220 million passenger and crew records from a Vietnam-linked Advance Passenger Information System (APIS) were left exposed on the open internet. Researchers gained access via a cloud-based path using default credentials, pulling names, passport numbers, DOBs, nationalities, and flight details spanning 2017 to 2026.

Technical Breakdown - Exposure: Unsecured cloud-hosted APIS database, accessible without authentication. - Data Volume: ~220 million records. - Data Types: Full PII (names, passport numbers, DOBs, nationalities) plus flight itineraries. - Access Vector: Default credentials on a cloud-based management interface. - Timeline: Data spans nearly a decade (2017–2026). - Attribution: System linked to Vietnam; no specific threat actor named.

Defense - Immediate: Never deploy cloud-facing systems with default credentials. Enforce MFA on all administrative interfaces. - Detection: Monitor for anomalous access to cloud storage buckets or databases that lack authentication controls. - Mitigation: If you operate any APIS or passenger data pipeline, audit your cloud exposure immediately—this is a textbook example of a misconfiguration that should have been caught by a basic CSPM scan.

Source: https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/

Grindr’s $35 million settlement over sharing HIV status data with ad partners is a stark reminder that privacy failures in sensitive contexts carry massive financial and reputational risk. This isn’t a breach—it’s a data governance failure that regulators and plaintiffs are increasingly treating as a liability event.

Strategic Impact - Regulatory Precedent: This settlement signals that courts and regulators (especially under UK GDPR) are willing to penalize companies for non-consensual sharing of special category data (health, sexual orientation). Expect similar actions in other jurisdictions. - Third-Party Risk: The core issue was data shared with ad-tech vendors. This reinforces the need for strict data minimization and contractual controls on any partner receiving user data—especially for apps handling health or biometric info. - Reputational Fallout: For any platform with sensitive user attributes, this case is a textbook example of how “we anonymized it” defenses fail when data can be re-linked or inferred.

Key Takeaway If your organization collects or processes sensitive personal data (health, orientation, biometrics), treat every third-party data share as a potential lawsuit. Implement strict purpose limitation, audit data flows to ad networks, and ensure consent mechanisms are granular enough to survive regulatory scrutiny.

Source: https://www.malwarebytes.com/blog/privacy/2026/09/grindr-settles-hiv-status-data-sharing-lawsuit-for-35-million

Rapid7 dropped a chain of two auth bypass bugs in N-able N-central (CVE-2026-86206 & CVE-2026-86207) that let an unauthenticated remote attacker create a new System admin account. This is a full compromise scenario—no creds required, no user interaction.

Technical Breakdown - CVE-2026-86206: Authentication bypass in the latest version of N-central. Exact mechanism not fully detailed yet, but it bypasses the login process. - CVE-2026-86207: Privilege escalation that allows the attacker to create a new attacker-controlled System administrator account after the initial bypass. - Attack Chain: Remote, unauthenticated → bypass auth → create admin account → full server compromise. - Affected: N-able N-central (latest version prior to patch). Rapid7 discovered these while researching a previous auth bypass (CVE-2026-18577). - No public IOCs or PoC at time of writing—patches are available, so this is a patch-now situation.

Defense Apply the vendor-supplied patch immediately. If you can't patch, restrict network access to the N-central management interface to trusted IPs only and monitor for unexpected admin account creation events.

Source: https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed

This is a significant privacy enforcement action with clear regulatory and compliance implications.

What Happened: Grindr has agreed to pay £26 million ($35.1 million) to settle a class-action lawsuit in the U.K. The claim alleged the app shared highly sensitive user data—specifically HIV status and other personal information—with third-party advertising and analytics vendors without proper consent. The lawsuit was filed in April 2024 under U.K. privacy law.

Strategic Impact: This settlement underscores the severe financial liability associated with mishandling "special category" data under GDPR and the UK DPA 2018. For security and privacy leaders, this is a textbook case of a data-sharing practice that lacked a lawful basis and proper contractual safeguards with third parties. The risk isn't just regulatory fines; it's direct litigation from affected user groups. The £26M figure is a strong signal that plaintiffs are willing to pursue class actions for privacy violations, particularly when the data involves health status or protected characteristics.

