Listen to this Post
A New PaperCut Security Crisis Emerges
A serious security incident involving PaperCut NG and PaperCut MF has moved rapidly from an undisclosed zero-day warning to a pair of publicly identified vulnerabilities with confirmed exploitation in the wild. PaperCut confirmed customer incidents on August 27, 2026, and released emergency updates while urging organizations to immediately remove public internet exposure from affected Application Servers.
Huntress
+1
The vulnerabilities are now tracked as CVE-2026-81578 and CVE-2026-82078. According to NHS England’s cybersecurity alert, CVE-2026-81578 involves improper access control that can allow unauthorized remote modification of certain system configurations, while CVE-2026-82078 involves unsafe dynamic class loading that can ultimately allow arbitrary Java bytecode execution.
NHS Digital
For organizations that rely on PaperCut to manage printing, scanning, authentication and document workflows, this is more than a routine software update. A compromised print-management server can become an attractive foothold inside an otherwise protected corporate or institutional network.
The Warning Started as a Zero-Day Alert
PaperCut initially disclosed the issue as a vulnerability under active exploitation without releasing technical details or a CVE identifier. The company said it was aware of confirmed customer incidents and was treating the situation as a high-priority investigation.
BleepingComputer
That initial approach was understandable from a defensive perspective. Publishing detailed exploit mechanics while attackers were already abusing the flaw could have accelerated attacks against organizations that had not yet patched.
PaperCut has previously described a “fix-first” approach to security disclosures, in which technical information may be withheld until the company believes disclosure will no longer create an immediate risk to customers.
PaperCut
Two CVEs Now Define the Attack Chain
The mystery surrounding the original zero-day has since become clearer. CVE-2026-81578 is an improper-access-control vulnerability affecting the PaperCut web management interface, while CVE-2026-82078 is an unsafe dynamic-class-loading vulnerability in database connection utilities.
NHS Digital
The important point is that these weaknesses can work together. An attacker who reaches the vulnerable application can manipulate configuration in a way that ultimately enables dangerous code-loading behavior.
Huntress reported that its researchers reproduced a pre-authentication remote configuration takeover and a complete remote-code-execution chain against a stock PaperCut NG 25.0.11 installation.
Huntress
The Most Dangerous Detail: Pre-Authentication Exploitation
One of the most concerning aspects of the incident is that the exploitation chain can begin before an attacker has authenticated.
Huntress found that a specially crafted request could cause PaperCut’s authorization mechanism to evaluate the wrong page during an administrative operation. Under the researchers’ reproduction, this allowed an unauthenticated request to modify server configuration and reach sensitive functionality.
Huntress
That distinction matters enormously.
A vulnerability requiring a valid administrator account is dangerous, but a vulnerability that can be reached without authentication dramatically lowers the barrier for exploitation.
Arbitrary Java Code Execution Raises the Stakes
CVE-2026-82078 introduces another major escalation point.
The vulnerability concerns unsafe dynamic loading of database driver classes. If an attacker can manipulate the relevant configuration parameters, malicious Java bytecode residing on the application’s classpath can potentially be executed under the security context of the PaperCut server process.
NHS Digital
In practical terms, attackers are not merely gaining the ability to change a harmless setting. The vulnerability chain can transform unauthorized configuration access into server-side code execution.
That is why organizations should treat this incident as a potential server-compromise event rather than simply a configuration-management problem.
Huntress Observed Real-World Attacks
The strongest evidence that this is an active threat comes from incident-response observations.
Huntress said it observed exploitation in two customer environments. In one case, the activity lasted less than two minutes and involved commands designed to identify the compromised system’s user account and Windows version.
Huntress
In another incident, researchers observed activity that also attempted to enumerate running processes.
These behaviors are consistent with early-stage reconnaissance. Attackers often want to establish what privileges they have, what operating system they are dealing with and what security or business processes are running before deciding how to proceed.
The pc-app.exe Process Deserves Attention
PaperCut’s investigation guidance identifies suspicious post-exploitation activity involving pc-app.exe, the PaperCut Application Server process.
Huntress was able to reproduce remote code execution that resulted in a process being spawned beneath pc-app.exe, demonstrating why unusual child processes originating from this executable deserve close investigation.
