60
60
45
57
wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)
Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.
wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.
90
45
60
60
60
60
45
60
U.S. CISA adds SKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS flaws to its Known Exploited Vulnerabilities catalog
60
ToolShell Exploit: Critical SharePoint Zero
60
57
60
60
Three JFrog Artifactory Flaws Exploited for Backdoor Deployment
Wiz reports multiple actors chaining three JFrog Artifactory auth flaws to gain admin and deploy backdoors; CISA added all three CVEs to KEV.
Wz reports threat actors exploiting CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 in self-hosted JFrog Artifactory instances to bypass authentication and gain administrative privileges. Between August 15 and September 8, 2026, multiple actors chained CVE-2026-42018 and CVE-2026-42016 to mint anonymous-user tokens, escalate privileges, create persistent admin accounts, install malicious plugins for code execution, and drop second-stage payloads. From early September, CVE-2026-82329 was exploited for configuration exfiltration, cluster key theft, token minting, and SSH key attachment to attacker-created accounts. CISA added all three CVEs to its KEV catalog, giving federal agencies two weeks under BOD 26-04 to patch to versions 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21.
75
BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
Proofpoint reports multiple espionage groups rapidly adopting BlueMoon, a new exploit kit chaining Chrome and Windows zero-days.
Proofpoint identified a new exploit kit, BlueMoon, chaining two Chrome V8 zero-days (CVE-2026-85046, CVE-2026-87491) with a Windows ALPC privilege escalation zero-day (CVE-2026-85880), all patched between September 3 and September 2026 Patch Tuesday. China-linked Violet Typhoon (APT31) first used it on August 28 against US NGOs and mining/commodity trading firms; UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket adopted it within days against targets in the US, Vietnam, Indonesia, and Singapore. The kit exploits the V8 defects for sandbox escape, fingerprints the host, and injects a CreateProcess stub into the Chrome broker process to download and execute a payload via curl. Development artifacts suggest the kit's creators may have used AI to build it, potentially lowering the barrier to exploit development.
88
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
Wiz Research confirms in-the-wild exploitation of three JFrog Artifactory vulnerabilities, chained to gain administrative control, deploy Groovy plugins, and install Rust backdoors.
Wiz Research identified active exploitation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 in JFrog Artifactory between August 15 and September 8, 2026. Attackers chain the anonymous-token exposure (CVE-2026-42018) with the token scope-validation flaw (CVE-2026-42016) to obtain admin-scoped tokens, while CVE-2026-82329 allows unauthenticated administrative access in default configurations. Observed post-exploitation includes persistent administrator accounts created in under five minutes, malicious Groovy plugin deployment, ad-hoc command execution, Rust-based C2 backdoors dropped to writable paths, and webshell uploads. Wiz measured that 59-62% of organizations running Artifactory remained vulnerable to the chained CVEs weeks after disclosure, and the vulnerabilities were already included in CISA KEV.
85
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
GreyNoise tracked a likely Russian-speaking actor that used AI agents (OpenAI Codex, a DeepSeek model) to exploit an authentication bypass (CVE-2026-81578) and unsafe-reflection RCE (CVE-2026-82078) in PaperCut NG/MF starting August 31, 2026. At least 440 servers across 395 organizations in 48 countries were compromised, with one US high school going from initial access to Domain Admin in seven minutes. Escalation relied on LSASS and registry credential harvesting, pass-the-hash, the noPac technique (CVE-2021-42278/CVE-2021-42287), new Domain Admin accounts, and DCSync to steal NTDS.DIT data. Operators staged registry hives, used Ligolo tunneling and certutil Base64 encoding for exfiltration, and one attempt was blocked by Cloudflare WAF.
82
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.
72
CISA Added JFrog Artifactory Vulnerability to its Known Exploited Vulnerabilities Catalog (CVE-2026-82329)
CISA added the actively exploited JFrog Artifactory flaw CVE-2026-82329 (CVSS 9.8) to its KEV catalog; unauthenticated attackers gain admin access.
CISA added CVE-2026-82329, a critical improper authentication flaw in JFrog Artifactory, to its Known Exploited Vulnerabilities Catalog with a September 5, 2026 patch deadline. The CVSS v3.1 9.8 flaw allows unauthenticated attackers with network access to obtain administrative privileges under the default configuration. WatchTowr honeypot data shows attackers minting administrator tokens, enumerating users, groups, and federated access topologies, and in some cases creating backdoor users for persistence. Users must upgrade to Artifactory 7.161.20 or the applicable fixed release; Qualys detects vulnerable assets via QID 735249.
84
60
60
60
60
60
60
57
60
60
Samsung Mobile Flaw Exploited as Zero
60
September 2025 CVE Landscape
60
60
60
60
60
45
60