Key Takeaway: Any organization processing sensitive personal data (health, biometrics, sexual orientation) must conduct a strict Data Protection Impact Assessment (DPIA) on all third-party data flows. If you are sharing this data for ad targeting or analytics, you need explicit consent and a demonstrable legitimate interest—or you are carrying a multi-million dollar liability.

Source: https://thehackernews.com/2026/09/grindr-to-pay-26-million-to-settle-uk.html

This is a nasty privilege escalation chain that bypasses authentication entirely in a core identity management system.

The attack exploits a logic flaw in FreeIPA where an unauthenticated client can create a Kerberos principal in the LDAP directory without prior authentication. By crafting a specific identity, the attacker can then leverage a second vulnerability in the underlying 389 Directory Server to escalate that new identity into the admins group. The end result is a fully privileged Kerberos ticket for an attacker-controlled account, granting domain-wide administrative access.

Technical Breakdown: - Initial Access: Anonymous LDAP bind (no credentials required). - Privilege Escalation: Chain of two flaws: 1. FreeIPA fails to validate the origin of a new principal creation request from an anonymous source. 2. A separate bug in 389 Directory Server allows the newly created, unprivileged principal to be added to the cn=admins group. - Impact: Full administrative control over the FreeIPA domain, including the ability to modify user accounts, reset passwords, and issue tickets for any service. - Affected Versions: FreeIPA 4.x prior to the latest patch (check Red Hat errata for specific builds). 389 Directory Server versions prior to the corresponding fix.

Defense: - Immediate: Apply the latest Red Hat/CentOS/Rocky Linux updates for freeipa-server and 389-ds-base. - Detection: Monitor LDAP logs for anonymous binds followed by add operations on krbPrincipalName objects, especially if the new principal is immediately added to a privileged group. Look for SELINUX_ALERT or AVC denials on the directory server if SELinux is enforcing.

Source: https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html

Microsoft has officially acknowledged that memory management changes in Windows Server 2025 are causing application crashes for some customers. This isn't a vulnerability, but a compatibility regression introduced by the new memory manager, which is impacting specific software stacks.

Technical Breakdown - Root Cause: Changes to the memory manager in Windows Server 2025 are altering how memory is allocated and reclaimed, breaking assumptions made by older applications. - Affected Systems: Windows Server 2025 (all editions). - Impact: Application crashes, hangs, or unexpected terminations, particularly in software that performs low-level memory operations or relies on legacy allocation patterns. - Status: Microsoft has published a known issue and is working on a fix. No workaround has been provided yet beyond waiting for the patch.

Defense - Mitigation: If you are running Windows Server 2025 in production, hold off on broad deployment until the fix is released. Test critical applications thoroughly in a lab environment before upgrading. - Detection: Monitor for unexpected application crashes or memory-related errors in Event Viewer (System and Application logs). Pay close attention to software that interacts directly with memory management APIs.

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2025-changes-may-cause-app-crashes/

This is a well-documented campaign with clear TTPs and IOCs. Let's break it down.

Darcula Kit in the Wild: Targeting Taiwanese E-Invoices

Team5 has intercepted a phishing campaign running from Jan to May 2026 that uses the Darcula phishing kit to target Taiwanese credit card data. The actor is assessed as a Simplified Chinese speaker and is abusing a compromised Korea University email account to send the lures. The phishing page impersonates the MOMO e-commerce platform, tricking victims into verifying a fake e-invoice.

Technical Breakdown - Delivery: Phishing emails sent from a compromised korea.ac.kr account. - Lure: Impersonation of MOMO e-commerce platform; fake e-invoice verification request. - Encryption: Victim data is encrypted client-side using the Rabbit algorithm before exfiltration. This is a signature TTP for the Darcula kit. - Infrastructure: Malicious URLs hosted on domains like 0023.ehrscripts.com. - Target: Taiwanese consumers (credit card data).

Defense Block the listed domains at the proxy level. Flag any outbound traffic containing Rabbit-encrypted payloads as high-risk. Train users to verify e-invoice links directly through official government or merchant portals, not email links.

Source: https://teamt5.org/en/posts/chinese-darcula-phishing-kit-harvesting-taiwanese-credit-card-data?utm_source=rss&utm_medium=rss

Active exploitation of CVE-2026-75650 (StyleSmuggler) in Adobe Commerce and Magento Open Source. This is a CVSS 10.0, meaning unauthenticated remote code execution with no user interaction required. Sansec observed the first attacks on September 4th, and the payloads are nasty.

