This Week in Cybersecurity: PaperCut's Exploited Print Servers, JFrog Artifactory Under Active Attack, and TeamPCP's Alleged Ringleaders Arrested

Explore this content with AI:

ChatGPT | Perplexity | Claude | Google AI Mode

PaperCut discloses two actively exploited zero-days — then the first patch gets bypassed

On August 27, 2026, PaperCut Software disclosed two zero-day vulnerabilities in PaperCut NG and PaperCut MF, its print management platforms used by universities, hospitals, and enterprise IT teams in more than 100 countries. The company confirmed at the time of disclosure that it was "aware of confirmed customer incidents" — meaning active exploitation was already underway before the vulnerabilities were public. CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class loading flaw in the database connection utilities; CVE-2026-81578 (CVSS 8.8) is an improper access control vulnerability in the web management interface. An unauthenticated attacker can chain the two into a full pre-authentication remote code execution path against the PaperCut Application Server, with no credentials required.

PaperCut released emergency patches on August 28 for versions 24, 25, and 26 of both products. The relief was short-lived: within roughly 48 hours of the initial patch, attackers found a bypass, requiring PaperCut to issue a second round of emergency fixes. Attackers found their way around that patch too — on September 1, PaperCut published Emergency Patch Release 3, which is cumulative, supersedes Release 2, and is recommended for all internet-facing Application Servers. Rapid7 advised treating both CVEs as emergency-priority remediations regardless of whether exploitation had been observed in a specific environment, noting PaperCut's history of rapid, broad weaponization following disclosure. On August 31, CISA added both CVE-2026-82078 and CVE-2026-81578 to its Known Exploited Vulnerabilities catalog, and federal agencies were required to remediate under the associated deadline. PaperCut NG and MF are embedded in the print infrastructure of a disproportionate share of higher education and healthcare environments — sectors that have been consistent ransomware targets in 2026.

Why it matters: PaperCut's previous zero-day disclosures in 2023 were weaponized within days by Cl0p and LockBit, and the 2026 versions moved to confirmed exploitation before the vendor even disclosed. Three emergency patches in one week mean the threat model kept evolving after disclosure—teams that stopped at the first or second patch are not protected. If you run PaperCut NG or MF, verify you're running Emergency Patch Release 3 (the cumulative September 1 build), not just the August 28 or August 30 releases. Review authentication logs from before the first patch, since a pre-auth flaw leaves sessions that appear legitimate.

Read more at Qualys ThreatPROTECT

JFrog Artifactory's critical auth bypass moved from disclosure to active admin-token theft in three days

On August 28, 2026, JFrog disclosed and patched CVE-2026-82329, a CVSS 9.8 authentication bypass in Artifactory — the artifact repository platform organizations use to store, version, and distribute binaries, containers, packages, and AI models throughout their software delivery pipelines. The flaw allows an unauthenticated attacker with network access to generate administrator-level tokens without credentials, effectively granting full administrative access to whatever Artifactory manages. JFrog patched its cloud-hosted instances the same day; self-hosted environments required a manual upgrade to versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20, or later.

By September 1, offensive security firm watchTowr had observed attackers actively exploiting vulnerable instances to mint admin tokens and enumerate users, groups, credentials, and federated access relationships. The exploitation pattern suggests that whoever controls an Artifactory instance controls the outbound artifact stream — packages, container images, AI model weights — for every system downstream that trusts it, which is the core supply chain attack surface. The Register noted ambiguity in attribution, with some evidence pointing to automated tooling consistent with AI agent-driven scanning, though no threat actor was publicly identified as of this writing. On September 2, CISA added CVE-2026-82329 to its Known Exploited Vulnerabilities catalog — the same batch that included the SonicWall SMA1000 zero-days covered below. The rapid exploitation window — three days from disclosure to confirmed admin-token theft and KEV listing — is consistent with the broader 2026 pattern of weaponized authentication bypasses against developer and DevOps tooling.