Huntress
Security teams should therefore avoid looking only for a single known malware filename.
A compromised PaperCut server may instead show abnormal process trees, unexpected Java activity, suspicious child processes, unusual network connections or other artifacts associated with post-exploitation.
Deleted or Truncated Logs Could Be a Warning Sign
PaperCut has also highlighted unexpectedly truncated or deleted server.log files as a possible indication of compromise.
Log destruction is particularly significant during an intrusion because attackers understand that logs can reveal the sequence of actions they performed.
Huntress additionally identified suspicious log entries associated with exploitation attempts, including encoded commands and database-related artifacts.
Huntress
For incident responders, a missing log should not automatically be treated as a harmless logging failure when it occurs alongside other suspicious activity.
The Internet Exposure Problem Makes This More Dangerous
Internet exposure is a major factor in the severity of this incident.
PaperCut has advised organizations to immediately restrict Application Server web access to trusted IP addresses, using firewall rules, network access controls or equivalent protections.
NHS Digital
This is especially important because organizations sometimes expose administrative interfaces for convenience, remote management or distributed printing environments.
A management interface that is reachable from the public internet effectively gives attackers a much larger opportunity to discover and target the service.
PaperCut Has a History of Exploited Vulnerabilities
This incident is also not
PaperCut’s earlier security advisories documented vulnerabilities in NG/MF products that were exploited in the wild, including the major 2023 incident involving CVE-2023-27350 and CVE-2023-27351. PaperCut stated at the time that unpatched servers were being exploited.
PaperCut
The historical pattern matters because it demonstrates that PaperCut servers have already attracted serious attention from threat actors.
The current campaign should therefore be evaluated against that broader history rather than as an isolated vulnerability.
Why Print Servers Are Attractive Targets
Print infrastructure is often overlooked when organizations design security controls.
Security teams naturally focus on internet-facing firewalls, VPN concentrators, email systems, identity platforms and web applications. Print-management servers may receive less scrutiny despite running privileged software and interacting with large numbers of endpoints.
That makes them attractive potential footholds.
A compromised PaperCut server may provide an attacker with an opportunity to study internal network architecture, identify connected systems and potentially move toward more valuable targets.
The Risk Goes Beyond Printing
The danger is not limited to the ability to manipulate print jobs.
PaperCut NG/MF can sit in the middle of authentication, print management, scanning workflows and endpoint communication. Depending on the organization’s configuration, compromising the Application Server could provide an attacker with a useful position from which to explore the wider environment.
The Dutch National Cyber Security Centre warned that successful exploitation could allow attackers to take control of the printing environment and potentially gain access to other systems within the network.
NCSC
That possibility makes network segmentation particularly important.
Emergency Patches Are Now Available
PaperCut has released emergency updates for supported versions, with emergency patch releases available for versions 24, 25 and 26 according to NHS England’s alert. Organizations running older releases are encouraged to move to a current supported version.
NHS Digital
Huntress reported emergency builds for PaperCut NG and MF version 25, including Windows builds 25.0.12.76497 for NG and 25.0.12.76496 for MF.
Huntress
Administrators should verify the exact remediation package against their deployed PaperCut version rather than assuming that installing a generic update is sufficient.
Patching Alone Is Not Enough
One of the most important lessons from this incident is that organizations should not interpret “patched” as automatically meaning “safe.”
If exploitation occurred before the patch was installed, upgrading the server will remove the vulnerability but may not remove an attacker who has already established persistence.
That is why PaperCut recommends investigating suspicious activity, while Huntress advises organizations to preserve relevant evidence before upgrades or restarts alter the system state.
Huntress
Incident Response Should Begin With Evidence Preservation
Organizations that had publicly exposed PaperCut servers should consider treating them as potentially compromised until investigation provides confidence otherwise.
Relevant evidence includes PaperCut logs, configuration files, endpoint process trees, firewall and reverse-proxy records, DNS activity and network-flow information.
Huntress specifically recommends preserving the PaperCut server/logs directory, nondefault configuration, process information and surrounding network-security telemetry.
