The Permanent Attack Surface: What PaperCut's Unpatchable 47% Teaches Us About Security Debt
Everyone is selling you a solution. No one is showing you the failure mode.
Last week, a security snapshot crossed my desk that got swallowed by the noise of a bull market: a two-step attack chain against PaperCut NG/MF, an enterprise print management system with an installed base measured in the tens of thousands. Huntress, the security vendor, examined roughly 2,500 installations in its telemetry. 47% of them are running versions that will never receive a patch. That number is not a footnote in the report. It is the report.
For someone who spends most of her days arguing about smart contracts, immutability, and the ethics of decentralized code, this is a strange story to dissect. Not because it involves cryptography or a ledger. But because it is the clearest example I have seen in years of a truth that we in the crypto world often choose to ignore: the permanent attack surface is not a blockchain exclusive. It is the default state of enterprise software that has been abandoned by its vendor.
Let me ground this in context. PaperCut NG and MF are on-premises, Java-based applications that organizations use to manage print quotas, track usage, and integrate with Active Directory. They run on Jetty, an embedded Java servlet container, and they connect to local databases and LDAP directories. Because they are on-premises, every installation is its own little universe. There is no cloud backend that can push a patch. The vendor can release a security fix, but the customer must find it, test it, and schedule a maintenance window. In a school district, a hospital, or a municipal office, that window may never come. That is the first structural weakness: the upgrade path is at the mercy of the customer's IT budget.
Then the vulnerabilities arrive. As reported, CVE-2026-81578 is a broken access control flaw with a CVSS score of 8.8. It lets an unauthenticated attacker bypass authentication by modifying the configuration through a management interface. CVE-2026-82078, with a CVSS score of 9.4, involves insecure dynamic class loading. The attacker, once authenticated or using the bypass, injects a specially crafted JDBC URL into the configuration settings. The application then loads and executes a remote Java class from that URL, delivering a payload encoded as a hexadecimal .class file. Two bugs, one chain, pre-auth remote code execution. I should note that the CVE numbers look off by a few years — the real PaperCut vulnerabilities from 2023 were CVE-2023-27350 and CVE-2023-27351 — but let us take the reported scenario at face value, because the pattern is what matters.
This is classic gadget-chain material. Anyone who has audited smart contracts will recognize the shape immediately. In Solidity, we call it an unvalidated external input in a low-level call. In Java, it is a JDBC URL that the management plane trusts. The root cause is not a typo in a line of code. It is a design anti-pattern: the application treats configuration data as code. Log4Shell did the same thing. MySQL JDBC autoDeserialize did the same thing. H2 INIT does the same thing. The pattern is timeless. And here, the management configuration panel, which is supposed to be protected by authentication, is the attack surface. The trust boundary between an authenticated user and a configuration value is hopelessly blurred.
From my audit experience, I can tell you that the most reputable security fixes fail not because the patch is sloppy, but because the architecture was already compromised at a deeper layer. The report confirms this. The emergency patch issued by PaperCut was quickly bypassed using a “Home page display” setting. So the patched system gave customers a false sense of security. They thought they had applied the remedy. What they actually had was a slightly more difficult entry point for the same structural flaw. A patch that can be sidestepped is not a patch; it is a placeholder.
The persistence mechanism is even more worrying. The attackers installed a memory-resident webshell as a Jetty servlet filter. This is not a file on disk. Your classic file-scanning EDR is looking in the wrong place. The webshell lives in the application’s memory, inside the Java virtual machine, and it executes with the privileges of the application server. When the server restarts, it may or may not survive, but the report suggests the attackers were also installing Remote Monitoring and Management tools — AnyDesk, SimpleHelp, and tunneling suites like suo5 — to ensure they could come back even after a reboot. They dumped the SAM database BootKey to grab local credentials. They collected domain credentials. They did all of this quietly, with the efficiency of a well-run operations team.
The report describes an attack pipeline with self-correcting capability. One implant failed. The operators debugged it. An hour later, they tried again and succeeded. That is not a random opportunistic scan. That is a professional operation. The combination of modules — authentication bypass, class loading injection, in-memory persistence, RMM abuse, credential dumping — is the hallmark of what cybersecurity researchers now call an Initial Access Broker, or a crime-as-a-service platform. In the blockchain world, we would call it a composable DeFi exploit: each piece is a module, and the stack is as strong as its weakest interface.
Now, let me take you to the contrarian angle. Because the headlines will say “PaperCut is vulnerable” or “Patch now.” But that is the pitch. The protocol, as we say in my world, is something much more uncomfortable.
