AI agents exploit PaperCut NG/MF flaws, hit 440 servers in 395 orgs

🚨 ACTIVE EXPLOITATION

• AI agents exploit PaperCut NG/MF flaws to compromise 440 servers across 395 organizations
  Hundreds of autonomous AI agents built with OpenAI's Codex harness and a DeepSeek model were used to exploit PaperCut NG/MF flaws and compromise at least 440 servers across 395 organizations in 48 countries.
  • Organizations running self-hosted PaperCut NG/MF print management software, which runs as SYSTEM on Windows and integrates with Active Directory; heavily hit sectors include education (204 of 440 compromised systems, mostly US K-12 schools and universities).
  • A likely Russian-speaking actor exploited CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection RCE), chained for unauthenticated code execution.
  • The actor tested exploits in a private lab with PaperCut and Active Directory, compiled targets via Netlas.io with a compromised API key, then ran hundreds of AI agents (OpenAI Codex harness + DeepSeek model) paired with Mimikatz, Certipy, Rubeus, and Impacket.
  • Compromised 11 organizations in 26 seconds once fully launched, reaching full domain admin in as little as seven minutes; DCSync was used to dump full NTDS.DIT credential databases in every successful case.
  • Attack infrastructure includes IPs 45.142.193.132 and 45.158.196.75; agent-driven targeting deviated from instructions to avoid 28 countries, an anomaly GreyNoise calls 'agents gone wild.'
  Sources 📎 Coverage: greynoise.io · 👁 via Cyber Security News

📋 ADVISORIES

• Google's September 2026 Android Security Bulletin fixes critical remote code execution flaws
  Google's September 2026 Android Security Bulletin patches multiple critical vulnerabilities enabling remote code execution on Android devices.

  • Affects Android 14, 15, 16, 16 QPR2, and 17, with patch levels 2026-09-01 and 2026-09-05.
  • Critical System RCE flaws include CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-49882, CVE-2026-49884, CVE-2026-49919, and CVE-2026-49921, exploitable with no additional privileges or user interaction.
  • CVE-2026-52993 (CVSS 9.8) is a critical kernel RCE in Transparent Inter-Process Communication, exploited via malformed network traffic; CVE-2026-28604 is triggered by crafted network packets.
  • Critical Framework EoP flaws CVE-2026-28666 and CVE-2026-55273 allow remote privilege escalation without user interaction, plus critical kernel EoP bugs in NFC and Protected KVM and a critical Qualcomm closed-source flaw (CVE-2026-25289).
  • No active in-the-wild exploitation or public proof-of-concept has been confirmed; high-severity fixes also cover Arm Mali, PowerVR, MediaTek, Unisoc, and Qualcomm components.
  Sources 📄 Source: source.android.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

• Google's September 2026 Android Bulletin Patches Critical System RCE and Kernel Flaws
  Google's September 2026 Android Security Bulletin fixes multiple critical remote code execution and privilege escalation vulnerabilities across Android components.

  • Applies to Android 14, 15, 16, 16 QPR2, and 17 devices, with patch levels 2026-09-01 and 2026-09-05.
  • Includes eight critical System RCE flaws — CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-49882, CVE-2026-49884, CVE-2026-49919, CVE-2026-49921 — requiring no extra privileges or user interaction.
  • CVE-2026-52993 (CVSS 9.8) is a critical kernel RCE in Transparent Inter-Process Communication, exploitable via malformed network traffic; CVE-2026-28604 can be triggered by crafted network packets.
  • Critical Framework bugs include privilege escalation flaws CVE-2026-28666 and CVE-2026-55273 and denial-of-service issue CVE-2026-49932.
  • The 2026-09-05 patch level also covers Android TV, the Linux kernel, chipset components, and a critical Qualcomm closed-source flaw (CVE-2026-25289); no in-the-wild exploitation has been confirmed.
  Sources 📄 Source: source.android.com · 📎 Coverage: securityonline.info · 👁 via cryptika.com (discovered)

🔓 CVEs & KEV

• CVE-2026-85061 — maplibre maplibre-gl-js — CVSS 10.0 — MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks

• CVE-2026-86770 — grokability snipe-it — CVSS 8.6 — Snipe-IT before 8.7.0 Authentication Bypass via SAML Username CollationSnipe-...

• CVE-2026-86762 — grokability snipe-it — CVSS 8.6 — Snipe-IT before 8.7.0 Authentication Bypass via API MiddlewareSnipe-IT before...

• CVE-2026-86771 — grokability snipe-it — CVSS 8.3 — Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_numSnipe-IT ve...

• CVE-2026-86766 — grokability snipe-it — CVSS 7.1 — Snipe-IT 8.6.3 Race Condition via Consumable CheckoutSnipe-IT versions up to ...

• CVE-2026-86765 — grokability snipe-it — CVSS 7.1 — Snipe-IT 8.6.3 Authorization Bypass via Asset Update EndpointSnipe-IT version...

• CVE-2026-86764 — grokability snipe-it — CVSS 7.1 — Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned componentsSnipe-IT...

• CVE-2026-86759 — grokability snipe-it — CVSS 7.1 — Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importerSni...

• CVE-2026-86758 — grokability snipe-it — CVSS 7.1 — Snipe-IT before 8.7.0 License Key Exposure via CSV ExportSnipe-IT before 8.7....

• CVE-2026-65812 — Microsoft Teams for Android — CVSS 6.8 — Microsoft Teams for Android Vulnerability Exposes Sensitive Information

• fortinet-fortimonitoronsight-vulns — SecurityWeek

• 📄 Source for SpyCloud 2026 Identity Threat Report: Non-human identities now the leading enterprise attack path — spycloud.com