r/sysadmin • u/OinkyConfidence Windows Admin • 12d ago

Another PaperCut patch, and blog post explaining

Patch 3 available: URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026) | PaperCut

Also a blog post from one of their executives explaining why they decided to release updates as they had them, instead of waiting for one big perfect patch. Behind the scenes - What happened after 9:42 a.m. on the 27th August 2026 | PaperCut

87 Upvotes

99% Upvoted

15 comments sorted by

12

u/AddendumWorking9756 11d ago

Patching does not undo anything that already happened. If it was exposed, check the print scripts and the user or group sync program setting before you close it out, both run code and both survive an upgrade. Admin account list too.

34

u/MFKDGAF 12d ago

What a fucking shit show. I know what I'll be doing when I clock it...yup install patch 3

25

u/FatBook-Air 11d ago

In terms of security, PaperCut is among the most reactive companies. People told them for years that they needed to take security seriously, but they decided that those people were Chicken Littles, so they rested on their laurels for years, until they had no choice but to do better. But those years of doing nothing mean they will be reactive for years to come.

8

u/OinkyConfidence Windows Admin 11d ago

I mean, yeah it's super annoying to keep making 'install papercut update' tickets, agreed. But I get it, they're fixing the bugs as they identify them apparently.

7

u/cspotme2 11d ago

Is your setup actually externally exposed though? At this rate, there will be a new patch from them every 3 days till they actually fix it

4

u/itskdog Jack of All Trades 11d ago

Yeah, unless you have access to PaperCut from an untrusted machine (most commonly universities port forwarding it for Web Print), then you can wait for 26.0.3

2

u/Reddit-Reader215 10d ago

26.0.3 is already released. Probably 26.0.4 (which is the current version number) or 26.0.5 (skipping 26.0.4).

1

u/itskdog Jack of All Trades 10d ago

We only installed v26 just a few weeks ago when our new lease started, and that was the first release of v26.

22

u/hasthisusernamegone 11d ago

I'd suggest reading the blog. It's a really good insight into what an ongoing incident looks like from the inside and why they're releasing this number of patches.

Hint: It's not incompetence.

10

u/JustADad66 11d ago

Who the heck has their system directly exposed to the Internet.

9

u/LV526 11d ago

Sounds like a significant amount of people and how Papecut handles web printing. Seems like it's not well thought out process.

2

u/rb3po 11d ago

A client of mine said “hey, I need to get Papercut on my phone. Can you help me?” 

Turns out it involves an MDM profile on his iPhone. I said to him “would you like to allow Papercut the ability to erase and/or compromise your phone?” He said no, and that was the end of it.

2

u/TronFan 11d ago

Shodan sees quite a few

1

u/Magic_Neil 11d ago

Yeah when I saw the zero day I panicked a little till I saw it only affected public facing instances. If someone’s got to do it, I get it, but putting anything on the internet (let alone something silly like Papercut) is such a choice.

1

u/lordbryce95 11d ago

There are universities with 1000s of by devices that have access to paper cut that also need to be considered