Chinese hackers hit thousands of organizations using Microsoft Exchange
60
60
60
60
60
60
60
60
60
60
60
60
Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution
China-linked UNC3569 actively exploited critical Sogou Input Method flaw CVE-2026-51990 for one-click system-level code execution, deploying the GrayRabbit backdoor.
Gen Threat Labs reports that China-linked threat actor UNC3569, possibly tied to contractor i-SOON, exploited critical CVE-2026-51990 in Tencent's Sogou Input Method, a Windows IME used by hundreds of millions, via crafted sgbiz URLs. The chain combines unvalidated command-line argument injection, unrestricted URL navigation, and an un-sandboxed Chromium 80 engine missing roughly six years of security patches. The exploit gives system-level code execution and was used to deploy the GrayRabbit backdoor, which provides a reverse shell, plugin loading, file upload to C2, and system info collection, and has appeared in UNC3569 intrusions since at least 2021. Tencent patched the issue in version 16.3.0.3498 via automatic update, but the outdated Chromium configuration reportedly remained unchanged as of September 10.
80
U.S. CISA adds Dahua IP Camera, Linux Kernel and Microsoft Exchange Server bugs to its Known Exploited Vulnerabilities catalog
60
60
60
60
Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
Cisco warns CVE-2026-76461 (CVSS 9.8), an unauthenticated root RCE in Secure Email Gateway AsyncOS, is actively exploited in the wild.
Cisco confirmed that CVE-2026-76461, a CVSS 9.8 email-parsing flaw in Secure Email Gateway AsyncOS, is being exploited in the wild since September 2026, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges via crafted emails containing malicious SQL statements. All physical and virtual SEG configurations are affected; Secure Email and Web Manager and Secure Web Appliance are not. CISA added the flaw to the KEV catalog with a September 17 federal remediation deadline, and Cisco released IoCs while noting root access lets attackers remove them.
85
60
60
60
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
CISA added actively exploited Oracle WebLogic flaw CVE-2026-21962 (CVSS 10.0) to its KEV catalog, letting unauthenticated attackers access or modify critical data.
CISA added CVE-2026-21962, a CVSS 10.0 improper access control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Oracle shipped patches in January 2026, and GreyNoise, CloudSEK, and SOCRadar have since reported exploitation attempts, including a lone IP scanning multiple WebLogic, Ivanti, GNU InetUtils, and GLPI vulnerabilities. The flaw is also among several exploited by a China-linked actor delivering the SNOWLIGHT downloader to government and commercial infrastructure in more than 100 countries. Federal civilian agencies must apply fixes by August 27, 2026 under BOD 26-04.
85
CISA Adds Four Critical Vulnerabilities to KEV Catalog Due to Active Exploitation
60
60
60
60
60
60
60
60
60
BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
Proofpoint reports multiple espionage groups rapidly adopting BlueMoon, a new exploit kit chaining Chrome and Windows zero-days.
Proofpoint identified a new exploit kit, BlueMoon, chaining two Chrome V8 zero-days (CVE-2026-85046, CVE-2026-87491) with a Windows ALPC privilege escalation zero-day (CVE-2026-85880), all patched between September 3 and September 2026 Patch Tuesday. China-linked Violet Typhoon (APT31) first used it on August 28 against US NGOs and mining/commodity trading firms; UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket adopted it within days against targets in the US, Vietnam, Indonesia, and Singapore. The kit exploits the V8 defects for sandbox escape, fingerprints the host, and injects a CreateProcess stub into the Chrome broker process to download and execute a payload via curl. Development artifacts suggest the kit's creators may have used AI to build it, potentially lowering the barrier to exploit development.
88
60
60
60
60
60
60
60
CISA orders federal agencies to disconnect Ivanti VPN instances by February 2
60