PaperCut Flaws Exploited at Scale in 2026, But Scan Counts Mislead on True Exposure

·6 views

Two critical vulnerabilities in PaperCut NG and MF print management software — CVE-2026-81578 (CVSS 9.8) and CVE-2026-82078 (CVSS 9.1) — were actively exploited in September 2026, enabling authentication bypass and remote code execution. Internet scan data from ZoomEye returned over 1.2 million results for PaperCut-related queries, but analysts warn these figures do not represent the actual count of vulnerable servers. The high numbers reflect how broadly the PaperCut name appears across web content, including pages that merely reference or link to the platform rather than host it. More precise queries, such as those targeting PaperCut NG specifically or the CVE identifier, returned zero results, exposing gaps in the scan index rather than confirming the absence of vulnerable systems. Security teams are advised to scope exposure through internal asset inventories, verify software versions against patched releases, and restrict public internet access to print management servers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds npm library to finally give designers full control over scrollbars

A developer and former UI/UX designer created an npm library called morphing-scroll in 2023 to address long-standing limitations in browser scrollbar customization. The project was inspired by years of frustration — first as a designer whose scrollbar concepts were rejected as technically impossible, then as a developer who experienced those constraints firsthand. Native browser scrollbars lack a unified standard across browsers and offer only minimal styling options, such as basic color changes and width presets. The library, built with JavaScript and React, aims to let developers replace the scrollbar thumb with any custom element, including animated or interactive ones. Inline styles were chosen to ship default styling reliably within the component itself.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Svelte 5 Runes Mirror React Hooks, Abandoning Framework's Original Magic

Svelte built its reputation on implicit reactivity, where a simple variable assignment like 'let count = 0' would automatically update the UI without any special syntax. Svelte 5, announced in September 2023 and stabilized in late 2024, replaced that approach with 'runes' — $state, $derived, and $effect — which closely parallel React's useState, useMemo, and useEffect hooks. The Svelte team, led by Rich Harris, justified the shift by citing scalability issues with the old reactive syntax and the need for reactivity to work outside .svelte files in plain JavaScript or TypeScript. The change delivered measurable benefits, including a reported 55% bundle size reduction in one real-world migration of a 147-component app. Critics argue, however, that Svelte has lost its defining identity by converging on the same explicit reactivity model it once positioned itself against.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Debug Log Flaw Exposes All User Passwords via Unsecured SIEM Dashboard

A security research exercise demonstrated how a forgotten debug statement in a web app's login route logged user passwords in plaintext on every authentication attempt. The logs were captured by an internal SIEM dashboard hosted at an unlisted but discoverable URL, reachable via standard directory enumeration tools like Gobuster. The SIEM console was protected only by default credentials, allowing anyone who found it to log in and read all captured passwords. Four distinct vulnerabilities enabled the attack: plaintext logging of sensitive fields, cleartext log storage, an exposed internal monitoring endpoint, and hardcoded default credentials. The findings highlight the need to redact sensitive data from logs, secure internal tools with proper credentials, and treat log files with the same care as production databases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Chief of Staff Runs Day-1 Solana Memecoin Pipeline, Flags Caution on First Lead

An AI system configured as a Chief of Staff completed its first end-to-end pipeline test, guiding a first-time Solana memecoin learner through a structured research and risk-assessment workflow. The pipeline routed a DexScreener discovery (DEXCAT) through three specialist roles — Researcher, Radar, and Risk — returning a CAUTION verdict and blocking any live funds due to thin liquidity, unverified holders, and a brand-new launch profile. The day-one retrospective identified key weaknesses, including cognitive overload from too many parallel workstreams, missing paper-trading mechanics before the first scan, and overly frequent status updates to the user. Scorecard ratings averaged 3.7 out of 5, with safety and refusal discipline scoring highest and token efficiency scoring lowest. The operator noted that future builds should begin with a single orchestrator, one specialist, a written refusal list, and a clear stop rule when the human operator feels overwhelmed.

0 comments Read more at DEV Community