Huntress
The server.log File May Tell Part of the Story
Huntress observed encoded commands in
Among the observed commands were attempts to identify the current user, Windows version and running processes.
Huntress
This illustrates why even apparently simple reconnaissance commands can become valuable forensic evidence.
A security team investigating a PaperCut server should therefore examine not only whether logs exist, but also whether they contain unusual requests, encoded strings, database errors or unexpected execution artifacts.
Network Isolation Can Buy Critical Time
For organizations unable to patch immediately, isolation becomes the next defensive priority.
Restricting the PaperCut Application Server so that its web interface is reachable only from trusted internal networks, VPN infrastructure or approved administrative IP addresses can dramatically reduce the attack surface.
This does not eliminate the vulnerability, but it can make opportunistic internet-based exploitation substantially harder.
Outbound Traffic Also Deserves Scrutiny
A compromised server is not only a destination for malicious traffic.
Once attackers obtain execution, they may attempt to retrieve additional payloads, communicate with command-and-control infrastructure or access other systems.
Huntress recommends monitoring outbound SMB activity and noted that its reproduced exploitation chain used an attacker-controlled SMB2 share to deliver a Derby archive.
Huntress
Organizations should therefore investigate unusual outbound connections originating from PaperCut servers, especially connections that are inconsistent with normal printing infrastructure.
What Makes This Incident Different From a Normal Patch Cycle
Most vulnerability disclosures follow a predictable pattern: researchers discover a flaw, the vendor develops a fix, the vulnerability receives a CVE, and defenders then begin remediation.
This incident moved in the opposite direction.
Exploitation was already occurring before full technical disclosure.
That creates a difficult defensive environment because attackers can potentially learn from live exploitation while defenders are still trying to understand exactly what happened.
The Timing Is Particularly Important
The vulnerability became public at the end of August, when many organizations are preparing for the final quarter of the year.
Universities, government agencies and enterprises often operate large printing environments with multiple servers, embedded devices and distributed users.
That complexity can make emergency remediation slower than simply applying a single workstation update.
The organizations most at risk are likely to be those that have exposed PaperCut management infrastructure, run outdated versions or lack centralized visibility into their print-management servers.
Security Teams Should Hunt Beyond the Known Indicators
Indicators of compromise are useful, but they should never become the entire investigation.
Attackers can change filenames, commands and infrastructure quickly.
For example, finding or not finding pc-app.exe by itself does not prove whether a server has been compromised, because legitimate PaperCut components can naturally use that process.
The real question is whether the process is behaving abnormally.
Process Trees Can Reveal the Difference
A legitimate PaperCut process should generally perform expected application functions.
An unexpected chain involving pc-app.exe spawning command interpreters, system utilities, scripting engines or unusual Java components deserves investigation.
Huntress’ successful reproduction of code execution underneath the PaperCut process makes process-tree monitoring particularly relevant to this incident.
Huntress
Authentication Controls May Not Save Vulnerable Servers
The presence of strong administrator passwords does not necessarily protect an exposed server against a vulnerability that can be exploited before authentication.
This is an important conceptual distinction.
Organizations sometimes assume that enforcing MFA, complex passwords and privileged-account controls automatically protects every management application.
Those controls remain essential, but an application-layer authorization flaw can potentially bypass them before an attacker reaches the authentication stage.
Segmentation Becomes the Second Line of Defense
Network segmentation can limit what happens after an application server is compromised.
A PaperCut server should ideally not have unrestricted access to every workstation, server, database and administrative service on the network.
Restricting unnecessary east-west connectivity can prevent an initial compromise from becoming a broader enterprise incident.
This is one of the most valuable lessons from the PaperCut case: vulnerability management and network architecture must work together.
The Broader Security Lesson for IT Administrators
The PaperCut incident highlights an uncomfortable truth about enterprise infrastructure.
The systems that appear operationally mundane can become strategically important to attackers.
Printers may not contain the same information as a database server, but the software controlling them can possess credentials, network access, administrative privileges and connections to numerous endpoints.
That makes print-management infrastructure part of the
Deep Analysis: How the Attack Chain Changes the Risk
The first command for defenders is simple: identify every PaperCut NG/MF Application Server in the environment.
