer malware, not a network exploit. This is a leak site claim, not an independently confirmed breach, but it is a clean illustration that for small UK firms holding client financial data, credential hygiene on one employee's device is often the whole perimeter.

ServiceNow patched three maximum-severity flaws in its AI Platform. CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 each score 10.0 on CVSS and are exploitable by an unauthenticated attacker over the network, covering code injection, image-upload access control and SQL injection respectively. ServiceNow has already patched its hosted instances; self-hosted customers, which include a number of NHS bodies running ServiceNow for IT service management, need to apply the fixes themselves rather than assume the vendor has done it for them.

Sources

If you want to talk through how a chained access-control flaw like this could play out in your own estate, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.