← All threat briefs

Cybersecurity Brief - 2026-09-09

SECURITY // 2026-09-09

Cybersecurity Brief — 2026-09-09

Vulnerabilities & Exploits

  • Chrome V8 zero-day (CVE-2026-87491) actively exploited — Google patched an out-of-bounds write in V8 (Chrome 153.0.8010.36) that allows arbitrary code execution inside the sandbox via a crafted HTML page. This is the 7th actively exploited Chrome zero-day in 2026. Update Chrome and all Chromium-based browsers immediately. (Source: The Hacker News)

  • cPanel privilege escalation (CVE-2026-67401) — SQL injection in EmailTrack lets an authenticated hosting account with mail privileges write arbitrary files and execute code as root on the entire server. All supported cPanel/WHM versions affected; fixed builds released Sept 8 (11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, WP Squared 11.138.1.9). No mitigation guidance for servers that cannot update immediately. (Source: The Hacker News)

  • Microsoft Patch Tuesday: 974 CVEs (record) — Largest single patch batch ever; 113 rated critical. Two zero-days under active exploitation: CVE-2026-81963 and CVE-2026-85880 (both Windows privilege escalation via ALPC). CISA added both to KEV with Sept 22 federal deadline. Notable critical: CVE-2026-69730 (DNS, wormable potential) and CVE-2026-69829 (Windows Shell RCE, CVSS 9.8). 2026 total now >2,600 CVEs. (Source: Krebs on Security, The Register)

  • Adobe Commerce/Magento "StyleSmuggler" (CVE-2026-75650) — Max-severity unauthenticated RCE exploited since Sept 4. Attackers inject malicious PHP via template "styles" properties, installing C2 backdoors. All versions 2.4.4–2.4.9 affected. Adobe shipped hotfix Sept 8; CISA KEV deadline Sept 11 for federal agencies. Prioritize immediately if you run any Magento/Adobe Commerce storefront. (Source: The Register)

Breaches & Threat Activity

  • FBI investigates "Nexus" identity theft service — 153M+ driver's licenses — Dark web service selling scans of US/Canada licenses, plus 10M+ ID cards, 3M+ travel documents, 579K medical cards. Data appears sourced from a Louisiana-based identity verification company; timestamps correlate with car rental (Hertz) and airport activity. Active exfiltration ongoing >1 year; ~400K new records added in 24h. FBI New Orleans field office inquiry launched. (Source: Krebs on Security)

  • BigBear phishing crew harvests 5,137 Microsoft 365 credentials — Researchers infiltrated the gang's admin panel, finding stolen creds from 461 organizations. Campaign uses adversary-in-the-middle phishing kits targeting M365. (Source: The Register)

  • Boston Scientific confirms cyberattack impacting earnings — Medical device giant warns August intrusion will hit Q3 and full-year sales/earnings as recovery drags on. (Source: The Register)

  • Liquid Network: $320M (4,000 BTC) drained — Attackers claim "white hat" motive, promise to return "most" funds after vulnerability fixed. (Source: The Register)

Notable Research & Trends

  • OpenAI Artifactory covert data-stealing channel — Rogue agents used cross-account trick alongside Hugging Face zero-day for admin access; disclosed same day. (Source: The Register)

  • ASCII smuggling via invisible Unicode tags — Phishers now using Unicode tag characters to evade filters; not just an AI security risk. (Source: The Register)

  • LG accused of "egregious invasion of privacy" — TV data collection practices under scrutiny; follows earlier monitor adware controversy. (Source: The Register)

Action Items

  1. Patch Chrome/Chromium browsers to 153.0.8010.36+ immediately (CVE-2026-87491).
  2. Update cPanel/WHM to fixed builds (CVE-2026-67401) — no interim mitigation documented.
  3. Apply Microsoft Sept patches — prioritize the two exploited zero-days (CVE-2026-81963, CVE-2026-85880) and the wormable DNS flaw (CVE-2026-69730).
  4. Patch Adobe Commerce/Magento now (CVE-2026-75650) — CISA deadline Sept 11, active exploitation confirmed.
  5. Monitor for identity theft — if you've rented from Hertz or used identity verification services recently, consider credit freeze/monitoring given Nexus breach scope.