Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Exploit-DB publishes a local remote code execution exploit for Microsoft Edge 150.0.4078.48.
A public exploit demonstrates remote code execution in Microsoft Edge version 150.0.4078.48, listed under the local category on Exploit-DB. Successful exploitation could allow arbitrary code execution in the context of the browser. Users should update to the latest patched Edge release.
Socket found 19 malicious Chrome and Edge extensions, active since February 2024, stealing wallet seed phrases and credentials and draining crypto from about 80,000 users.
Socket researcher Karlo Zanki documented a cluster of 18 Chrome and one Edge extensions with wallet secret stealing and cryptocurrency draining capabilities, tracked as campaign Superior and possibly active since February 2024. The actor created 14 extensions and bought five legitimate ones, later pushing malicious updates; the largest, Enable Right Click & Copy, has roughly 80,000 installs across both browsers. The extensions maintain WebSocket C2 connections with endpoint rotation, strip CSP headers, and load 16 modules including multi-chain wallet drainers, hardware-wallet seed-phrase harvesters, credential grabbers, and ClickFix-style lures.
Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, including two zero-days in Windows components.
Microsoft's September 2026 release patched roughly 972 vulnerabilities (997 including ported Chromium fixes for Edge), a record, with 112 rated critical. Notable flaws include two zero-days: CVE-2026-81963 in the Windows update service and CVE-2026-85880 in the Windows Advanced Local Procedure, with no public information on exploitation breadth. Microsoft has fixed 2,760 vulnerabilities in 2026, more than double last year's total, which ZDI's Dustin Childs attributes to AI-assisted discovery becoming the 'new normal'.
Elastic Security Labs detailed KREMLIN, a Brazilian banking malware that silently installs malicious Chrome and Edge extensions, with 1,515 confirmed infections.
Elastic Security Labs analyzed KREMLIN, a toolkit used by a Brazilian operation in at least seven campaigns since May 2025 that impersonates 12 banks to trick users into opening a JavaScript file disguised as a bank receipt or invoice. After anti-sandbox checks, it downloads Node.js, persists via a scheduled task, and fetches payload locations from an Ethereum smart contract, hiding payloads in JPEG images on Internet Archive. The toolkit bypasses Chromium integrity mechanisms to install unapproved Chrome/Edge extensions masquerading as AVSync that steal cookies, keylog form input, capture screenshots, and intercept HTTP traffic, while recent campaigns deployed the REMCOS RAT and earlier ones Pulsar RAT. Elastic confirmed 1,515 infected systems, almost all in Brazil, and disrupted the campaign by registering an anti-sandbox canary domain; the linked wallet handled roughly 20,800 USDT incoming and 19,000 USDT outgoing.
Microsoft outlines security architecture guidance for edge AI, urging runtime attestation, artifact provenance, and deterministic mediation of model actions.
Microsoft details how edge AI shifts trust responsibilities to customers operating their own infrastructure, where prompt injection, model tampering, and malicious firmware updates can occur alongside model weights, credentials, and physical-system access. The guidance recommends verifying runtimes with attestation, verifying AI artifacts with provenance, and constraining model actions through a deterministic mediator outside the model. It also covers new exposure surfaces from MCP, multi-agent systems, and computer-use agents running in disconnected or hostile edge environments.
Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.
Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.
Palo Alto Unit 42 archive page describing Secure Access Service Edge (SASE), a cloud architecture unifying SD-WAN with SWG, CASB, FWaaS and ZTNA services.
Category archive page defining SASE as a cloud-native architecture that converges SD-WAN with security functions such as SWG, CASB, FWaaS and ZTNA into one cloud service. It frames SASE as a shift from separate networking and security disciplines to unified, cloud-delivered security and connectivity. The page contains no news, incident, vulnerability or research findings.
Canada's Cyber Centre updated advisory AV26-804 relaying Microsoft's August 2026 monthly rollup of vulnerabilities across .NET and Azure products.
