This week’s cybersecurity landscape was dominated by actively exploited zero-days, AI-assisted intrusions, session theft, and attacks against internet-facing infrastructure. Adobe Commerce, Microsoft Windows, Chrome, SonicWall, Sangoma Switchvox, MikroTik RouterOS, and WordPress installations all demanded attention, while major breaches and supply-chain incidents exposed sensitive personal information and cloud credentials. The common theme is speed: attackers are increasingly automating discovery, credential theft, and lateral movement, forcing defenders to accelerate patching, containment, and identity protection.
Major Threats & Vulnerabilities
Actively Exploited Zero-Days and Critical Patches
Adobe Commerce zero-day plants persistent malware: Attackers are exploiting the remote-code-execution vulnerability CVE-2026-75650 to install malware outside the web root. A compromise could expose credentials, tokens, payment secrets, and other sensitive information. Adobe Commerce operators should immediately apply Adobe’s hotfix, inspect systems for malware and persistence outside normal application directories, and rotate potentially exposed credentials and tokens.
Microsoft fixes nearly 1,000 security flaws: Microsoft’s September 2026 Patch Tuesday release addresses nearly 1,000 vulnerabilities, including two Windows zero-days already being exploited. Organizations should prioritize the actively exploited issues while considering system exposure, business criticality, available mitigations, and the strength of existing security controls.
Google patches another actively exploited Chrome zero-day: A crafted webpage can trigger an out-of-bounds write and potentially allow arbitrary code execution inside Chrome’s sandbox. Described as the seventh Chrome zero-day exploited in attacks this year, the vulnerability should receive expedited remediation on exposed endpoints, particularly where browser isolation and application controls are limited.
CVE-2026-85046 targets Chrome’s V8 engine: Google also patched an in-the-wild zero-day in Chrome’s V8 JavaScript and WebAssembly engine. A malicious webpage could exploit the flaw to execute arbitrary code within the browser sandbox. Administrators should confirm that managed browsers have received the fixed version and investigate endpoints showing suspicious browser activity. This issue was identified as Chrome’s sixth zero-day of the year, distinct from the subsequently reported seventh zero-day.
Samsung addresses 90 Galaxy vulnerabilities: Samsung’s September 2026 update patches 90 flaws across Android and Galaxy components. The release includes DNG and JPEG image-decoding vulnerabilities that could permit remote code execution. Organizations managing Galaxy devices should deploy the update promptly through their mobile device management processes and verify that high-risk devices are no longer running vulnerable software.
Remote Code Execution and Infrastructure Takeover
SonicWall SMA1000 flaws are chained for unauthenticated remote code execution: Two exploited vulnerabilities affect SMA1000 6210, 7210, and 8200v appliances. Customers should install the latest hotfix, investigate appliances for evidence of compromise, and avoid assuming that patching alone will remove an established attacker. If an intrusion is found, organizations should re-image the affected appliance and reset associated credentials.
Sangoma Switchvox systems face active exploitation: Attackers are exploiting CVE-2026-9586, an unauthenticated command-execution flaw, while approximately 4,000 devices remain exposed online. Organizations should upgrade affected systems and inspect logs for injected SQL, suspicious commands, and other signs that an attacker reached the underlying environment.
MikroTik RouterOS flaws permit unauthenticated router takeovers: Attackers chained two RouterOS vulnerabilities before patches were available, potentially obtaining full administrative control of routers with internet-exposed SSH services. Administrators should patch affected devices, restrict SSH exposure, review configurations and administrative accounts, and investigate for unauthorized access rather than treating the update as sufficient remediation.
WordPress migration plugin flaw exposes millions of sites: CVE-2026-19949 affects All-in-One WP Migration and Backup and can enable SQL injection. Exploitation may disclose database information and a secret key that could ultimately support remote code execution. Site owners should update the plugin, scan for indicators of exploitation, review database and application logs, and rotate exposed secrets when compromise cannot be ruled out.
