PaperCut NG and MF are under active attack as two zero-day flaws enable unauthenticated remote code execution, prompting an emergency patch.