URGENT UPDATE: Active Exploitation of Two Chained PaperCut NG/MF Vulnerabilities CVE-2026-81578 and CVE-2026-82078

**PaperCut NG/MF pre-auth RCE (CVE-2026-81578 & CVE-2026-82078) — Active exploitation reported; emergency Patch Release 3 available.** Two chained flaws enable unauthenticated attackers to execute arbitrary code as SYSTEM; multiple vendors and Huntress observed in-the-wild activity (base64 discovery commands, Java .class payloads, pc-app.exe at SYSTEM). Apply Emergency Patch Release 3 (24.1.10, 25.0.13, 26.0.5), remove public exposure of ports 9191/9192, and follow configuration hardening and network restrictions until patched.