Google has released security updates for Chrome, patching 12 vulnerabilities including CVE-2026-85046, a high-severity type confusion bug in the V8 JavaScript and WebAssembly engine that is being actively exploited in the wild. The flaw affects Chrome versions prior to 152.0.7977.82 and could allow remote attackers to execute arbitrary code. Users are urged to update immediately.
Security researchers report that a critical-severity authentication bypass vulnerability in Citrix NetScaler appliances is being exploited in the wild. The flaw, tracked as CVE-2026-19490, allows unauthenticated remote attackers to circumvent authentication protections on affected appliances. Exploitation began being reported around early September 2026. The vulnerability impacts NetScaler deployments globally, particularly those used for application delivery and load balancing. Citrix has not yet disclosed full technical details, but organizations are urged to apply the latest firmware updates and monitor official advisories.
Microsoft Security Research has identified a high-volume phishing campaign leveraging invisible Unicode tag characters to fragment financial lure words. By splitting terms such as 'funding', attackers aim to bypass email security gateway parsing logic while presenting a legitimate appearance to human readers. The campaign's global distribution and exact victim count remain unconfirmed.
Multiple class-action lawsuits have been filed against identity verification company IDScan following allegations of a data breach impacting over 153 million driver's license records. Plaintiffs claim the company failed to adequately protect sensitive personal information, while hackers allegedly breached the service and offered to sell the dataset. The incident, reported by BleepingComputer on September 4, 2026, raises concerns about identity theft and fraud risks for affected drivers.
PostgreSQL has released security updates to address a vulnerability present since the introduction of logical decoding in PostgreSQL 9.4 (2014). Tracked as CVE-2026-6471, the flaw carries a CVSS score of 7.2 and allows an account with the REPLICATION attribute to execute arbitrary code as the operating-system user running the database server. Versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85046, a Google Chromium V8 type confusion vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation in the wild. CISA's Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and verify whether compromise occurred before patching. All organizations are encouraged to update affected browsers promptly.
A recent analysis highlights how attackers exploit residential proxies and VPNs to mask malicious traffic, causing existing edge security controls to miss high-risk sessions. The report discusses session enrichment as a method to add data points that improve the identification of risky sessions and support stronger enforcement decisions.
Researchers have identified 13 malicious Composer theme packages on Packagist designed to inject JavaScript into Vietnamese movie and comic streaming sites. The injected code runs mobile ad-fraud and gambling-redirect operations, and additionally initiates the deployment of spyware against visitors using unpatched iOS devices to steal cryptocurrency wallet seed phrases. The packages were reported in September 2026.
According to a Dark Reading feature, former cybercriminal Brett Johnson explains that artificial intelligence gives threat actors a significant advantage by enhancing social engineering, phishing, malware development, and other attack vectors. The discussion highlights that AI lowers the barrier to entry for attackers, enabling faster and more convincing campaigns that are harder to detect. No specific exploit methods were detailed, but the trend reflects a widely observed shift in the current threat landscape.
Threat actors have begun leveraging the trusted Node.js JavaScript runtime (node.exe) as a delivery mechanism for malicious payloads in campaigns targeting government departments, technology companies, and hotels. According to the Symantec Threat Hunter Team, the attacks have been active since February 2026. The exploitation of a trusted system utility reduces suspicion and facilitates payload deployment.
Security researchers report that the Breeze Comet threat group, identified as Brazil's most sophisticated threat actor, is conducting targeted attacks against financial systems in Brazil and globally. The group is leveraging sophisticated techniques to compromise banking and financial infrastructure, with the apparent objective of financial theft. Details regarding specific attack vectors, exploited vulnerabilities, and the full extent of financial impact remain limited and under investigation.
Microsoft has confirmed that the KB5120998 August 2026 preview update resets desktop settings on some Windows devices. Users report loss of customizations including taskbar, Start menu, and display preferences. The issue is classified as a quality regression, not a security vulnerability, and no active exploitation has been reported.
