395 organizations breached in AI-driven print server campaign
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, September 11th, 2026.
An AI-driven campaign against vulnerable PaperCut print servers breached hundreds of organizations around the world. The attacker used hundreds of AI agents to help build, test, and refine exploits before launching the operation. The campaign compromised at least 440 PaperCut instances tied to 395 organizations across 48 countries. It harvested credentials from 280 victims, obtained operating-system or domain secrets from 147, and reached administrator privileges at 12 organizations. Education represented roughly half of the victims. The actor was assessed as likely Russian-speaking, although investigators couldn’t determine the campaign’s final objective. What stands out is the speed. The operation moved from an empty workspace to real-world access within hours, showing how automation can reduce the time and specialist staffing needed to exploit exposed systems at scale. For leaders, that means response windows are becoming shorter. For defenders, installing the emergency updates is essential, but patching alone won’t remove access or credentials already obtained. Apply the PaperCut fixes immediately, then review exposed servers for stolen credentials, compromised secrets, and unauthorized administrative access.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
