57
45
60
45
50
60
57
45
57
55
45
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Ontinue disclosed TWINLOOT, a Python implant hiding C2 in SharePoint dead drops and Teams TURN relays, harvesting credentials and pivoting via reverse SOCKS5.
Ontinue's Cyber Defense Center identified TWINLOOT during a July 2026 campaign investigation: a modular, PyArmor-hardened Python implant (a 39 MB bootstrap-fat.pyc loader) whose entire C2 infrastructure lives inside trusted Microsoft services. Tasking flows through SharePoint Online file dead drops polled every 15 seconds via the Microsoft Graph API, while interactive operator access uses WebRTC DataChannels relayed by Microsoft Teams TURN servers; Graph traffic is driven by the victim's own headless Edge browser. The implant harvests Windows credentials with fake lock screens, offers a reverse SOCKS5 pivot for lateral movement to SMB, RDP, WinRM, and MSSQL, executes commands, and persists on hosts. Initial access is assessed to be Teams social engineering masquerading as IT support, prompting a PowerShell command to download the payload.
60
30
57
57
30
Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild
Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.
Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.
82
30
30
55
45
60
30
45
The Apple Security Update Review for September 2026
Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.
ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.
75
Apple Updates Everything, (Mon, Sep 14th)
Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.
Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.
58
30
30
30
30
57
60
60
Urgent: New Chrome Zero-Day Vulnerability Exploited in the Wild
60
Google addressed a new actively exploited Chrome zero
60
47
60
60
30
55