The second command is equally important: determine which servers are reachable from the public internet.
The third command should be: verify the exact PaperCut version and emergency patch status on every server.
The fourth step is to remove unnecessary public exposure immediately, even before the full patching process is complete.
The fifth step is to review PaperCut logs for exploitation artifacts and unexpected administrative activity.
The sixth step is to look for missing, truncated or suspiciously modified server.log files.
The seventh step is to inspect processes originating from pc-app.exe.
The eighth step is to look for unexpected Java execution, command interpreters or system utilities launched from the PaperCut process tree.
The ninth step is to review firewall, proxy, DNS and network-flow telemetry for unusual outbound activity.
The tenth step is to check whether the server communicated with unknown external infrastructure around the suspected exploitation window.
The eleventh step is to review scheduled tasks, services, startup mechanisms and recently created files for evidence of persistence.
The twelfth step is to compare configuration changes against legitimate administrative activity.
The thirteenth step is to investigate encoded commands appearing in PaperCut logs rather than treating them as harmless application noise.
The fourteenth step is to look for signs that attackers performed reconnaissance after gaining execution.
The fifteenth step is to review the
The sixteenth step is to examine connected systems for evidence of lateral movement.
The seventeenth step is to preserve forensic evidence before rebuilding or restarting a potentially compromised server whenever practical.
The eighteenth step is to patch using
The nineteenth step is to verify the patch afterward instead of assuming that the update completed successfully.
The twentieth step is to continue monitoring after remediation because exploitation may have occurred before the patch was installed.
The deeper lesson is that the CVEs should not be considered independently.
CVE-2026-81578 creates the configuration-manipulation problem, while CVE-2026-82078 creates the dangerous code-loading consequence.
NHS Digital
Together, they illustrate how an authorization weakness can become a remote-code-execution problem when sensitive configuration controls influence application behavior.
That chain is precisely what makes the incident more serious than an isolated administrative bug.
Why Attackers Could Move Quickly
Once a vulnerability becomes publicly known, defenders are not the only ones studying it.
Threat actors can analyze vendor updates, compare vulnerable and patched versions, reverse-engineer application behavior and develop their own exploitation techniques.
Because this vulnerability was already being exploited before detailed public disclosure, the defensive window is particularly narrow.
Organizations should therefore assume that internet-exposed installations may already have been scanned or targeted.
The Two Observed Incidents Matter
Huntress’ observation of exploitation against two customer environments does not mean that only two organizations were targeted.
It means that two incidents were visible to that particular research and monitoring network.
Other attacks may have occurred elsewhere without being detected, reported or publicly disclosed.
This distinction is crucial when assessing the scope of an active exploitation campaign.
The Absence of Obvious Malware Is Not Proof of Safety
An attacker does not necessarily need to install a conventional executable to benefit from a server compromise.
The PaperCut vulnerability can lead to code execution within the application’s Java environment, meaning defenders should consider in-memory activity, temporary files, class-loading behavior and abnormal child processes alongside traditional malware indicators.
This is another reason why endpoint telemetry and application logs should be examined together.
PaperCut’s Earlier Security Work Adds Context
PaperCut has published multiple security bulletins throughout 2026, including fixes for vulnerabilities discovered through internal audits and security research. The company has described a broader strategy of “pattern hunting” in its codebase after discovering vulnerabilities.
PaperCut
That continuing security work is important, but the current incident demonstrates why secure development must be accompanied by rapid deployment of fixes in customer environments.
A vulnerability cannot be considered practically resolved until vulnerable installations are actually updated or isolated.
The Real Challenge Is Enterprise-Scale Remediation
For a small organization, updating one PaperCut server may be straightforward.
For a multinational enterprise, university or government organization, the situation can be very different.
There may be dozens of Application Servers, regional installations, redundant systems, embedded printer components, legacy deployments and systems managed by different IT teams.
The first challenge is therefore asset discovery.
You cannot patch what you do not know exists.
Organizations Should Treat This as a Priority Incident
The combination of confirmed exploitation, remote attack potential, configuration manipulation and code execution should place this vulnerability high on the remediation list for any organization running PaperCut NG or MF.