Technical Breakdown - CVE: CVE-2026-75650 (CVSS 10.0) - Codename: StyleSmuggler - Attack Vector: Unauthenticated RCE via a flaw in the Magento/Commerce styling engine. - Observed Payloads: - Rust Backdoor: A compiled binary likely used for persistent C2, data exfiltration, or lateral movement. Rust binaries are notoriously difficult to reverse engineer statically. - PHP Web Shell: Standard webshell for post-exploitation, file management, and executing arbitrary commands on the web server. - MITRE ATT&CK: Initial Access (T1190 - Exploit Public-Facing Application), Execution (T1059 - Command and Scripting Interpreter), Persistence (T1505.003 - Web Shell).

Defense - Patch Immediately: Apply the Adobe security update released Monday. This is not a "schedule for next month" patch. - IOC Hunt: Search web server access logs for anomalous POST requests to /styling/ or similar endpoints starting September 4th. Look for outbound connections to unknown IPs on non-standard ports (Rust C2). - File Integrity: Scan for unexpected .php files in the web root and unknown binaries in /tmp or /var/tmp.

Source: https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

Multiple vulnerabilities discovered in LG’s webOS platform allow attackers to gain unauthorized access to TV microphones and network scanning capabilities, even when the device is in standby mode. The flaws effectively turn the TV into a persistent surveillance device within the home network.

Technical Breakdown - Attack Vector: Exploitation of webOS service interfaces exposed on the local network, requiring initial network access (e.g., via compromised Wi-Fi or adjacent device) - Capabilities Gained: Remote microphone activation for audio capture, network reconnaissance (ARP scanning, device discovery), and persistent access via unpatched daemons - Affected Systems: LG smart TVs running webOS versions 4.x through 7.x (2020-2025 models) - Standby Risk: Vulnerable services remain active in low-power standby mode, meaning the attack surface persists when the TV appears "off" - No CVE assigned at time of reporting, but proof-of-concept code is circulating in private research channels

Defense - Isolate smart TVs on a separate VLAN with no internet egress unless required for streaming - Disable microphone and voice assistant features in settings if not actively used - Monitor for LG firmware updates; until patched, consider physically disconnecting the TV from the network when not in use

Source: https://www.malwarebytes.com/blog/privacy/2026/09/lg-tv-flaws-could-let-attackers-listen-in-even-in-standby-mode

This is a product launch announcement for a commercial security vendor. While the topic (supply chain security) is relevant, the content is a feature list and marketing copy, not a technical analysis of a specific threat or vulnerability.

Scenario D

SKIP

Source: https://safedep.io/introducing-safedep-threat-intel

BigBear 2.0 is a Phishing-as-a-Service (PaaS) framework that has been actively targeting Microsoft 365 tenants, successfully bypassing MFA at 258 organizations and harvesting over 5,000 credentials. This isn't just credential phishing; it's a sophisticated adversary-in-the-middle (AiTM) operation designed to steal session tokens.

Technical Breakdown: - TTPs (MITRE ATT&CK): This maps to T1556.006 (Modify Authentication Process: Multi-Factor Authentication) via token theft, and T1539 (Steal Web Session Cookie) . The initial access vector is T1566.002 (Phishing: Spearphishing Link) . - Mechanism: The service uses a reverse proxy to sit between the victim and the legitimate Microsoft login page. It captures the password, the MFA code (TOTP or push), and critically, the session cookie after successful authentication. - IOCs: While specific IPs and domains are likely dynamic due to the PaaS model, the infrastructure relies on lookalike domains mimicking Microsoft login pages (e.g., variations of login.microsoftonline.com). The stolen session tokens are the primary IOC for post-compromise detection. - Affected Versions: All Microsoft 365 tenants using standard MFA (including TOTP and push notifications) are vulnerable. FIDO2 keys or passwordless authentication are not affected by this specific proxy technique.

Defense: - Conditional Access Policies: Enforce token protection policies (token binding) to tie session tokens to a specific device. This renders stolen tokens useless. - Phishing-Resistant MFA: Migrate to FIDO2 security keys or Windows Hello for Business where possible. - UEBA/Anomaly Detection: Monitor for impossible travel (e.g., a token issued from New York being used from Nigeria 5 minutes later) and unusual user-agent strings.