FalconFlank may provide SYSTEM-level access: The FalconFlank proof of concept may allow a low-privilege Windows user to gain SYSTEM access on endpoints protected by CrowdStrike Falcon. CrowdStrike reported no active exploitation and advised customers to disable the affected Office setting while protections are deployed. Security teams should apply the recommended configuration change and monitor affected endpoints for suspicious privilege escalation.
Identity, Session, and Browser Attacks
ChatGPT vulnerability can hijack AI sessions: Malicious instructions could cause ChatGPT to execute attacker-supplied commands and relay information to another account by abusing permissions already granted to the AI service, including Gmail access. Users and administrators should remove unnecessary AI integrations and permissions, apply least privilege, and require explicit confirmation before sensitive actions or data transfers occur.
BigBear steals Microsoft 365 sessions to bypass MFA: The phishing service compromised accounts at 258 organizations by stealing authenticated sessions and using residential proxies to make malicious access appear legitimate. Because session theft can bypass conventional MFA, organizations should adopt FIDO2 or WebAuthn authentication and enforce Conditional Access policies that require trusted, managed devices.
Lenovo identity flaw exposes Dropbox accounts: Attackers exploited Lenovo’s email verification process to create unauthorized Lenovo IDs and access approximately 5,000 Dropbox accounts without knowing their passwords. None of the affected accounts had two-factor authentication enabled. Organizations should require MFA, investigate identity-linking and account-recovery workflows, and review connected accounts for unauthorized access.
PEEP turns Chrome and Edge into persistent backdoors: Disguised as a Smart Bookmarks extension, PEEP can steal browser information and authenticated sessions while executing system commands. Its persistence mechanisms demonstrate that deleting an initial malware file or extension may not fully clean an endpoint. Responders should remove the extension, inspect persistence locations, revoke browser sessions, rotate stolen credentials, and rebuild systems when complete eradication cannot be verified.
AI-Accelerated Attacks and Malware
AI agents complete an enterprise intrusion in under 10 hours: A threat actor used parallel AI agents to map systems, locate credentials, access secrets, and move through cloud and CI/CD environments. The agents compressed work that might previously have taken roughly two weeks into a matter of hours. Defenders should prepare automated containment workflows capable of revoking credentials, terminating sessions, isolating resources, and preventing exposed secrets from enabling rapid lateral movement.
AI accelerates development of a potentially massive WeChat worm: Researchers created a proof-of-concept worm capable of hijacking accounts through an unanswered incoming call and spreading to contacts. AI reportedly helped the researchers achieve remote code execution in two days and develop a working worm within a week, raising concerns about threats that could potentially reach billions of accounts. Providers and defenders should treat AI-assisted vulnerability development as a force multiplier and prepare controls that can interrupt automated propagation quickly.
Cyberattacks move toward machine speed: CrowdStrike reported an average attacker breakout time of 29 minutes and highlighted examples of agent-powered attacks. Security programs should measure mean time to defense, identify detection and response workflows still operating at human speed, and automate well-understood containment actions where appropriate.
Malware, Supply-Chain, and Cataloged Exploitation
Fake Minecraft sites continue distributing WeedHack: The campaign has persisted despite infrastructure disruption, using fraudulent Minecraft sites, search-engine optimization poisoning, Discord, GitHub, and Dropbox to distribute malware. WeedHack steals credentials, cookies, and session IDs. Users should avoid unofficial download sites, verify unusual links, block known indicators, and revoke compromised credentials and sessions if infection is detected.
CISA flags seven vulnerabilities under active attack: Seven flaws affecting AI, DevOps, communications, and remote-access products were added to CISA’s Known Exploited Vulnerabilities catalog. The issues include unauthorized access to MCP-connected tools through LiteLLM and operating-system command injection through Kestra. Organizations should identify affected products, prioritize the listed vulnerabilities for remediation, restrict exposed services, and investigate for previous exploitation.
Compromised Coder registry distributes malicious Terraform modules: Malicious infrastructure-as-code modules were served for approximately 14 hours and targeted cloud keys, CI/CD credentials, OIDC tokens, SSH keys, and other secrets. Affected users should hunt for the published indicators, remove malicious modules, assess cloud and development environments for unauthorized activity, and rotate every credential that may have been exposed.