The true exploitable vulnerability is not the CVE. It is the 47% of installations that will never be patched. PaperCut has declared version 23 and earlier to be end-of-life. No more security updates. No more backporting. That is a business decision, dressed in the language of “support policy.” And it transfers risk directly to the most defenseless customers: K-12 schools, universities, public health systems, small municipal governments. These are organizations with stretched IT teams, minimal security budgets, and compliance obligations under HIPAA, FERPA, and various national regulations. They are being told, in effect, “Upgrade or accept the risk.” But upgrading is not free. The software is deeply integrated with printer fleets, Active Directory domains, and accounting workflows. Migrating from an old version to a new one is a project, not a click. In a school district that is already behind on security staffing, the choice is between a costly upgrade project and a silent compliance violation. Most will choose the latter.
This is what I mean by security debt becoming a permanent attack surface. In blockchain, we debate whether an immutable smart contract is a liability or a strength. If there is a bug, you cannot fix it — that is the price of immutability. But here we have the same condition, not by design, but by neglect. The vendor can fix the code, but the customer cannot afford or cannot execute the fix. The result is a permanent vulnerability that will be exploited for years. The report calls it a “forever day.” I would call it a slow-motion security crisis.
And here is the uncomfortable parallel to the world I write about. Some will say, “This is exactly why we need decentralized, self-sovereign infrastructure.” But decentralization does not eliminate the patching problem; it amplifies it. In a decentralized network, every node operator is responsible for their own version. The protocol can release an upgrade, but if 47% of nodes refuse or fail to update, the network is still exposed. We saw this with the Ethereum Merge, not in a security context but in a coordination context. And we see it every day in the endless debate over whether to use upgradeable proxies or immutable contracts. Upgradeable proxies are a patch mechanism, but they are also a governance surface. Immutable contracts are clean, but unforgiving when a vulnerability is found. PaperCut is simply the centralized corporate version of the same dilemma. No matter the architecture, the human problem remains: somebody has to bear the cost of keeping the system safe.
Trust the protocol, not the pitch. The protocol here, the actual operational reality, is that enterprises running on-prem software cannot be patched with the speed of a modern, automated attack. The patch cadence of a software vendor is measured in weeks. The attack cadence of a crime-as-a-service operator is measured in hours. That mismatch is the fundamental reason why this incident matters. It is not about Print Management. It is about the economics of security responsibility.
Let me give you concrete recommendations, but not the typical listicle. You will not find a five-step “security checklist” here, because the problem is not a checklist problem. It is a mindset problem. For those customers stuck on unsupported versions, the immediate mitigation is network segmentation. Put the print server behind a dedicated VLAN. Control outbound internet access. Disable the management interface from non-admin networks. Actively monitor for new instances of AnyDesk or SimpleHelp being installed. These are compensating controls, and they are essential, but they are not a cure.
For the industry, the lesson is deeper. Software end-of-life policies need to change. In the blockchain space, we have a culture of rewarding pioneers who ship code and ship it fast. We call it “move fast and break things.” But the break is not always on the testnet. The break is often on a hospital domain. We need to build a culture where the end of support is a considered risk, not an afterthought. As an open-source evangelist, I have watched many projects declare 1.0 and then abandon an entire cohort of users. The silence that follows is the loudest audit. The absence of patches is a verdict.
Silence is the loudest audit. When a vendor goes quiet about a version that still has 47% of the installed base, the market hears it, even if the regulatory radar does not. The cybercriminals certainly hear it. They are listening to the same vendor communication channels that we are. They know which versions are left behind. They are building their exploit lists accordingly.
What can a blockchain writer add to this conversation? Perhaps this: the concept of an “unpatchable majority” is something we should have been talking about long before it was reflected in a print server. The culture that celebrates immutability needs to also celebrate the discipline that comes before immutability: rigorous design, formal verification, and ethical support obligations. Code doesn’t fix bad incentives. It only automates them. The incentives in the enterprise software industry — support contracts, upgrade revenue, maintenance margins — are designed to monetize anxiety. They are not designed to eliminate risk. That is why we see a 47% un-patchable rate. That is why the attack chain is so effective. That is why, even after this disclosure, nothing will change for most of those 2,500 installations.
The only path forward is a rethinking of what “support” means. Regulators should require minimum support windows for software sold to critical sectors. Enterprises should include patching capability as a formal procurement criterion, not just price. And the broader tech community — yes, including the crypto world — should stop pretending that decentralized deployment is a substitute for operational responsibility. It is not. It is a different form of it.
The next time you hear a pitch about a blockchain project that is “immutable and therefore secure,” ask yourself: how will this system respond to a flaw if the DAO cannot reach a quorum? How will it patch the 47% of node operators who are running an old version? What is the end-of-life policy? If you cannot answer those questions, you are not building a protocol. You are building a papercut. And papercuts hurt.
The failure mode is not a single CVE. The failure mode is the silent, unpatched dark matter of the installed base. It exists everywhere. In print servers, in smart contracts, in corporate Web3 treasury desks, in the forgotten directories of critical infrastructure. The bull market obscures it. The hype makes it invisible. But the operators in the dark have already mapped it.
Silence is the loudest audit. The data is out there. The 47% is a mirror. What we choose to look at is up to us.