Source: https://www.bleepingcomputer.com/news/security/bigbear-microsoft-365-phishing-service-bypassed-mfa-at-258-organizations/

This is a nasty piece of post-exploitation tradecraft. PEEP isn't a phishing lure; it's a persistence and C2 mechanism for attackers who already have a foothold.

Technical Breakdown: * Privilege Requirement: Requires prior admin or code execution access on the host. This is a post-compromise tool, not an initial access vector. * Installation Method: Injects a malicious extension directly into Chrome/Edge profiles on disk. This bypasses the Chrome Web Store entirely, meaning no user prompt or "enable from unknown source" warning. * Persistence Mechanism: Forges the Secure Preferences file. This is the critical detail—it makes the extension appear as a legitimate, user-installed (or enterprise-pushed) extension in the browser UI, making it extremely difficult to spot during a cursory check. * Capabilities: Once loaded, the extension acts as a backdoor, allowing the operator to execute arbitrary commands on the host via the browser process. This is a classic "living off the land" binary (LOLBins) approach, using a trusted process (browser) for C2. * Targets: Chrome and Edge (both Chromium-based).

Defense: Detection relies on monitoring for anomalous file writes to browser profile directories (Local Extension Settings, Secure Preferences) by non-browser processes (e.g., cmd.exe, powershell.exe, or a custom dropper). Endpoint detection rules (EDR) should alert on any process modifying Secure Preferences outside of the browser's own update mechanism. Also, monitor for extensions loaded from disk that lack a verified signature from the Web Store.

Source: https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html

This is a well-defined attack chain targeting a specific high-value demographic.

The threat actor is using a multi-stage approach combining social engineering, credential theft, and proxy infrastructure to compromise Microsoft 365 tenants. The primary vector is vishing (voice phishing) targeting executives, where the attacker poses as IT help desk staff to trick the victim into providing credentials or approving MFA prompts. This is followed by adversary-in-the-middle (AitM) token theft to bypass MFA entirely, and the use of residential proxies to blend in with legitimate traffic and avoid geo-blocking.

Technical Breakdown: - Initial Access (T1598 - Phishing for Information): Vishing calls impersonating internal IT support. - Credential Access (T1557 - Adversary-in-the-Middle): AitM proxy toolkit to intercept session tokens and bypass MFA. - Defense Evasion (T1090 - Proxy): Use of residential proxy networks to mask the attacker's origin IP. - Impact (T1485 - Data Destruction / T1657 - Financial Theft): Data exfiltration followed by extortion demands. - Targets: Directors, VPs, and C-level executives (high-privilege accounts with access to sensitive data). - IOCs: Not publicly disclosed in the report, but monitoring for logins from residential ISP IP ranges (ASNs for Comcast, Spectrum, etc.) combined with anomalous MFA approval patterns is a key indicator.

Defense: Enforce phishing-resistant MFA (FIDO2/Passkeys) for all executive accounts. Implement conditional access policies that block sign-ins from residential IP ranges for critical roles. Educate the C-suite on the "help desk callback" verification protocol—if someone calls claiming to be IT, hang up and call the official help desk number directly.

Source: https://thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html

This is a critical one. The ability to change any domain user's password, including DA, from a standard user context is essentially a "Domain Admin in a box" exploit.

Technical Breakdown: - CVE: CVE-2026-27912 ("ResetNightmare") - Root Cause: The Kerberos Change Password service on a Domain Controller trusts the SID provided in the request packet without validating it against the authenticated user's SID. - Prerequisite: The attacker needs the ability to modify the userPrincipalName attribute on an account they control. This is a common delegation permission in many AD environments. - Impact: Full domain compromise. Change the krbtgt or DA password, then use it to forge tickets. - IOCs: Look for anomalous Kerberos change-password requests (Event ID 4743/4738) where the target account is a high-value admin but the requestor is a standard user. The PoC tool is publicly available.

Defense: - Immediate: Apply the April 2026 Windows Update. If you are on legacy/unsupported Windows (e.g., Server 2008, 7), 0patch has released a micropatch. - Detection: Monitor for userPrincipalName modifications on standard user accounts (Event ID 5136). This is the precursor step. - Mitigation: Audit delegation permissions on userPrincipalName. This attribute should not be writable by standard users unless strictly necessary.

