Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploited
60
Microsoft Issues Patches for Actively Exploited Excel, Exchange Server 0
60
60
Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs
Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.
Kaspersky researchers link the campaign to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore), with victims in aviation, aerospace and fintech in Egypt, Ethiopia and Afghanistan. Trojanized npm dependencies (colorized_terminal, pretty-log) bundled in coding-challenge archives launch the Node.js implants across Windows, Linux and macOS. NodeRabbit uses AES-256-GCM-encrypted C2 via Azure, and its third variant persists through a fake GitHub Copilot Helper VS Code extension plus Git post-merge/post-checkout hooks. PollCat is an obfuscated JavaScript RAT that registers with C2 before OTP authentication and inventories tools from 24 security vendors.
72
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.
CVE-2026-45659 is a deserialization of untrusted data RCE in Microsoft SharePoint Server affecting Subscription Edition, 2019, and 2016, patched by Microsoft in May 2026. An authenticated attacker with at least Site Member permissions can execute code remotely over the network. CISA added the flaw to its KEV catalog on July 2 with a July 4 deadline for federal agencies, and on August 11 confirmed ransomware groups are exploiting it. Microsoft separately described Storm-2603 (Warlock ransomware) and an unrelated actor co-existing in one network, with initial access likely via the Gladinet Triofox flaw CVE-2025-11371 (CVSS 9.1).
78
SolarWinds Web Help Desk Exploited for RCE in Multi
60
Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs
Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.
PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.
55
Microsoft Releases Fix for New Zero
60
Risky Bulletin: BEC campaign steals €35 million from French notaries
Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.
A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.
72
Microsoft Patch Tuesday, September 2026 Security Update Review
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.
74
Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1
Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.
Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.
65
60
60
Microsoft Patch Tuesday for October 2022 doesn't fix Exchange Server flaws
60
Microsoft and Other Major Software Firms Release February 2022 Patch Updates
60
Update Your Windows PCs to Patch 117 New Flaws, Including 9 Zero
60
Update Your Windows Computers to Patch 6 New In-the-Wild Zero
60
Microsoft June 2021 Patch Tuesday addresses 6 0days actively exploited
60
Microsoft Patch Tuesday — February 2019 Update Fixes 77 Flaws
60
March 2019 Patch Tuesday: Microsoft patches two actively exploited Windows flaws
60
Microsoft Patch Tuesday for May 2021 fix 4 critical flaws
60
Microsoft Patch Tuesday security updates for November 2024 fix two actively exploited zero
60
Microsoft January 2019 Patch Tuesday updates fix 7 critical vulnerabilities
60
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
60
Critical Security Patches Issued by Microsoft, Adobe and Other Major Software Firms
60
Microsoft Patches Record 622 Flaws, Including Two Zero
60
Microsoft Patch Tuesday for July 2024 fixed 2 actively exploited zero
60
60
August 2018 Microsoft Patch Tuesday fixes two flaws exploited in attacks in the wild
60
Microsoft, Adobe fix zero-days exploited by attackers (CVE-2023-26369, CVE-2023-36761, CVE-2023-36802)
60
Patch Tuesday: Microsoft fixes 5 actively exploited zero-days
60
Microsoft Patch Tuesday for November 2025 — Snort rules and prominent vulnerabilities
60
60
Microsoft Patch Tuesday for September 2023 — Unusually low 5 critical vulnerabilities included in Microsoft Patch Tuesday, along with two zero
60
Patch Tuesday Fixes Two Zero
60
Exploit kits attack vector – mid
60
December 2019 Patch Tuesday: Microsoft fixes one actively exploited zero-day
60
Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
60
Microsoft Fixes 90 New Flaws, Including Actively Exploited NTLM and Task Scheduler Bugs
60
Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
60