Hackers used Codex and DeepSeek AI agents to breach 440 PaperCut servers, GreyNoise finds

#What happened

A cybercrime campaign used hundreds of AI agents to target internet-facing PaperCut NG and MF print-management servers, compromising at least 440 instances linked to 395 organizations in 48 countries, according to GreyNoise. The operator paired OpenAI's Codex coding-agent harness with a DeepSeek model and common security tools, developing and testing exploits in a self-hosted lab from August 31, 2026 before hitting real targets. GreyNoise says the operator reached a first real system in under four hours, gained domain administrator access two hours later, and compromised 11 organizations in 26 seconds once the wider operation began. The campaign centered on two PaperCut vulnerabilities: CVE-2026-81578 (unauthenticated requests that can change certain settings) and CVE-2026-82078 (an unsafe class-loading flaw enabling code execution). Analysts at Hunt.io later found the attacker's exposed workbench: project folders, target lists, exploit code, agent instructions that told the coding agent to keep testing and work in parallel, plus 45 targets with working reverse-SOCKS access and 46 Active Directory domains in the recovered victim packages. Compromised print servers were used to collect credentials and reach internal networks.

#Why it matters

This is a real-world attack campaign that weaponized agentic coding tools: the agent did iterative exploit development and parallel testing, not just a one-shot exploit run. PaperCut recommends upgrading to security maintenance releases 26.0.5, 25.0.13, or 24.1.10 and reviewing logs for unexpected accounts, privilege changes, credential collection, and Active Directory access. Verified October 17, 2026.

#Sources

• https://cybersecuritynews.com/breach-440-papercut-servers/