60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
60
60
60
60
60
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.
72
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70
60
60
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.
Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.
80
60
60
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [3 February]
60
DarkSword: Researchers uncover another iOS exploit kit
60
Week in review: Google fixes yet another Chrome zero-day exploit, YouTube as a cybercrime channel
60
60
60
60
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.
Sansec disclosed on September 5 that attackers are exploiting an unpatched vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution, with attacks observed starting September 4. All current versions including 2.4.9 are affected, and Adobe has published no advisory, CVE, patch, or workaround, with the next scheduled security release on September 8. Hosting firm Disrex Group independently confirmed two compromised stores (running 2.4.8 and 2.4.7-p2), both breached within the roughly eight-hour window before Sansec's blocking rules went live. The implant is a ~1.9 MB statically linked Rust binary disguised as a Linux kworker process, re-adding a cron entry every five minutes and in one case reading Magento sessions directly from Redis with no outbound traffic.
85
60
60
60
3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update
60
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.
Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.
80