Episode Details

A Melbourne software company, a print server, and three emergency patches in six days.

The company. PaperCut Software International, founded 1998 by Chris Dance and Matt Doran, headquartered in Melbourne with offices in Portland and London. Privately held, still founder-led. PaperCut's own figure: around 100 million users across more than 70,000 organisations.

The timeline. 27 August, 9:42am AEST — an education-sector customer reports a compromised PaperCut MF server; a second organisation reports similar activity at 5:05pm, and its logs allow the full chain to be reconstructed. PaperCut declares a P0 and publishes an advisory deliberately stripped of technical detail. 28 August, 2:10am — Emergency Patch Release 1 for versions 25 and 26; version 24 later that day; CVEs assigned; Emergency Patch Release 2 the same day after watchTowr and Huntress bypass the first fix. 29 August — Defused honeypots see the attacks pivot to database-table dumping. 31 August — both CVEs added to the CISA Known Exploited Vulnerabilities catalogue with a 14 September federal deadline; a Metasploit module is published. 1 September — Emergency Patch Release 3, fixing two regressions and adding hardening. Install it even if you patched earlier.

The vulnerabilities. CVE-2026-81578, authentication bypass in the web management interface (CWE-306), 8.8 High under CVSS v4.0. CVE-2026-82078, unsafe dynamic class loading in the database connector (CWE-470), 9.4 Critical under CVSS v4.0. Chained, they give unauthenticated remote code execution: an Apache Tapestry routing quirk lets an attacker display a public page while invoking an admin component, rewrite the external user-lookup settings, and abuse the bundled Apache Derby driver to reach an attacker-controlled H2 database whose initialisation parameter creates a JavaScript-backed trigger that spawns a process.

What is not known. No attribution by anyone — not PaperCut, not Huntress, not watchTowr, not CISA. No ransomware gang has claimed it. No victim count, record count or data-category list has been published. Shadowserver tracked 800+ internet-exposed servers as at 1 September; that is an exposure count, not a compromise count.

What to do. Patch to Emergency Patch Release 3. Assume compromise if the server was internet-facing and unpatched after 26 August — patching does not evict an existing intruder. Hunt PaperCut's indicators: suspicious activity from pc-app.exe, missing or truncated server.log, and the "no suitable driver found for jdbc:no:x" and "Database error looking up cardID" errors. There are no published network indicators. Then ask why a print server was internet-facing at all.

Also timely: the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, released for consultation around 1 September, proposes a hard 72-hour notification deadline to the Information Commissioner.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: PaperCut security bulletin and Chris Dance's incident blog; Rapid7; BleepingComputer; Cyber Daily; SecurityWeek; CISA Known Exploited Vulnerabilities catalogue; iTnews.