60
60
60
60
60
60
60
60
60
60
Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch
PaperCut pre-auth RCE CVE-2026-81578 actively exploited; 47% of tracked installs unpatched and exposed to remote code execution.
Huntress confirmed active exploitation of a pre-authentication RCE flaw in PaperCut (CVE-2026-81578), chainable with CVE-2026-82078 to achieve SYSTEM-level code execution via PaperCut's Application Server. Observed attacks focused on short reconnaissance (whoami, ver, tasklist) with no persistence, but a malicious Java class dropping into the installation directory leaves the jdbc:derby:memory:pwn breadcrumb. Roughly 47% of ~2,500 tracked installations run version 23 or earlier with no patch yet available.
74
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
55
U.S. CISA adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog
60
Week in review: Exploited zero-day in Cisco email security appliances, Kali Linux 2025.4 released
60
60
60
60
60
BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
Proofpoint reports multiple espionage groups rapidly adopting BlueMoon, a new exploit kit chaining Chrome and Windows zero-days.
Proofpoint identified a new exploit kit, BlueMoon, chaining two Chrome V8 zero-days (CVE-2026-85046, CVE-2026-87491) with a Windows ALPC privilege escalation zero-day (CVE-2026-85880), all patched between September 3 and September 2026 Patch Tuesday. China-linked Violet Typhoon (APT31) first used it on August 28 against US NGOs and mining/commodity trading firms; UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket adopted it within days against targets in the US, Vietnam, Indonesia, and Singapore. The kit exploits the V8 defects for sandbox escape, fingerprints the host, and injects a CreateProcess stub into the Chrome broker process to download and execute a payload via curl. Development artifacts suggest the kit's creators may have used AI to build it, potentially lowering the barrier to exploit development.
88
60
U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog
60
60
U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
60
Apple released out-of-band updates for a new Zero‑Day actively exploited
60
Microsoft updated MSERT to detect web shells used in attacks against Microsoft Exchange installs
60
Four zero-days in Microsoft Exchange actively exploited in the wild
60
60
60
60
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.
72
Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026
60
U.S. CISA adds Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder flaws to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds Ubiquiti UniFi OS and Lantronix EDS5000 plugin flaws to its Known Exploited Vulnerabilities catalog
60
60