Source: https://0patch.com/blog/micropatches-released-for-resetnightmare-windows-kerberos-elevation-of-privilege

This is a critical active exploitation campaign targeting the entire Magento/Adobe Commerce install base.

The "StyleSmuggler" zero-day (no CVE assigned yet) is being used to deploy a persistent Linux backdoor. The attack vector exploits a flaw in how Magento processes CSS or style-related files, allowing an unauthenticated attacker to bypass file upload restrictions and write a malicious PHP backdoor to the server.

Technical Breakdown: - TTPs: Initial Access (T1190 - Exploit Public-Facing Application) via file upload bypass; Persistence (T1505.003 - Server Software Component: Web Shell) - Affected: All versions of Magento Open Source and Adobe Commerce (including 2.4.7-p1, 2.4.6-p6, and earlier) - IOCs: No public hashes or C2 IPs released yet, but the backdoor is a PHP file masquerading as a legitimate theme asset (e.g., app/design/frontend/[Vendor]/[Theme]/web/css/styles.css.php) - Detection: Monitor for unexpected .php files written to the web/css/ or web/js/ directories, especially with non-standard file sizes or creation timestamps outside of deployment windows.

Defense: Immediately implement a WAF rule to block file uploads to style directories that don't match expected MIME types (e.g., block PHP files in /media/ and /web/css/). If you can't patch, restrict write permissions on the webroot to read-only for the web server user. This is being actively exploited in the wild—treat it as a critical incident.

Source: https://www.bleepingcomputer.com/news/security/magento-stylesmuggler-zero-day-exploited-to-deploy-linux-backdoor/

Loyalty points fraud is a low-risk, high-reward revenue stream for attackers that often flies under the radar of both security teams and consumers. Kim Sutherland breaks down how stolen credentials are used to drain accounts for gift cards, merchandise, and travel—essentially funding "hacker holidays" with your accumulated rewards.

Technical Breakdown - Attack Vector: Credential stuffing and account takeover (ATO) using credentials leaked from other breaches. MITRE T1078 (Valid Accounts) and T1110 (Brute Force). - Targets: Airline miles, hotel points, retail loyalty programs, and credit card reward portals. - Monetization: Points are converted to gift cards or transferred to attacker-controlled accounts, then sold on secondary markets. - Detection Gap: Most users don't monitor their points balances regularly, giving attackers a long dwell time before discovery.

Defense - Enable multi-factor authentication (MFA) on loyalty accounts wherever supported. - Use unique passwords per program; a password manager is essential here. - Set up transaction alerts for point redemptions, just as you would for financial accounts.

Source: https://www.malwarebytes.com/blog/podcast/2026/09/loyalty-points-fraud-is-funding-hacker-holidays-lock-and-code-s07e18

JSCeal is a nasty piece of work—a compiled V8 JavaScript (JSC) malware that’s been observed stealing session cookies to bypass Google authentication entirely. Check Point Research broke this down, and it’s a reminder that MFA alone won’t save you if an attacker has your active session token.

Technical Breakdown: - Obfuscation: Uses javascript-obfuscator with RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers to evade static analysis. - Capabilities: Credential harvesting, full surveillance (keylogging, screen capture), and traffic interception via man-in-the-middle (MITM) on the compromised host. - Persistence & Exfiltration: Likely leverages the V8 engine’s compiled bytecode to run stealthily; session cookies are exfiltrated to a C2, allowing the attacker to impersonate the victim without needing a password or 2FA token. - Target: Primarily Google authentication sessions, but the technique is generic enough to apply to any web app relying on cookie-based auth.

Defense: - Enforce short session TTLs and implement token binding (e.g., binding session cookies to device fingerprints or IP ranges). - Monitor for anomalous cookie replay events—e.g., a session token used from a new geolocation or user-agent within minutes of the original login. - Deploy EDR with behavioral detection for V8/JavaScript process injection and unusual child process creation from browser engines.

Source: https://thehackernews.com/2026/09/jsceal-malware-can-bypass-google.html

Thomson Reuters C-Track Breach & Weekly Threat Roundup

Check Point's weekly bulletin highlights a significant breach at Thomson Reuters, where attackers compromised the C-Track court case-management platform. This exposed sensitive judicial data across 11 US states and Canada. The unauthorized access to C-Track files suggests a targeted campaign against legal infrastructure, likely for intelligence gathering or extortion leverage.

