PaperCut Under Active Attack: Two CVEs, One Failed Patch

CISA confirmed on 31 August that two vulnerabilities in PaperCut NG and MF print management software are being actively exploited in the wild. CVE-2026-81578 allows unauthenticated remote attackers to bypass authentication and access admin functions, whilst CVE-2026-82078 enables arbitrary code execution once inside. The vulnerabilities are designed to be chained together, and the initial emergency patch issued by PaperCut was broken by security researchers within days, forcing a second fix. For UK small businesses running PaperCut, this warrants same-day action: confirm your version, verify the second patch has been applied, and restrict internet-facing admin panels to internal network access only. The episode also covers Manic, a new Android banking trojan that exfiltrates credentials through peer-to-peer relay without requiring a direct internet connection, raising questions about SMS-based two-factor authentication on personal devices used for business access. Practical steps include checking your mobile device policy and migrating from SMS codes to authenticator apps where feasible.

Chapters

• Introduction Corrine opens with breaking news: CISA has confirmed active exploitation of two PaperCut vulnerabilities, and the initial patch has already failed. The episode also previews coverage of Manic, a new Android banking trojan with offline credential exfiltration capabilities.
• PaperCut Actively Exploited: Two CVEs, One Very Messy Patch Detailed breakdown of CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection enabling code execution), how they chain together, why the first patch failed, and specific steps for UK small businesses to verify patch status, restrict internet-facing access, and contact MSPs in writing for confirmation.
• Call to Action Corrine encourages listeners to follow, rate, review, and share the show with others who need actionable cybersecurity intelligence.
• Manic Android Trojan: Banking Credentials Without a Connection Analysis of the Manic banking trojan, which harvests credentials and SMS two-factor authentication codes through a transparent keyboard overlay and exfiltrates data via peer-to-peer relay through other infected devices. Corrine recommends reviewing mobile device policies and migrating from SMS codes to authenticator apps for business-critical systems.
• Closing Summary Corrine summarises the two stories, reiterates the need for same-day PaperCut patch verification, and recommends one specific action: sending an email to your IT contact or MSP asking for current version and patch confirmation.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.papercut.com/kb/Main/Security-Bulletin-August-2026