News
GreyNoise Traced One Attacker Running OpenAI's Codex Harness With a DeepSeek Model Through 395 Organizations in 48 Countries
A Russian-speaking actor chained CVE-2026-81578 and CVE-2026-82078 against PaperCut NG/MF, hitting at least 440 instances across 395 organizations in 48 countries, 204 of them in education. GreyNoise clocked remote code execution in under four hours and domain admin two hours later, with 11 organizations compromised in 26 seconds and one US high school taken from initial access to domain admin in seven minutes. The offensive orchestration layer was OpenAI's Codex harness driving a DeepSeek model alongside off-the-shelf offensive tooling, which is the same builder stack defenders are shipping.
↳ Follow the thread