AI-powered attack exploited PaperCut flaws to hack 395 organizations

A likely Russian-speaking threat actor used hundreds of AI agents combined with offensive tools to rapidly develop and launch exploits for two PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078), compromising at least 440 instances across 395 organizations in 48 countries—primarily in education—harvesting credentials from 280 victims, obtaining domain secrets from 147, and achieving domain admin in multiple cases; administrators are urged to apply vendor patches immediately.