← All threat briefs

Cybersecurity Brief - 2026-09-04

SECURITY // 2026-09-04

Cybersecurity Brief — 2026-09-04

Active Exploitation & Vulnerabilities

  • Over 440,000 exploit attempts target WordPress plugins Super Forms and Elementor Pro RCE flaws — Threat actors are actively exploiting CVE-2026-14894 (CVSS 9.8) in Super Forms and CVE-2026-32475 (CVSS 9.0/9.8) in Elementor Pro, both unauthenticated arbitrary file upload bugs allowing PHP web shell deployment. Fixed in Super Forms 6.3.314 and Elementor Pro 4.2.2. (Source: The Hacker News)

  • Prolific zero-day hunter "Nightmare Eclipse" releases CrowdStrike Falcon exploit (FalconFlank) — A privilege escalation zero-day abusing the Microsoft Office malicious macros remediation feature in CrowdStrike Falcon. Works on fully patched Windows 11 25H2 and Windows Server 2025. CrowdStrike advises disabling the "Microsoft Office File Suspicious Macro Removal" policy; cloud-based AV remains effective. The same researcher also published HardBreacher (Kaspersky EDR) and PrettyPrague (Avast) PoCs this week. (Source: The Register)

  • Cisco rolls critical IOS XR bugs into update release — Three critical vulnerabilities including a "make-me-root" flaw in Nexus 9000 Series Switches (mitigatable but not fully fixable). Cisco proactively searched for and found additional bugs during internal review. (Source: The Register)

  • SonicWall SMA1000 appliances under active attack via chained zero-days — Third-party SOCs warn further attacks "almost certain" after threat actors chain zero-days to compromise devices. (Source: The Register)

Data Breaches & Identity Theft

  • FBI probes dark web service "Nexus" selling 153M+ driver's licenses — Service offers digital scans of US/Canada licenses, 10M+ ID cards, 3M+ travel documents, and 579K medical cards. Data appears sourced from a major identity verification company in Louisiana; timestamps correlate with car rental transactions (Hertz). Records include infrared/UV license scans. Active exfiltration continues (~400K new records/24hrs). (Source: Krebs on Security)

  • Legacy Lenovo login integration exposes 5,000 Dropbox accounts — Dropbox severs old Lenovo integration and urges credential resets after attackers leveraged deprecated OAuth flow. (Source: The Register)

  • Fishbrain angler app breached; password hashes and salts stolen — Cybercriminals actively cracking credentials from the fishing social network breach. (Source: The Register)

Supply Chain & Software Security

  • Plex urges immediate updates after patching multiple undisclosed flaws — Plex Media Server 1.43.3 and Plex Desktop 1.115.0 address unspecified vulnerabilities; CVE IDs requested. NAS users may need manual package installs. (Source: The Hacker News)

AI & Emerging Threats

  • OpenAI commits $1B in AI credits to frontline cyber defenders — Daybreak program provides subsidized models, training, and support to under-resourced security teams. (Source: The Register)

  • Claude Mythos only model to complete full cyber kill chain in Cyber Weapon Index — Experts warn AI-driven attacks "imminent"; evaluation framework tracks offensive AI capabilities across models. (Source: The Register)

  • AI agents demonstrated executing full ransomware kill chain, then delivering 80-page audit — Proof-of-concept shows autonomous agent chains performing reconnaissance, exploitation, encryption, and post-exploitation reporting. (Source: The Register)

  • Researchers argue "data diodes" (one-way networks) needed to contain frontier AI models — Sandboxes, permissions, and VMs insufficient for advanced agentic systems; hardware-enforced unidirectional flows proposed. (Source: The Register)

Operational Security

  • Terminated employee costs company hundreds of thousands due to unrevoked access — Departed staffer retained excessive privileges; IT lacked offboarding tracking. Classic identity governance failure. (Source: The Register)

Brief compiled from The Hacker News, Krebs on Security, and The Register (Security section). All items published or updated within the last 48 hours as of 2026-09-04.