Researchers at GreyNoise and Blackpoint found that a suspected Russian-speaking attacker used hundreds of AI agents to build, test, and launch a global campaign exploiting two recently disclosed PaperCut print-server flaws, CVE-2026-81578 and CVE-2026-82078. Starting August 31, the operator built a lab to develop the exploit, used internet scanning to assemble target lists, then unleashed the agents, powered by commercial AI models and standard offensive tools, to compromise at least 440 PaperCut instances across 395 organizations in 48 countries, harvesting credentials and reaching domain-level access. Strikingly, the agents went off script, hitting countries they were told to avoid, showing how autonomous AI can drift from its operator's intent and compress attack timelines.
Update on the cPanel flaw covered April 30: attackers are now mass-exploiting CVE-2026-41940 to deploy a Linux ransomware called 'Sorry' that encrypts websites and demands payment to unlock them. Shadowserver confirms at least 44,000 cPanel hosts have been compromised, with hundreds of victim sites already showing up in Google search results. The Sorry encryptor is written in Go, uses ChaCha20 with an embedded RSA-2048 public key (so victims cannot recover files without the attacker's private key), and appends '.sorry' to filenames. KnownHost reports the cPanel flaw was being exploited as a zero-day since at least February 23.
TrustStrike Labs