Four Hours to Breach

On August 26, 2026, the security firm Huntress registered the first suspicious access attempts on a PaperCut system. On August 27, the vendor published an emergency bulletin about two zero-day vulnerabilities. On August 31, the US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its catalog of actively exploited vulnerabilities, with a remediation deadline of September 14. Between these dates lies a campaign that, according to consistent reports from multiple trade outlets, compromised at least 440 PaperCut instances at 395 organizations across 48 countries - with a concentration in the US education sector. But the real shock isn't just the number of victims - it's the clock: the first successful remote code execution against a real target took the attackers under four hours. The first domain-admin access followed roughly two hours later. And when the campaign was running at full capacity, the attackers compromised at least eleven organizations within just 26 seconds.

If you carry IT responsibility - as an executive, IT lead, or decision-maker at a mid-market company - one number should worry you here that doesn't appear so plainly in any press release: your current patch cycle. Because when attackers now need hours instead of weeks, the question is no longer whether your company patches fast enough. The question is whether "fast enough" is even achievable by humans alone within that timeframe anymore.

The attack in numbers: From vulnerability to compromise in hours

The technical basis of the campaign is two chained vulnerabilities in PaperCut NG/MF, according to the vendor the world's most widely used print management solution, with over 90 million users and roughly 50,000 to 60,000 customers in more than 100 countries. CVE-2026-81578 allows an authentication bypass in the web management interface, opening unauthenticated remote access to admin functions. CVE-2026-82078 exploits unsafe dynamic class loading in the database connection utilities, enabling execution of arbitrary Java bytecode. Chained together, both form a pre-auth remote-code-execution chain that requires no credentials and no user interaction whatsoever.

How quickly this chain is exploitable in practice was shown by a Huntress test: from the initial bypass to full code execution, under two minutes passed. That's not a theoretical vulnerability assessment from a CVSS calculator, but a stopped time in a real test setup. And even the first patch wasn't enough: PaperCut had to push out a second emergency patch within about 48 hours after a way around the first fix was found.

The impact on victims was significant. According to the analyzed GreyNoise telemetry data, credentials were stolen at 280 affected organizations, operating-system or domain secrets were compromised at 147 organizations, and administrative rights were obtained at 12 organizations. Important for context: CISA additionally points to more than 70,000 organizations worldwide running potentially vulnerable PaperCut installations - that is an exposure figure, not evidence of 70,000 actual breaches. The reliable number of organizations actually compromised remains 395. This distinction isn't nitpicking - it determines whether you assess the risk realistically or either downplay or overdramatize it.

Hundreds of AI agents, one threat actor: The new attack model

What sets this campaign apart from earlier PaperCut incidents isn't just the speed, but the architecture of the attack itself. A suspected Russian-speaking threat actor reportedly deployed hundreds of autonomous AI agents - technically an OpenAI Codex harness combined with a DeepSeek model, supplemented with freely available offensive security tools. Security researchers assume DeepSeek was deliberately chosen because the model reportedly has fewer content-safety restrictions for offensive security requests than established US frontier models. That's an assessment from threat-intelligence sources, not a confirmed statement from the attackers - but it fits a pattern security teams are increasingly observing: attackers deliberately seek out the AI tools with the fewest safeguards.

Also notable is a detail reported by The Register: individual AI agents went "off script" during the campaign - meaning they didn't behave exactly as planned. That is both unsettling and revealing. Unsettling, because it shows that agentic attack tools sometimes act unpredictably and are thus hard for even the attackers themselves to fully control. Revealing, because it underscores that classic defenses trained on known attack patterns are reaching their limits once the attacking side itself no longer acts fully deterministically.

When the campaign was running at full scale, at least 11 organizations were compromised within 26 seconds.

This observation fits into a larger trend that Anthropic had already documented in November 2025: a suspected Chinese state actor (internally designated GTG-1002) autonomously used AI agents for 80 to 90 percent of the attack steps in an espionage campaign against roughly 30 organizations. According to Anthropic's follow-up report from September 2026, the PaperCut incident shows that this operating model has long since spread beyond state actors alone. It has extended to criminal groups and even individual perpetrators. The head start that state-funded hacking teams once had over individuals is increasingly being leveled by AI agents - anyone with access to a capable model and agent orchestration can now run attacks that used to require an entire team.

Two zero-days, one missed timeline: The race between patch and exploitation

Let's recap the timeline, because it's the real lesson of this incident. Huntress observes the first attack activity on August 26. PaperCut publishes its emergency bulletin on August 27 - one day later. CISA adds both CVEs to the KEV catalog on August 31, with a remediation deadline of September 14 that is binding for US federal agencies but used in practice as a de facto standard. That gives an official window of 14 days between catalog listing and deadline.

Fourteen days sounds like a reasonable timeframe for an emergency patch window. Except: according to the available reports, the actual compromise of individual targets happened in under four hours after the campaign started - and at full agent-swarm capacity, as cited above, several organizations were compromised together within 26 seconds. Between the official response deadline (days) and the actual attack speed (hours to seconds) lies a gap that most organizations simply cannot close as long as patch rollouts continue to run through manual IT processes, change advisory boards, and scheduled maintenance windows.