The Dutch NCSC has already advised organizations to install the recommended updates quickly because active exploitation is underway.
NCSC
This is not a vulnerability where organizations should wait for a convenient maintenance weekend if the affected server is exposed to the internet.
What Undercode Say:
A Small Infrastructure Component Can Become a Major Security Gateway
The PaperCut incident is a powerful reminder that attackers do not necessarily begin with the most glamorous target.
A print server can look insignificant compared with an identity platform or database.
But software controlling printers can have extensive privileges and network visibility.
That makes it a valuable target.
Active Exploitation Changes the Risk Calculation
The biggest difference between this incident and a theoretical vulnerability is evidence of exploitation.
PaperCut confirmed customer incidents.
Huntress observed exploitation.
Huntress also reproduced the attack chain.
That combination should eliminate any assumption that attackers are merely capable of exploiting the vulnerability in theory.
Huntress
+1
The Authentication Boundary Is the Critical Weakness
The most troubling aspect is the possibility of reaching dangerous functionality before authentication.
Once an attacker can manipulate trusted configuration without first proving who they are, conventional account-security controls may not be enough.
That fundamentally changes the security model of the application.
Configuration Is Not Always Harmless
Many organizations treat configuration files and settings as operational data.
But this vulnerability demonstrates that configuration can become executable security logic when application components dynamically load classes or drivers based on those values.
A setting that appears administrative can therefore become an execution primitive.
Java Makes the Attack Chain Especially Significant
The ability to load arbitrary Java bytecode turns configuration manipulation into something much more serious.
This is why defenders need to investigate not only web requests but also Java-related execution artifacts and unexpected processes spawned by the PaperCut service.
Public Exposure Is the First Question Every Defender Should Ask
Before attempting to understand every technical detail, organizations should answer a simple question:
Can the PaperCut Application Server be reached from the public internet?
If the answer is yes, reducing that exposure should be immediate.
Patching and Investigation Must Happen Together
A common mistake during emergency remediation is to install the patch and move on.
That approach can miss an attacker who compromised the server before the update.
The correct strategy is remediation plus investigation.
Deleted Logs May Be More Valuable Than Existing Logs
A missing or unexpectedly truncated log can itself be an indicator.
Attackers frequently understand that forensic evidence can expose their activity.
Therefore, log integrity should be part of the investigation.
The Two Huntress Cases Should Not Create False Comfort
Two observed incidents do not establish that the campaign is small.
They establish that exploitation has been observed.
That is enough to justify treating exposed systems as high priority.
Network Segmentation Can Limit the Damage
Even if an attacker succeeds, segmentation can determine how far they can go.
A compromised PaperCut server should not automatically have unrestricted access to critical servers and sensitive management networks.
Print Infrastructure Deserves Security Monitoring
Organizations should reconsider the assumption that printers are purely operational technology.
Modern print-management platforms are sophisticated applications.
They deserve vulnerability management, endpoint telemetry, network monitoring and incident-response coverage just like other enterprise software.
The CVEs Are a Warning About Chained Vulnerabilities
CVE-2026-81578 and CVE-2026-82078 demonstrate how multiple weaknesses can combine into a much more dangerous attack path.
NHS Digital
The security impact of a chain can be significantly greater than the apparent impact of each component viewed independently.
Emergency Advisories Should Trigger Emergency Behavior
When a vendor confirms exploitation, organizations should change their normal patching rhythm.
Waiting for a scheduled update cycle can create unnecessary exposure.
The appropriate response is accelerated remediation.
The Threat May Continue After Patching
Installing the emergency update closes the known vulnerability.
It does not erase evidence of previous exploitation.
Organizations should maintain heightened monitoring after remediation.
The Bigger Lesson Is About Visibility
The organizations best positioned to respond are those that already know where their PaperCut servers are, which versions they run and how those servers communicate.
Asset visibility is therefore not merely an IT-management issue.
It is a security capability.
Attackers Are Increasingly Targeting Trusted Applications
A compromised security product is alarming.
A compromised business application can be equally dangerous when it is trusted by the environment.
PaperCut sits inside normal enterprise workflows, which makes its compromise particularly interesting to attackers.
