PaperCut escalated one education customer's compromised MF server to a zero-day P0 by midday

Triage began with the ordinary question. PaperCut asked whether the education customer's server was fully patched, and looked at whether an attacker was using a vulnerability the vendor had already fixed in a later release ^[2]. The logs pointed to a different path and showed real code execution on the server ^[3]. That moved the working theory from n-day to zero-day in roughly two hours and eighteen minutes ^[18].

What the first customer handed over mattered because of how it was collected. Its intrusion-detection systems flagged the suspicious behaviour quickly and the affected virtual machine was isolated almost immediately, so logs and forensic evidence survived ^[7]. Those logs were thin: enough context to hint at an area of code that might be part of an exploit chain, which is what the engineering teams then tried to reproduce ^[5]. The second report arrived seven hours and twenty-three minutes after the first ^[17]. It came with additional logs and details, and with those PaperCut fingerprinted and reconstructed much more of the exploit chain and the attack ^[6].

The guidance to pull internet-facing Application Servers offline went out before any of that reconstruction was complete. "We assumed the worst and acted accordingly," wrote Chris, one of PaperCut's founders and its CEO ^[10][15]. The stated concern was other attackers reproducing the technique while potentially thousands of customers were still exposed ^[16].

The precedent PaperCut is working from is its own. "One of the biggest lessons from that incident was that the first attacker is not necessarily the biggest part of the problem," Chris wrote of 2023 ^[11]. In that round, once enough information about the n-day vulnerability became public, additional hacker groups moved in, including state-sponsored actors, and began exploiting exposed servers at scale ^[12].

What the account does not carry is the detail an administrator needs to scope the problem: no CVE identifier, no affected version numbers, no attacker attribution, and no count of compromised servers beyond the two customers who reported ^[19]. "This is not the full technical account. The incident is still active, we are still investigating and hardening, and there may be further updates," Chris wrote ^[13]. The company says it will publish a technical retrospective once the incident settles, as it did after 2023 ^[14].