⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.
- Chrome CVE-2026-85046 is a V8 type confusion bug exploited in the wild; fixed in 152.0.7977.82
- MikroTrick chain creates an 'ops' account on RouterOS; fixes in 6.49.21, 7.23.4, 7.24.2
- StyleSmuggler zero-day injects PHP code into Magento templates, dropping a Rust backdoor to C2
- N-able N-central hotfixes address auth bypass and a CVSS 10.0 pre-auth RCE with suspected exploitation
- RevStealer uses EtherHiding blockchain dead drops and targets gaming platforms and crypto wallets
- CVEs
- CVE-2026-85046CVE-2026-86206CVE-2026-86207CVE-2026-86218CVE-2026-67276CVE-2026-67277CVE-2026-67278CVE-2026-67279CVE-2026-67281CVE-2026-86060
- Malware
- RevStealer
- Countries
- Poland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86060 | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
CVE-2026-86207+1 related CVE | Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3 | 7.7 group max | <1% | ||
| CVE-2026-86218 | Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild) | 10.0 | 15% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | coder-infra.com | rds. The data was then exfiltrated to the lookalike domain "coder-infra[.]com." "An unidentified malicious actor gained access to Coder |
| ipv4 | 103.102.31.18 | September," CERT Polska said. "In addition, the IP address 103.102.31.18 was used in attempts to exploit the described chain." Unpat |
| ipv4 | 82.192.72.4 | eation of the 'ops' account, originated from the IP address 82.192.72.4 and have been occurring since at least 2 September," CERT P |
| ipv4 | 99.84.67.186 | mail." The backdoor is a Rust program that connects to the "99.84.67[.]186" C2 server and waits for further instructions. There are |
From the original article
12 min read at thehackernews.com
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.