The Attack Surface Is Larger Than the Web Interface
The web interface may provide the initial entry point, but defenders must investigate processes, Java execution, configuration changes, file creation and outbound network traffic.
A modern intrusion rarely remains confined to the original vulnerability.
Organizations Should Assume Attackers Read Security Advisories
Once details become public, exploitation can accelerate.
Defenders should therefore aim to reduce exposure before attackers have time to operationalize newly published technical information.
PaperCut’s Fix-First Strategy Has Value
With active exploitation underway, withholding detailed technical information initially can help protect customers while emergency fixes are deployed.
The later assignment of CVEs provides defenders with the standardized identifiers needed for tracking and prioritization.
The Incident Is Also a Supply-Chain Lesson
Organizations often inherit risk from applications they did not develop themselves.
PaperCut may be a legitimate and trusted vendor, but vulnerabilities in trusted software can still become enterprise-wide security problems.
Security Teams Should Not Wait for a KEV Listing
A vulnerability does not need to appear in CISA’s Known Exploited Vulnerabilities catalog before an organization takes action.
Confirmed exploitation is already enough evidence to prioritize remediation.
The Most Dangerous Server May Be the One Nobody Watches
If security monitoring excludes print servers, attackers can potentially operate in an area of the environment with less scrutiny.
That makes overlooked infrastructure particularly valuable.
This Incident Should Trigger a Broader Review
Organizations using PaperCut should consider reviewing previous PaperCut vulnerabilities and confirming that older weaknesses have been properly remediated.
The company has documented multiple security issues throughout 2026, demonstrating that continuous patch management is necessary.
PaperCut
The Final Assessment
The PaperCut NG/MF incident should be regarded as a serious active-exploitation event rather than a routine vulnerability announcement.
The combination of unauthenticated access-control weaknesses, configuration manipulation and arbitrary Java code execution creates a credible path from internet exposure to server compromise.
The strongest defense is straightforward: remove unnecessary internet exposure, install the appropriate emergency update, investigate previously exposed servers and monitor for signs of post-exploitation.
✅ Confirmed: PaperCut confirmed active exploitation and customer incidents involving its NG and MF products.
Huntress
+1
✅ Confirmed: The vulnerabilities have been assigned CVE-2026-81578 and CVE-2026-82078, involving improper access control and unsafe dynamic class loading respectively.
NHS Digital
✅ Confirmed: Huntress reproduced a pre-authentication attack chain leading to remote code execution and observed exploitation in two customer environments.
Huntress
❌ Not established: The identity of the threat actor or actors behind the current PaperCut exploitation campaign has not been publicly established.
Prediction
(+1) Emergency Patching Will Accelerate
Organizations running exposed PaperCut NG/MF servers are likely to prioritize emergency remediation rapidly now that the two CVE identifiers and exploitation details are public.
(+1) More Technical Evidence Will Emerge
As incident responders investigate affected environments, additional indicators, exploitation patterns and post-compromise behaviors are likely to become public.
(-1) Opportunistic Attacks Could Increase
Public disclosure of a working exploitation chain can encourage additional threat actors to target vulnerable PaperCut installations, particularly systems that remain accessible from the internet.
(-1) Previously Compromised Servers May Become a Secondary Problem
Organizations that patch without investigating historical activity could leave persistence or compromised credentials behind.
(+1) Network Isolation Will Become More Common
Enterprises are likely to move PaperCut management interfaces behind VPNs, internal access controls and restricted network zones as a longer-term defensive measure.
(+1) Print Infrastructure Will Receive More Security Attention
The incident could push security teams to treat print-management platforms as serious enterprise applications rather than low-priority infrastructure.
(-1) The Exposure Window Will Remain Significant for Legacy Systems
Organizations running unsupported or difficult-to-upgrade versions may remain vulnerable longer, making older PaperCut installations an attractive target for attackers.
(+1) The Long-Term Lesson Is Clear
The PaperCut incident will likely reinforce a broader cybersecurity principle: any internet-facing application with privileged access can become a gateway into the enterprise, regardless of whether its primary purpose is printing, file management, authentication or something else.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.securityweek.com
Extra Source Hub (Possible Sources for article):
https://www.github.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