The Canadian Centre for Cyber Security advisory AV26-804, updated August 27, 2026, relays Microsoft's August 2026 monthly security rollup originally issued August 11. Affected products include .NET 8.0, 9.0, and 10.0 on Linux, macOS, and Windows, plus many Azure services. Listed Azure components include Azure Kubernetes Service, Azure SQL Database, Azure Service Bus, Azure Active Directory, Azure Logic Apps, and Azure Monitor Agent.
Researchers showed a single browser extension could hijack AI agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome, earning $20,000 in bounties.
Forever Security demonstrated that a browser extension with two common permissions could seize the trusted page controlling built-in AI assistants in five Chromium-based products and drive the agent, read local files, or access the camera. Chrome's flaw was fixed as CVE-2026-0628 (CVSS 8.8) in Chrome 143.0.7499.192, and Microsoft fixed CVE-2026-55945 (CVSS 4.2) in Edge 150.0.4078.48. Perplexity Comet was the worst case: a hijacked agent could read any file, leak browsing history, take screenshots, and act as the user via an unsecured test subdomain. All attacks require a malicious extension already installed; no in-the-wild exploitation or KEV listing was reported as of September 16, 2026.
Five Eyes intelligence agencies issued joint guidance aimed at improving security of edge network devices.
Based on the headline, Five Eyes cyber agencies released guidance recommending organizations improve the security posture of edge devices such as routers and remote-access appliances. No article text is available, so specific recommendations are unavailable.
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.
2026 comparison of twelve enterprise browsers ranks Island and Palo Alto Talon as purpose-built leaders, with Chrome Enterprise and Edge free or bundled.
Guide compares twelve enterprise browser options across three models: purpose-built secure browsers (Island, Talon, Surf), layered controls on existing browsers (Chrome Enterprise, Edge for Business, LayerX, Seraphic), and streamed/isolated browsers (Kasm). Island and Palo Alto's Prisma Access Browser lead the purpose-built category for BYOD and contractor DLP. It also notes Mammoth Cyber has ceased operations.
Researcher Nightmare Eclipse released 'ShieldCrash', a zero-day exploit for Microsoft Defender that grants attackers SYSTEM-level access.
An anonymous researcher known as Nightmare Eclipse published a zero-day exploit for Microsoft Defender, dubbed 'ShieldCrash', that yields SYSTEM-level access. The release came immediately after Microsoft rolled out its September 2026 Patch Tuesday security updates. No CVE identifier has been assigned publicly and no in-the-wild exploitation has been reported yet. Microsoft Defender ships by default on Windows, so potential exposure is broad until Microsoft patches the flaw.
Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.
Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.
Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.
Microsoft Defender Experts tracked a campaign breaching organizations in healthcare, manufacturing, gaming, technology, logistics, government, and education via spoofed vendor download pages, often using .com.cn and .hl.cn domains. Installers keep the same filename while their hash changes on every download, indicating server-side payload generation that defeats file-based detection. The chain abuses msiexec.exe and scheduled tasks for persistence, adds Defender exclusions, deletes shadow copies, and disables Windows Update, with some hands-on-keyboard activity. The activity is consistent with the publicly reported Silver Fox (Yinhu) campaign, though Microsoft has not attributed it to a nation-state actor.
Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, amid AI-accelerated vulnerability discovery.
Microsoft's September 2026 Patch Tuesday patches a record ~972 vulnerabilities, 112 rated critical, following records of 570 two months ago and ~620 last month. Schneier attributes the surge to AI-powered vulnerability finding, citing an open letter from OpenAI, Anthropic, AWS, Google, Microsoft and roughly 100 organizations warning of an AI-enabled attack tsunami. He predicts AIs will reverse-engineer exploits from patches, weaponizing flaws immediately upon release and shrinking the patch window to 'immediately.'
Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC that bypasses September patches and reads files as SYSTEM.
Zero-day researcher Nightmare Eclipse (MSNightmare) published ShieldCrash, their 11th Microsoft zero-day, a proof-of-concept bypass of the ShieldBreak patch (CVE-2026-69414), which itself had bypassed the fix for RoguePlanet (CVE-2026-50656). ShieldCrash works on Windows 10, Windows 11, and Windows Server systems that have applied the September 2026 patches and allows arbitrary file reads as SYSTEM, though not arbitrary writes or a full SYSTEM shell. Microsoft has not said when it plans to patch the issue. The researcher recently also released zero-days affecting CrowdStrike Falcon (FalconFlank), Kaspersky endpoint antivirus (HardBreacher, patched), and Gen Digital's Avast (PrettyPrague).
SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.
SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.
Microsoft argues patch windows are shrinking and urges a new security control plane to protect systems between vulnerability discovery and remediation.
A Microsoft Security Blog post contends that the window between vulnerability discovery and patch deployment is collapsing, leaving exploitable gaps. It argues organizations need a security 'control plane' that provides protection in the gap between discovery and remediation. The piece is vendor thought leadership with no new incident, CVE, or product announcement details.
Joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs shows nation-state and criminal groups independently converge on the same edge infrastructure.
Tenable and SentinelOne jointly analyzed 93 CVE-actor attribution pairs covering exploitation of perimeter devices. The data shows state-sponsored and financially motivated actors independently target the same edge products from Ivanti, Fortinet, and Palo Alto Networks. The findings challenge the narrative that edge exploitation is exclusively a China-nexus nation-state problem, showing a broader shared attack surface.
Researcher Chaotic Eclipse released a PoC showing CVE-2026-69414's patch is bypassable, allowing arbitrary file reads as SYSTEM on current Windows.
The researcher known as Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender, dubbed ShieldCrash, assessed as a patch bypass for ShieldBreak (CVE-2026-69414, CVSS 7.8). The PoC demonstrates an arbitrary file read as SYSTEM with the latest Windows installed, and all supported desktop versions are said to be impacted. Microsoft patched the original issue in Microsoft Malware Protection Engine 1.1.26080.3, which updates automatically. The same researcher recently released PoCs for flaws in CrowdStrike Falcon Sensor, Kaspersky, Avast Antivirus and NVIDIA.
A researcher known as Nightmare-Eclipse published another zero-day exploit, dubbed ShieldCrash, targeting Windows Defender.
Dark Reading reports that the disgruntled researcher tracked as Nightmare-Eclipse continued a vendetta against Microsoft by publishing a new zero-day exploit named ShieldCrash for Windows Defender. The brief report does not detail affected versions, exploitation prerequisites, or whether exploitation has been observed.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities across Windows and Office, including two actively exploited Windows privilege-escalation zero-days.
Microsoft's September 2026 Patch Tuesday addresses 974 vulnerabilities spanning Windows, Office, SQL Server, SharePoint, Exchange, Azure, and developer tools. Two Windows zero-days are confirmed exploited in attacks: CVE-2026-85880, a Windows ALPC elevation-of-privilege flaw, and CVE-2026-81963, a Windows Update Stack privilege-escalation flaw involving link following. The release also includes Critical fixes for Windows Secure Kernel Mode, VBS Enclave, Excel, and Word.
2026 enterprise browser guide ranks Island first and notes Mammoth Cyber's wind-down plus corrections to standard vendor shortlists.
An editorial guide assesses ten enterprise browser options, ranking category creator Island first for last-mile DLP and BYOD controls, followed by Palo Alto's Talon browser as a Prisma Access/SASE surface and Google Chrome Enterprise Premium for DLP on already-deployed browsers. It corrects common lists, noting SlashNext is browser-adjacent phishing and BEC defense rather than a managed browser, and that Mammoth Cyber has wound down independent operations. Microsoft Edge for Business is positioned as effectively free policy depth for Microsoft 365 estates, with Menlo Security offering an isolation-plus-browser blend.
Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.
Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.
Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.
Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.
A ShieldCrash proof-of-concept bypasses Microsoft's patch for CVE-2026-69414, a high-severity elevation-of-privilege flaw in the Microsoft Malware Protection Engine.
Microsoft previously fixed CVE-2026-69414 (ShieldBreak), a high-severity elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender. SOCRadar now reports a new proof-of-concept dubbed ShieldCrash demonstrating that the published fix can be bypassed. The available source text does not detail affected versions or whether the bypass has been used in real attacks.