{"uuid": "5811b843-5143-47e6-8535-4d085baf5ee7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81578", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/117258905363792667", "content": "We shared a one-off share of over 400 compromised PaperCut NG/MF instances (via CVE-2026-81578/CVE-2026-82078) observed by @greynoise.  IP data in our Compromised Website reporting for 2026-09-11, tagged  'papercut-compromise'.\nDashboard Tree Map stats: https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=other_value&day=2026-09-11&source=compromised_iot&source=compromised_website&source=compromised_website6&tag=papercut-compromise&data_set=count&scale=log&auto_update=on\nCompromised Website Report: https://www.shadowserver.org/what-we-do/network-reporting/compromised-website-report/\nThank you to @greynoise for the share! Background with info about the AI-orchestrated campaign behind the compromises (includes IOCs): https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf", "creation_timestamp": "2026-09-12T16:01:44.290260Z"}