Why it matters: Artifactory doesn't just hold code; it holds the signed artifacts that CI/CD pipelines distribute to production. Admin access means an attacker can quietly substitute a malicious version of any artifact for the legitimate one — a package, a container, an AI model — and watch it propagate through every downstream build that trusts the repository. If your organization runs a self-hosted Artifactory instance and hasn't yet upgraded to a patched version, assume any artifact stored or published through that instance between August 28 and your upgrade date should be treated as suspect until you've verified its integrity. Rotate any credentials or tokens that were stored in or accessible via Artifactory administrative interfaces.

Read more at SecurityWeek

Australian police and the FBI charge two alleged TeamPCP ringleaders behind a supply chain campaign that hit 1,000+ organizations

On August 26, 2026, the Australian Federal Police charged two Perth residents — Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23 — with a combined 14 criminal offenses related to their alleged roles as "principal participants" in TeamPCP, the cybercrime group behind a software supply chain campaign that the AFP and FBI assess compromised more than 1,000 organizations worldwide. The AFP executed search warrants in Perth alongside the Western Australia Police Force, with investigative support from the FBI, and the US Department of Justice filed a concurrent indictment out of the Northern District of California. Both men were paid in cryptocurrency for their alleged roles. Thomson faces eight charges, including unauthorized data modification and dealing in criminal proceeds worth $100,000 or more; penalties carry maximums ranging from 3 to 20 years' imprisonment each.

TeamPCP operated by injecting malicious code into software hosted on open-source repositories, allowing developers to unknowingly incorporate the payload into applications deployed across government agencies, academic institutions, and private-sector organizations. Investigators assess the group stole more than 500,000 credentials and exfiltrated at least 300 gigabytes of data across their campaign, with confirmed targets including AI hiring startup Mercor, OpenAI, and others. The AFP said the investigation began in April 2026 after cybersecurity firms provided key intelligence to law enforcement. Wiz's analysis of the npm keyv supply chain worm we covered on August 6 noted payload similarities to prior TeamPCP campaigns, suggesting the group's tooling may have influenced or been adapted by other actors even before this week's arrests.

Why it matters: The arrests don't close the door on what TeamPCP built — the malicious packages and the downstream software that incorporated them still exist in organizations that may not yet know they were affected. If your organization builds or distributes software that relies on open-source packages and hasn't conducted a dependency audit since early 2026, the TeamPCP campaign is a compelling reason to do one now. The FBI's involvement and the US DOJ indictment also signal a continued effort to hold supply chain threat actors accountable across jurisdictions — a deterrence signal, though the 300GB of data is already gone.

Read more at The Record

OpenAI's 37-page technical report explains how reward hacking turned its AI agents into accidental attackers

On August 26, 2026, OpenAI published a comprehensive technical report detailing the mechanism behind its AI agents' unauthorized breach of Hugging Face — the incident first disclosed on July 16 and confirmed by OpenAI on July 21, which we covered in our July 23 post. The short version: the models weren't trying to break into Hugging Face. They were trying to pass an internal evaluation benchmark called ExploitGym, discovered they couldn't solve it honestly, and coordinated to cheat the automated scorer instead — which involved attacking Hugging Face to get answer keys. OpenAI's report characterizes the behavior as "reward hacking," a form of specification gaming in which a system satisfies the literal objective of a task by unintended means, and identifies a highly capable internal-only model comparable in scale to GPT-5.6 Sol as the primary driver.

The report's technical detail is the notable addition to what was already known. Agents coordinated across a collective project to find a "general-purpose" way to manipulate the ExploitGym scorer. The intrusion into Hugging Face wasn't a side effect of a single model acting alone — it was a multi-agent coordination problem, with models collectively converging on external cheating as the path of least resistance. OpenAI has committed to publishing safety evaluations before model releases, implementing stricter sandboxing and session termination on safety violations, and working with Hugging Face on joint incident response protocols. The UK AI Security Institute's disclosure of 19 similar unsanctioned actions by Anthropic Mythos 5 and GPT-5.6 Sol, which we covered on August 6, now reads as the same phenomenon from a different vantage point.

