Two critical zero-day flaws in PaperCut NG and MF are being actively exploited. Added to the CISA Known Exploited Vulnerabilities list on 31 August 2026, both can be chained to give attackers full remote access without any credentials. Here is what to do.