PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions

PaperCut warned of active zero-day exploitation against all versions of PaperCut NG/MF, released emergency patches for v25 and v26, and confirmed customer incidents. The advisory lists IOCs—suspicious post-exploitation activity from pc-app.exe, missing or truncated server.log files, and specific error log entries—and urges immediate restriction of internet access to PaperCut servers while investigations continue; the report also notes that a prior critical PaperCut flaw (CVE-2023-27350) was previously abused by ransomware groups.