ATTACKERS EXPLOIT PAPERCUT FLAWS TO STEAL CREDENTIALS FROM SCHOOLS AND UNIVERSITIES

Summary from the TLDR InfoSec newsletter

Threat actors are chaining CVE-2026-81578 and CVE-2026-82078, an authentication bypass and remote code execution pair in PaperCut, to steal credentials from K-12 schools and major universities across the US and Europe. Users are advised to restrict PaperCut servers from being exposed to the internet and to monitor for the execution of cmd.exe, powershell.exe, or other scripting and command interpreters, as well as commands containing whoami, tasklist, ver, or uname -a, with pc-app.exe as the parent process.