What is confirmed
PaperCut reports confirmed customer incidents and recommends maintenance versions 26.0.5, 25.0.13 or 24.1.10 for the relevant branch.
The French health CERT cites a 9 September tally of at least 440 compromised servers across 395 organisations in 48 countries, 31 in France. It is a security vendor's tally, not an exhaustive census.
What it means
The vendor describes flaws in administration access control and database connector class loading. In some environments these can be chained.
A public URL checker can surface reputation signals but cannot inventory your PaperCut servers or prove an internal system was not compromised.
What to do
Inventory exposed NG/MF instances, compare versions against the PaperCut bulletin and install the relevant maintenance release.
Restrict administration access and review the vendor's logs and indicators of compromise. Have a security team examine suspected servers.
Use the related SecurCheck tool, then confirm important decisions with an official source.
