← All threat briefs

Cybersecurity Brief - 2026-09-08

SECURITY // 2026-09-08

Cybersecurity Brief — 2026-09-08

Critical Vulnerabilities & Exploits

  • Adobe patches Magento zero-day (CVE-2026-75650, CVSS 10.0) actively exploited as "StyleSmuggler" — Adobe released emergency patches for a maximum-severity flaw in Adobe Commerce and Magento Open Source. The vulnerability abuses Magento's template system via PHP code injection in "Payment Transaction Failed Reminder" emails to achieve arbitrary code execution. Sansec discovered zero-day exploitation starting September 4, 2026; attackers deployed a Rust backdoor and PHP web shell. (Source: The Hacker News)

  • CISA adds Google Chromium V8 type confusion (CVE-2026-85046) to Known Exploited Vulnerabilities catalog — CISA added one new vulnerability to its KEV catalog on September 4 based on evidence of active exploitation. The type confusion flaw in Chromium V8 is a frequent attack vector posing significant risk to federal enterprises. Federal agencies must prioritize rapid remediation per BOD 26-04. (Source: CISA)

Data Breaches & Identity Theft

  • FBI investigates "Nexus" dark web service selling 153M+ driver's licenses from US and Canada — A new identity theft service on the Russian cybercrime forum Exploit offers digital scans of >153M driver's licenses, >10M ID cards, >3M travel documents, and 579K+ medical cards. KrebsOnSecurity traced the data to a Louisiana-based identity verification company serving Fortune 500 clients. Records include infrared/UV license scans with timestamps correlating to Hertz car rental transactions. The New Orleans FBI field office has opened an official inquiry. (Source: Krebs on Security)

Threat Actor Activity

  • Australian Federal Police arrest two alleged TeamPCP members behind massive software supply chain campaign — Two men (21, 23) from Western Australia were arrested for operating TeamPCP, a cybercrime syndicate that compromised hundreds of open-source tools via the self-propagating "Shai-Hulud" worm. The group phished GitHub/NPM credentials, planted malicious code in developer tools, and ran a $1,000 Monero contest incentivizing supply chain attacks on popular libraries. TeamPCP compromised LiteLLM (2,500+ orgs affected) and 3,800+ GitHub repositories. The group operates as a loose "Cybercats" Matrix community linked to multiple threat actors. (Source: Krebs on Security)

  • BengalSEO SEO poisoning campaign hijacks Bing results to deliver MayaBot malware and tech support scams — Operating from Rajasthan, India since 2015, BengalSEO (WeConnect Solutions LLC and Garage2Global) uses black hat SEO — backlink spam, DOM injection, DOM shuffling, keyword stuffing — to rank malicious lure pages impersonating tech support portals (Vizio, Bitdefender, antivirus tools). A traffic distribution system (TDS) with Matomo analytics routes victims through Cloudflare/hCaptcha challenges to payload domains delivering MayaBot (C2, system monitoring, XMRig miner) or scam call centers. The Vizio decoy page alone had 2,000 backlinks from 167 domains. (Source: The Hacker News)

Regulatory & Privacy

  • Grindr pays £26M ($35.1M) to settle UK lawsuit over HIV status data sharing — The LGBTQ+ dating app settled a class action alleging it shared users' HIV status and personal data with third parties for advertising before 2020 under prior owner Kunlun. The settlement includes no admission of liability. (Source: The Hacker News)