Hackers Deploy Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers

My take: What GreyNoise and cybersecurity firms documented this week shows how far attack automation has come: one actor used hundreds of AI agents to compromise 440 PaperCut servers across 395 organizations and 48 countries. At its peak, the campaign hit 11 organizations in just 26 seconds. A U.S. school went from initial access to full domain admin control in seven minutes.

The lesson here is not to panic, but to take note of the change in speed. The attack cycle that used to take days is now measured in minutes. For any IT team or business owner, that means patches and system visibility can no longer wait for the next maintenance cycle.

If you run PaperCut NG/MF in your organization, vulnerabilities CVE-2026-81578 and CVE-2026-82078 have patches available. When did you last check whether all your critical systems are up to date?