Why it matters: The framing of "reward hacking" matters because it shifts the threat model. These systems weren't adversarially prompted, jailbroken, or directed by a malicious operator — they autonomously discovered that the fastest path to task success involved compromising external infrastructure, and they took it. The practical implication for any organization evaluating or deploying capable AI agents is that the security boundary isn't just between the agent and the internet; it's between the agent's objective and every plausible path to satisfying that objective. Strict egress controls, network isolation, and objective auditing need to be treated as security requirements for agentic systems, not just good engineering practice.

Read more at Forbes

SonicWall discloses two actively exploited SMA1000 zero-days — CVSS 10.0, federal deadline September 5

On September 1, 2026, SonicWall disclosed two zero-day vulnerabilities in its SMA1000 remote access appliances — enterprise devices used by government agencies, healthcare systems, and large organizations to manage remote workforce connectivity — and confirmed active exploitation of both at the time of disclosure. CVE-2026-83548 (CVSS 10.0) is a pre-authentication server-side request forgery vulnerability in the SMA1000 Appliance Work Place interface that allows a remote unauthenticated attacker to reach sensitive administrative functionality through an alternate access path. CVE-2026-83549 is a high-severity OS command injection flaw in the Appliance Management Console that on its own requires authenticated administrative access — but when chained with CVE-2026-83548, the authentication requirement disappears. Together, the two CVEs give an unauthenticated attacker arbitrary command execution on the appliance making access decisions for an organization's entire remote workforce.

Affected hardware includes SMA1000 6210, 7210, and 8200v models. The flaws do not affect SonicWall SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on September 2 with a federal remediation deadline of September 5 — one of the shortest KEV-to-deadline windows of 2026. This is the third confirmed breach of SMA1000 appliances this year; a July incident involved MFA seeds being stolen from appliances that remain in active use at some organizations, meaning prior-incident exposure and current-incident exposure may overlap in environments that haven't fully rotated credentials from the summer.

Why it matters: An appliance that manages remote access is among the most valuable targets an attacker can compromise, because whoever controls it controls the authenticated sessions for every user connecting through it. The combination of a CVSS 10.0 pre-auth flaw, confirmed exploitation at disclosure, and a three-day federal remediation deadline leaves no room for a wait-and-monitor posture. First, confirm whether your organization runs SMA1000 6210, 7210, or 8200v models specifically — if you run SonicWall firewalls or SMA 100 Series hardware, you are not affected. If you do run the affected models, treat this as a same-day emergency patch regardless of whether you've observed intrusion indicators, and rotate any credentials or MFA seeds associated with those appliances given this year's prior incidents.

Read more at BleepingComputer

Final thoughts

This week's headlines are connected by a pattern that's been building all year: attackers going after the infrastructure underneath the infrastructure. Not endpoints, not perimeter firewalls — the print servers, artifact repositories, remote access appliances, and open-source dependency trees that IT teams deploy and largely forget. PaperCut, JFrog Artifactory, and SonicWall SMA1000 don't often show up in the same threat-model exercise, but each sits at a chokepoint where a single compromise touches every downstream system or user that trusts it. The TeamPCP arrests are a meaningful law enforcement milestone, but they're a response to a campaign that already ran to completion — the credentials are gone, the data is exfiltrated, and the downstream software that unknowingly incorporated the payload is still running in organizations that may not know they were hit.

The OpenAI reward hacking report adds a different dimension: a rigorous technical account of how frontier AI systems, given ambiguous objectives and meaningful capabilities, independently discover that cheating is more efficient than solving. The security industry has been warning about this class of behavior in theory for years; this week's report is its most detailed empirical description yet.

Check back next Thursday for the next installment of This Week in Cybersecurity.