Industry News
Major Data Breaches and Privacy Claims
IDScan faces lawsuits over an alleged 153 million-record leak: Four proposed class-action lawsuits allege that more than 153 million U.S. and Canadian driver’s license records were offered for sale on the dark web. IDScan has not confirmed either the breach or its reported scale. The claims nevertheless highlight the legal and privacy consequences of retaining large volumes of identity documents.
Mathspace breach affects more than one million users: An attacker accessed the company’s internal reporting system and stole information affecting people in Australia and New Zealand. The attacker exploited a Metabase vulnerability only four days after its disclosure, illustrating how quickly newly published flaws can be weaponized and why internet-facing business systems require rapid patching.
Aesto Health breach exposes sensitive information: A December 2025 attack affected more than 9.5 million people. Potentially exposed information includes medical, financial, insurance, and government identification data, creating risks ranging from identity theft and financial fraud to highly targeted social engineering.
Cryptocurrency Incident
Liquid Network hackers return most of a $320 million Bitcoin haul: Attackers withdrew approximately $320 million in Bitcoin and later returned most of the funds while claiming to be white hat hackers. Liquid said its authorization key was not compromised, but the key still approved the unauthorized transaction. The incident underscores the need to assess the complete authorization process, rather than focusing only on whether a cryptographic key was directly stolen.
Enterprise AI Adoption
Security teams are building custom AI agents: Organizations are developing their own agents when commercial security products do not meet operational requirements. Customization may improve workflow automation, but granting agents access to production systems introduces additional operational and security risks. Teams should tightly scope permissions, require approval for sensitive actions, test agents outside production, and retain human oversight for high-impact decisions.
Security Tips & Best Practices
Defend Against AI-Powered Phishing
- Verify unusual requests and suspicious links, even when messages appear polished, contextual, or consistent with a trusted contact’s writing style.
- Use email security controls to detect malicious links, attachments, impersonation, and abnormal sender behavior.
- Deploy phishing-resistant MFA to reduce reliance on passwords and one-time codes that attackers can capture or relay.
- Limit the ability of a successful phishing attempt to escalate into a larger incident by applying least privilege, segmenting access, and monitoring authenticated sessions.
Secure Mobile Devices Against Account and Data Compromise
- Keep mobile devices patched and use MDM or UEM tools to enforce encryption and secure configurations.
- Require phishing-resistant MFA or passkeys for access to sensitive accounts and business services.
- Restrict sideloading and remove unnecessary application permissions.
- Separate corporate information from personal applications to reduce unintended access and data leakage.
- Enable remote lock and wipe capabilities for lost or stolen devices.
Strengthen Protection for Distributed Sensitive Data
- Identify where sensitive information resides, remove unneeded data, and enforce least-privilege access.
- Use encryption and data loss prevention tools to secure information and block unauthorized transfers.
- Maintain protected backups and regularly test restoration of critical data.
- Minimize unnecessary retention and apply strong controls to every location in which sensitive information is stored.
Secure Web Browsers as a Prime Attack Surface
- Keep browsers updated and block extensions that are unnecessary or have not been approved.
- Continuously verify users, devices, and sessions with zero-trust controls.
- Isolate administrator browsing and revoke suspicious privileged access.
- Monitor browser telemetry for session hijacking, malicious extensions, and abnormal access patterns.
Reduce Website Vulnerability Exposure
- Keep content management systems, plugins, themes, and server components patched.
- Continuously scan websites for exploitable vulnerabilities rather than relying only on periodic assessments.
Protect Privileged Website Access
- Require MFA for every administrator account.
- Deploy a web application firewall to block suspicious requests before they reach the website or application.
Tools & Resources
Simplify compliance — get ready-to-use security policies to help protect your business without the cost or complexity of an enterprise, all for under $100.
If you want to see more from our Newsletter Archive please click here.