57
57
57
57
Attackers are weaponizing the gap between Chromium fixes and Chrome patches
Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.
Proofpoint, working with Google Threat Intelligence Group, Microsoft Threat Intelligence Center and Volexity, reports that the BlueMoon exploit kit chains V8 type confusion CVE-2026-85046, V8 sandbox escape CVE-2026-87491 and Windows kernel LPE CVE-2026-85880, all rated high severity. The V8 flaws were fixed in upstream Chromium source but had not yet reached Chrome stable releases, creating a patch gap that attackers reverse-engineered and weaponized. A China-aligned state-sponsored actor used the kit from August 28 against a small number of US NGOs, mining and commodity trading firms via rapport-building spear phishing, and within days several mostly China-linked espionage clusters adopted BlueMoon. The chain yields full Windows admin privileges from a single phishing click; defenders should patch Chrome and Windows, apply Proofpoint detections and hunt for leftover artifacts.
82
57
57
57
Microsoft discloses two actively exploited zero-days among 974 vulnerabilities
Microsoft patches 974 flaws in record Patch Tuesday, including two actively exploited Windows zero-days enabling privilege escalation.
Microsoft's largest-ever Patch Tuesday addresses 974 vulnerabilities, with CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows Advanced Local Procedure Call) exploited before disclosure. Both zero-days carry CVSS 7.8 ratings and allow privilege escalation. More than 10% of the defects are rated critical, and researchers attribute the record volume to AI-assisted vulnerability discovery without a matching rise in active exploitation.
78
60
57
60
57
57
60
57
57