Friday, September 4, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 4 critical 29
- Linux 28
- themoos 5 critical 18
- Microsoft 6 critical 17
- Google 4 critical 14
- moos-ivp 6 critical 13
- misp 12
- Red Hat 11
- WWBN 1 critical 11
- MongoDB 9
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them," the Microsoft Security Research team said. The
Also in SecurityWeek Bleeping Computer Cyber Security News +3
-
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and
Also in Rapid7 Blog CCCS Alerts & Advisories
-
Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs
Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program. "The Fairwind Program gives high-priority defenders (like governments, healthcare providers, and telecommunications services) early access to advanced models that help them
Also in CCCS Alerts & Advisories Infosecurity Magazine CCCS Alerts & Advisories +1
-
Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution. The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as
Also in SecurityWeek CISA Alerts & Advisories
-
AI's Vulnerability Surge May Be More Manageable Than First Feared
New research suggests the coming Vulnpocalypse may not be so overwhelming for enterprise security teams — if they have the right strategies.
Also in CyberScoop Microsoft Security Blog
-
Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new zero-day dubbed FalconFlank, a proof-of-concept (PoC) for a privilege escalation flaw impacting Crowdstrike Falcon. "FalconFlank is a 0-day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon Sensor," the researcher said in
Also in Bleeping Computer CyberScoop
-
Podcast: We Spoke to an Amazon Worker Destroying Books for AI
We start this week with Emanuel’s follow-up to his Amazon book scanning story, in which he spoke to someone who worked in the Amazon warehouse which destroys books to train Amazon’s AI products. After the break, Emanuel and Sam tell us about the same few names appearing in LLM output over and over again. In the subscribers-only section, Joseph tells us why ICE is buying loads of data about ‘voter fraud’. Listen to the weekly podcast on Apple Podcasts , Spotify , or YouTube . Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid…
Also in Malwarebytes Labs
-
Hackers Use Popular Messaging Services to Control New Windows Backdoors
A financially motivated threat group known as Toy Ghouls has begun using two custom Windows backdoors that communicate through popular messaging and broker services. The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices. The campaign marks a change for the group, which had previously relied heavily on public tools and leaked ransomware builders. Its move to custom malware suggests a broader effort to stay inside victim networks longer while making activity harder for security teams to spot. Analysts at Securelist…
Also in The Hacker News
-
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote
Also in Malwarebytes Labs
-
Microsoft Confirms New Exchange Online Outage Delaying Emails from External Domains
Microsoft has confirmed a fresh Exchange Online incident, tracked as EX1467029, causing delays for users sending and receiving email messages from external domains. The company first acknowledged the disruption on September 4, 2026, flagging it as a service degradation issue affecting Exchange Online, one of the most widely used business email platforms in the world. According to Microsoft’s service health updates, the outage began around 3:49 PM GMT+5:30 and has continued through multiple status revisions issued that afternoon, with updates posted at 4:06 PM, 4:33 PM, and 5:56 PM. Affected…
Also in Bleeping Computer
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-85061 | maplibre-gl-jsmaplibre | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isMapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collectio… Attack
Exploitation
|
|||||||||
| CVE-2026-70352 | Azure AI Language AuthoringMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isMissing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-83711 | EntraMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAuthorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-85031 | CP450TOTOLINK | Critical | 9.9 | 0.6% | — | — | — | EPSS 0.6%CVSS 9.9 | |
What it isA vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attac… Attack
Exploitation
|
|||||||||
| CVE-2026-85223 | DNS-340LD-Link | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval r… Attack
Exploitation
|
|||||||||
| CVE-2026-85154 | AVideoWWBN | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isWWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a… Attack
Exploitation
|
|||||||||
| CVE-2026-85109 | HG10Tenda | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isA vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow.… Attack
Exploitation
|
|||||||||
| CVE-2026-85181 | catdianping | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isCAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and … Attack
Exploitation
|
|||||||||
| CVE-2026-84238 | YITH Request a Quote for WooCommerce PremiumWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isUnauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-84753 | Mail MintWPFunnels | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isUnauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.