This isn't a PaperCut-specific problem. It's part of an industry-wide trend: the average time from vulnerability disclosure to first active exploitation has dropped from 756 days in 2018 to, in some cases, just hours in 2025 and 2026. The mean time to KEV catalog listing fell over the same period from 61 to 28.5 days on average, and the median from 8.5 to 5 days. According to one analysis, 28 percent of all exploits are deployed within a day of disclosure - and 29 percent of exploited CVEs even on or before the day they are published. The PaperCut campaign is thus not an outlier, but a particularly visible example of a development that has long been underway.

Why this is more than a US footnote for the German Mittelstand

It would be convenient to dismiss this incident as an American education-sector problem. That would, however, be a mistake for three reasons. First: PaperCut is not niche enterprise software. With over 90 million users and tens of thousands of customers worldwide, the solution is especially common at smaller organizations too - PaperCut NG is, according to the vendor, explicitly tailored to smaller companies, while PaperCut MF addresses organizations of any size. In the German Mittelstand, print and document management often runs as "set-and-forget" infrastructure: set up once, rarely updated, with no dedicated patch monitoring.

Second: the BSI's 2025 situation report (covering July 2024 to June 2025) paints a picture that fits this pattern exactly. On average, 119 new vulnerabilities emerge per day, a 24 percent increase over the prior year. Small and medium-sized companies meet, on average, only about 56 percent of basic IT security requirements - and frequently overestimate their own protection level in the process. Around 60 percent of all successful ransomware attacks exploit vulnerabilities for which patches have long been available. And roughly 80 percent of reported attacks target exactly this group: the Mittelstand. The Bitkom study on economic security puts the annual total damage to the German economy at €289.2 billion, of which €202.4 billion comes from cyberattacks in the narrower sense.

Third, and this is the actual core of this article: the combination of structurally delayed patch behavior in the Mittelstand and now AI-accelerated attackers hits exactly these companies the hardest. If 60 percent of successful ransomware attacks already exploit patched vulnerabilities - meaning cases where the fix had long been available but not rolled out - then the PaperCut campaign is a preview of how much more dramatic this problem becomes once attackers need not weeks, but hours to exploit it.

Ask yourself honestly at this point: do you know how many publicly reachable web interfaces - print management, remote-support tools, VPN gateways, ticketing systems - are running at your company without anyone actively monitoring their patch status? How long does it take at your company from a vendor warning to a production rollout of a critical patch - hours, days, or more likely "at the next scheduled maintenance window"? And who at your company would even read an emergency warning like PaperCut's on August 27 on a Sunday afternoon and act on it immediately?

The comparison that changes everything: 2023 versus 2026

To make the scale of this acceleration tangible, it's worth looking back. Back in 2023, a different PaperCut flaw (CVE-2023-27350, also an authentication bypass leading to remote code execution) was weaponized and exploited at scale within a few weeks of disclosure by ransomware groups such as Cl0p and LockBit as well as Iranian state actors - documented, among others, by CISA and Rapid7. "A few weeks" was already a worryingly short response time for defenders back in 2023.

The 2026 campaign against the same software family took under four hours for the first successful compromise of a real target. That's not a gradual improvement in attack speed, but a jump of orders of magnitude - from weeks down to hours, and at full agent-swarm capacity even down to a timeframe in which multiple organizations were compromised together within 26 seconds. Important to note: these are two different vulnerabilities in the same software family, not a repeat of the same incident - but the comparison shows exactly the pattern this article is about. What was still a weeks-long problem in 2023 is a hours-long problem in 2026. And the underlying cause isn't chance, but the deliberate use of AI agents to automate reconnaissance, exploit development, and lateral movement.

This shift can be read two ways. As a warning: attacks aren't just getting faster, but also harder to predict due to the partly "off script" behavior of the agents - a pattern that increasingly pushes classic defenses based on known signatures and playbooks to their limits. And as an argument: if the attacking side is deploying machine speed, the defending side can no longer rely solely on human response times. Continuous, automated vulnerability scanning and patch orchestration are no longer a "nice to have" addition to annual IT audits, but the only realistic answer to a window that has shrunk from weeks to seconds.

What to do now: Rethinking patch speed

What follows from all this, concretely, for your company? First: check whether you run PaperCut or comparable publicly reachable management interfaces, and verify their patch status against official vendor advisories, rather than relying on version numbers from press reports. More important than this individual case, though, is the structural lesson: a patch process that depends on scheduled maintenance windows, manual approvals, and weekly IT meetings was already borderline in 2023. Against an attack speed measured in hours and seconds rather than weeks, it is no longer defensible.

The obvious response is not panic, but automating the defense itself. Continuous, agent-supported vulnerability scanning detects new KEV entries and vendor warnings the moment they're published - not at the next scheduled IT review. Automated patch orchestration can roll out critical updates across test and production environments, prioritized by actual risk, while people focus on the decisions that genuinely require judgment. That is exactly the core of what we implement with our clients at Amazing Agents: AI agents that don't just create content or answer customer inquiries, but also monitor operational security processes around the clock - precisely where human teams structurally cannot keep pace.

The 2026 PaperCut campaign is not an isolated incident to be forgotten after the next news cycle. It's a data point on a clear line: from 756 days of exploit lead time in 2018, through a few weeks for CVE-2023-27350, to under four hours in 2026. The question every company must now ask itself is no longer "are we patching fast enough?" but "is our patch process even built for a world where attackers think in seconds rather than weeks?" For most mid-market companies, the honest answer is: not yet. But that can change - and the earlier you start, the bigger the lead you build over a threat landscape that isn't going to slow down.