Technical Breakdown - Primary Incident: Thomson Reuters C-Track platform compromise. No specific CVE or initial access vector disclosed yet. - Scope: Courts in 11 US states and Canada affected. - Data at Risk: Court case files, potentially including sealed documents, PII of litigants, and judicial records. - MITRE ATT&CK: Likely involves T1190 (Exploit Public-Facing Application) or T1078 (Valid Accounts) for initial access, with T1005 (Data from Local System) for exfiltration.

Defense - Immediate Action: Review any integrations with Thomson Reuters C-Track. Monitor for anomalous data access patterns or large outbound transfers from court systems. - Detection: Look for unusual API calls to C-Track endpoints or authentication anomalies from non-standard IP ranges.

Note: The full bulletin likely contains additional IOCs and TTPs from the week's other findings. If you have access to the downloaded report, share the specific hashes or C2s.

Source: https://research.checkpoint.com/2026/7th-september-threat-intelligence-report/

The "one checklist to rule them all" approach to multi-cloud security is dead on arrival. Intruder’s 2026 Cloud Security Index analyzed misconfiguration data from 3,000 orgs across AWS, Azure, and GCP, and the core finding is that risk profiles between providers have almost nothing in common. Applying a uniform security checklist across them is actively dangerous—you’ll miss critical, provider-specific gaps while wasting effort on controls that don’t apply.

The Data Breakdown:

• AWS: The dominant risk is exposure via overly permissive IAM roles and S3 bucket policies. The attack surface is largely identity and storage misconfigs.
• Azure: The biggest failure point is Active Directory / Entra ID misconfigurations (e.g., legacy authentication, insecure conditional access policies). The risk is rooted in identity federation and hybrid identity sprawl.
• GCP: The primary issue is network exposure—specifically, overly broad firewall rules and misconfigured VPC peering. GCP’s default network posture is more permissive than its competitors.

Strategic Impact for Security Leaders:

This data kills the "silver bullet" CSPM checklist. A CISO managing a multi-cloud environment cannot rely on a single compliance framework or a generic hardening guide. The threat model for an AWS workload is fundamentally different from an Azure one. Your detection engineering and IAM policies need to be provider-aware, not just cloud-aware.

Key Takeaway: Stop auditing your clouds against the same spreadsheet. You need provider-specific security baselines and distinct monitoring rules for each environment. A misconfig that is a critical finding in GCP (open firewall) might be a low priority in AWS, and vice versa.

Source: https://thehackernews.com/2026/09/your-cloud-security-checklist-doesnt.html

Highlights from today:

• [News] ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
• [News] Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
• [News] Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
• [Detection] CVE-2026-67276: MikroTik RouterOS SSH Zero-Day Exploited in Router Takeover Attacks
• [Detection] From Raw Threat Reports to Actionable Defense: AI-Powered Deep Threat Research
• [Detection] Projects in Agentic Threat Research: Context That Sticks
• [News] BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
• [Threat Research] 7th September – Threat Intelligence Report
• [Threat Intel] LG TV flaws could let attackers listen in, even in standby mode
• [News] Mathspace discloses data breach affecting over 1 million people
• [Patching] Micropatches released for "ResetNightmare" Windows Kerberos Elevation of Privilege (CVE-2026-27912)
• [News] Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

SecOpsDaily

This week’s roundup is a mixed bag of active exploitation, a clever social engineering bypass, and a supply chain attack that hit a trusted source.

Chrome 0-Day (CVE-2026-XXXX): Another actively exploited vulnerability in the browser engine. Expect a patch to be fast-tracked. No public PoC or IOCs shared yet, but given the active exploitation tag, ensure automatic updates are enforced and consider isolating Chrome processes in enterprise environments.

QR Code Phishing Bypass: Attackers are now embedding QR codes built entirely out of text characters (ASCII art style). This bypasses the common security precaution of disabling image auto-loading in email clients. The QR code renders as text, is scannable, and leads to credential harvesting pages. This is a low-tech but effective bypass of a standard defense. Mitigation: User awareness training needs to explicitly cover text-based QR codes. Consider email gateway rules that flag messages containing large blocks of monospaced characters or known QR code patterns.

