r/sysadmin • u/OinkyConfidence Windows Admin • 21h ago

Another PaperCut patch, and blog post explaining

Patch 3 available: URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026) | PaperCut

Also a blog post from one of their executives explaining why they decided to release updates as they had them, instead of waiting for one big perfect patch. Behind the scenes - What happened after 9:42 a.m. on the 27th August 2026 | PaperCut

81 Upvotes

99% Upvoted

12 comments sorted by

•

u/AddendumWorking9756 16h ago

Patching does not undo anything that already happened. If it was exposed, check the print scripts and the user or group sync program setting before you close it out, both run code and both survive an upgrade. Admin account list too.

•

u/MFKDGAF 21h ago

What a fucking shit show. I know what I'll be doing when I clock it...yup install patch 3

•

u/FatBook-Air 20h ago

In terms of security, PaperCut is among the most reactive companies. People told them for years that they needed to take security seriously, but they decided that those people were Chicken Littles, so they rested on their laurels for years, until they had no choice but to do better. But those years of doing nothing mean they will be reactive for years to come.

•

u/OinkyConfidence Windows Admin 21h ago

I mean, yeah it's super annoying to keep making 'install papercut update' tickets, agreed. But I get it, they're fixing the bugs as they identify them apparently.

•

u/cspotme2 19h ago

Is your setup actually externally exposed though? At this rate, there will be a new patch from them every 3 days till they actually fix it

•

u/itskdog Jack of All Trades 18h ago

Yeah, unless you have access to PaperCut from an untrusted machine (most commonly universities port forwarding it for Web Print), then you can wait for 26.0.3

•

u/hasthisusernamegone 19h ago

I'd suggest reading the blog. It's a really good insight into what an ongoing incident looks like from the inside and why they're releasing this number of patches.

Hint: It's not incompetence.

•

u/JustADad66 17h ago

Who the heck has their system directly exposed to the Internet.

•

u/LV526 16h ago

Sounds like a significant amount of people and how Papecut handles web printing. Seems like it's not well thought out process.

•

u/rb3po 16h ago

A client of mine said “hey, I need to get Papercut on my phone. Can you help me?” 

Turns out it involves an MDM profile on his iPhone. I said to him “would you like to allow Papercut the ability to erase and/or compromise your phone?” He said no, and that was the end of it.

•

u/TronFan 10h ago

Shodan sees quite a few

•

u/Magic_Neil 4h ago

Yeah when I saw the zero day I panicked a little till I saw it only affected public facing instances. If someone’s got to do it, I get it, but putting anything on the internet (let alone something silly like Papercut) is such a choice.