A recent advisory from Flare, reported by BleepingComputer, highlights that infostealer malware can exfiltrate more than just passwords. Stolen browser cookies, session tokens, and authenticated sessions may allow attackers to bypass multi-factor authentication and gain unauthorized access to organizational accounts. The guidance emphasizes the need for defenders to prioritize compromised identities, assess whether stolen access is still usable, and implement credential rotation and session invalidation procedures before account takeover occurs.
Microsoft has acknowledged a bug in the KB5120998 August 2026 preview update that reverts mouse settings to defaults after installation. The issue is confirmed to impact only non-English Windows 11 systems, while English-language systems are unaffected. No exploitation has been reported, and the issue is described as a configuration reset bug rather than a security vulnerability.
According to VulnCheck, threat actors are actively exploiting two critical vulnerabilities: CVE-2026-0768 in Langflow, which lacks input validation and could allow arbitrary Python code execution as root, and CVE-2026-66066 in Ruby on Rails. The full details of the Rails flaw were truncated in initial reporting, but both flaws are assessed as critical and have been weaponized in the wild for credential-probing and command-and-control activity.
Two security vulnerabilities in PaperCut NG and PaperCut MF print management software were exploited as zero-days before patches were released last week. The flaws are now being abused in active data theft attacks targeting unpatched systems globally. Users are strongly advised to apply the available security updates to prevent remote code execution and unauthorized data access.
ESET researchers have disclosed a technique dubbed GuardBreaker, attributed to the Russia-aligned threat actor UAC-0099, which was used against a target in Ukraine. The method allegedly aims to interfere with large language model (LLM) safety mechanisms to disrupt AI-assisted analysis. The report indicates the technique was designed to trip safety filters, though specific technical details and the extent of impact remain under investigation.
Five Venezuelan nationals have pleaded guilty to charges related to ATM jackpotting attacks. The individuals admitted to deploying malware on automated teller machines with the intent to dispense cash fraudulently. The guilty pleas were entered as part of a law enforcement initiative targeting financial cybercrime.
Microsoft's threat research team observed that the ClickFix social engineering technique was the most common initial access method used by threat actors last year. The attack leverages fake CAPTCHA checks to trick victims into executing commands via terminal, leading to malware installation. The technique has been observed in-the-wild since at least 2024 and accounted for the highest frequency initial access vector in the reporting period.
A high-severity authentication bypass vulnerability in Microsoft Exchange servers continues to affect approximately 22,000 internet-exposed systems globally. The flaw allows attackers to hijack all user mailboxes without valid credentials, posing significant risks of data exfiltration and business disruption. Administrators are urged to apply available security updates immediately.
Threat actors exploited unpatched vulnerabilities in ownCloud to gain initial access to the Philippines Nuclear Research Institute, resulting in the exfiltration of reactor databases, personnel records, and credential stores. The incident underscores the risk of delayed patching in critical infrastructure environments.
A proof-of-concept named FalconFlank has been publicly disclosed, allegedly demonstrating a privilege escalation vulnerability in CrowdStrike Falcon Sensor. The researcher, known as Chaotic Eclipse, claims the flaw abuses the office malicious macros remediation feature within the sensor. As of the disclosure date, CrowdStrike has not released an official patch, and no independent verification of active exploitation or a CVE assignment has been confirmed.
Findings from the Citizen Lab in collaboration with the SHARE Foundation confirm that an iMessage zero-click exploit was used to infect the iPhone of a member of Serbia's student protest movement with NSO Group's Pegasus spyware. The report highlights the use of a zero-click iMessage vulnerability to silently install surveillance software, enabling unauthorized access to private communications and device data.
Plex has urged users to update their desktop clients and media server software immediately to patch multiple security vulnerabilities. The advisory notes that unpatched versions may be susceptible to remote code execution or privilege escalation, though no active exploitation has been confirmed at the time of release.
