Actively Exploited PaperCut Zero-Days Trigger Basel Schools Print-System Shutdown

PaperCut released a second emergency patch for CVE-2026-81578 and CVE-2026-82078, two actively exploited zero-days that can be chained for pre-authentication remote code execution on Internet-exposed PaperCut NG and PaperCut MF servers. The release followed reports that attackers could bypass the initial fix; Huntress observed intrusions on 26 and 27 August in which threat actors rapidly deployed hex-encoded Java class files and conducted host reconnaissance. Supported PaperCut versions 24 through 26 have updates, while version 23 and earlier require a full upgrade.

Basel-Stadt schools detected unauthorized attempts to access their printing system during the night of 3 September despite having promptly applied vendor updates for the late-August vulnerability. The Education Department disconnected the system as a precaution, disrupting printing for about one school day; limited service resumed Friday, while broader restoration was planned for 7 September. Authorities reported no evidence of data theft, notified relevant cantonal bodies, opened an independent investigation and filed a criminal complaint; rather than restore the prior environment, they will fully rebuild it to reduce the risk of undetected malware.