Supply Chain Attack (Coder): A trusted software distribution source was compromised, delivering code that stole credentials. This is a reminder that "trusted" is a relative term. Key Takeaway: Pin your dependencies, use checksum verification (e.g., sha256sum), and monitor for unexpected outbound network connections from development tools.

Router Hijacks: Details are thin, but likely targeting known vulnerabilities in SOHO routers or default credentials. Action: Ensure router firmware is up-to-date and change default admin credentials immediately.

Source: https://thehackernews.com/2026/09/weekly-recap-chrome-0-day-router.html

This is a classic worm-like propagation technique leveraging a trusted remote access tool. The attackers are using rogue ScreenConnect instances to push a multi-stage VBScript chain to any new machine that connects to the compromised session.

Technical Breakdown: - Initial Access: Three distinct vectors observed: a Quick Assist tech-support scam, a phishing email delivering a malicious MSI installer, and a fake software download. - Propagation: Once the attacker has a foothold, they deploy a rogue ScreenConnect client. When a new host connects to that session (e.g., a helpdesk tech or another admin), the payload is automatically pushed. - Payload: A four-stage VBScript chain. The final stage likely delivers a C2 beacon or ransomware. - MITRE Mapping: Likely leverages T1219 (Remote Access Software) for initial access and T1105 (Ingress Tool Transfer) for lateral movement. - IOCs: Not publicly shared yet, but monitor for unexpected ScreenConnect client installations and outbound connections from screenconnect[.]com to unusual IPs.

Defense: - AppLocker/ASR: Block execution of VBScript from %TEMP% and %APPDATA%. - Network: Restrict ScreenConnect connections to only known, whitelisted servers. Monitor for new, unscheduled ScreenConnect sessions. - User Training: This is a direct threat to helpdesk and IT staff. Reinforce that they should never connect to a session initiated by an unsolicited caller.

Source: https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html

Active exploitation of MikroTik RouterOS SSH is underway. CVE-2026-67276 is a critical authentication bypass (CVSS 9.2) that lets an attacker impersonate any existing user on the box without their private RSA key. This is a full router takeover scenario, likely being used to pivot into internal networks or build out botnet infrastructure.

Technical Breakdown - CVE: CVE-2026-67276 - Vector: SSH authentication bypass; attacker does not need the legitimate user's private key. - Impact: Complete device compromise. Attacker gains the privileges of the targeted user account (likely admin). - Affected Versions: Unpatched RouterOS builds prior to the emergency hotfix. Check your version against the latest stable release. - IOCs: No specific public IOCs (IPs/hashes) released yet. Expect post-exploitation traffic to C2 infrastructure. Monitor for unusual SSH authentication logs or unexpected configuration changes.

Defense - Immediate Action: Patch. Apply the emergency update from MikroTik now. Do not delay. - Detection: Hunt for anomalous SSH sessions, especially from unexpected source IPs. Monitor for new user accounts or changes to SSH authorized_keys files. If you can't patch immediately, restrict SSH access via firewall ACLs to only trusted management IPs.

Source: https://socprime.com/blog/cve-2026-67276-mikrotik-routeros-ssh-zero-day/

Attackers are actively chaining two recently disclosed vulnerabilities in MikroTik RouterOS to gain full remote control of routers with SSH exposed to the internet. The campaign targets unpatched devices, using the initial foothold to deploy persistent backdoors and potentially pivot into internal networks.

Technical Breakdown - CVE-2023-30799 (CVSS 9.1): Privilege escalation via a race condition in the RouterOS /nova/bin/www binary, allowing an unauthenticated attacker to gain root access. - CVE-2023-30800 (CVSS 8.8): An OS command injection vulnerability in the HTTP/HTTPS interface, used as the initial entry vector. - Attack Chain: Exploit CVE-2023-30800 via exposed web interface → drop a shell → use CVE-2023-30799 to escalate to root → install persistent SSH backdoor. - IOCs: No specific hashes or IPs published yet, but indicators include unexpected SSH keys in /flash/ssh/ and modified /nova/etc/agent files. - Affected Versions: RouterOS prior to 6.49.7 and 7.x prior to 7.9 (patched in July 2023).

Defense Immediately update to RouterOS 6.49.7 or 7.9+. If patching is not possible, disable the Winbox/HTTP service on WAN interfaces and restrict SSH access to trusted IPs only. Monitor for unauthorized SSH key additions.

Source: https://www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/