Tuesday, September 8, 2026 · generated · about 5 min read
Morning Brief
Patch today Patch Tuesday vendors with the most new CVEs today
- Dell 2 critical 36
- JetBrains 2 critical 29
- SAP 4 critical 17
- Siemens 2 critical 13
- Red Hat 2 critical 11
- ASUS 11
- WordPress 10
- MISP 9
- pmmp 9
- thephpleague 8
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Register Security BigBear phishing crew nets thousands of Microsoft 365 credentials
A Microsoft 365 phishing operation targeting hundreds of organizations captured thousands of passwords and session cookies, including hundreds of authenticated sessions that could be hijacked to bypass MFA, according to researchers who accessed the crooks' own admin panel. Security researchers at CloudSEK say they accessed the admin panel behind BigBear 2.0, an Evilginx2-based phishing-as-a-service operation targeting Microsoft 365 users, giving them an unusually detailed look at the campaign and its haul. According to the researchers, the panel contained 5,137 records associated with 461…
Also in Bleeping Computer Bleeping Computer Infosecurity Magazine +3
-
Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
A new intrusion campaign shows how quickly a Windows domain can be turned into a launchpad for deeper compromise. The operators used a Sliver command-and-control beacon, account creation, credential theft and remote administration to establish control after gaining an initial foothold. The activity was staged from an exposed server and aimed at one unnamed US organisation. Its scripts were built for a real Active Directory environment, including a planned rollout across 18 hosts, while the recovered material contained no proof that ransomware was deployed in this specific incident. Analysts…
Also in Microsoft Security Microsoft Security Microsoft Security +2
-
WeWorm – First 0-Click Worm Spreading Through WeChat Calls Across iOS and Android
A proof-of-concept zero-click worm dubbed “WeWorm” that it says can spread through WeChat voice calls on both iOS and Android, compromising a target’s WeChat account in seconds without the victim answering the call. Calif says the bug was reported to Tencent in July and that Tencent has since mitigated the exploit for users, but the research still serves as a stark warning about how mobile messaging apps can become wormable attack surfaces at planetary scale. WeChat is not a niche target. Tencent says Weixin and WeChat together exceeded 1.4 billion monthly active users as of the end of Q1…
Also in The Hacker News Infosecurity Magazine Malwarebytes Labs
-
Extortion crews have their eyes on high-value AI data, Google warns
Data theft and extortion crews are stealing companies’ proprietary AI data and threatening to leak it if the victim organizations don’t pay a ransom, according to Google’s threat hunters. In one case that Google’s Mandiant incident response team investigated, the crooks broke into a healthcare company and exfiltrated corporate data and drug research, including AI research and a proprietary AI model. The criminals then threatened to publish the data unless the company met their extortion demand. In another breach at a company that specializes in AI media generation, attackers stole sensitive…
Also in Infosecurity Magazine Cisco Talos Cisco Talos +1
-
Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical
Also in CCCS Alerts & Advisories Bleeping Computer The Hacker News
-
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. "The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment
Also in SecurityWeek Infosecurity Magazine
-
SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport
SAP has released its September 2026 Security Patch Day updates , delivering 19 new security notes and one update to a previously issued note. The patches address vulnerabilities across SAP NetWeaver, SAP Extended Passport Processing, SAP Cloud Application Programming Model, SAP S/4HANA, SAP Integration Suite, SAP Commerce Cloud, and other enterprise products. The most severe issue is CVE-2026-44756, a critical memory corruption vulnerability in SAP Extended Passport Processing, tracked under SAP Note 3747649. It carries a CVSS score of 10.0, the highest possible severity rating. The flaw…
Also in Bleeping Computer SecurityWeek
-
StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day
A critical unauthenticated remote code execution (RCE) zero-day in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler, has been actively exploited since September 4 with attacks observed three days before a vendor patch became available. Key takeaways CVE-2026-75650 is a critical remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that can be triggered without authentication. Active exploitation of CVE-2026-75650 began on September 4, 2026, three days before Adobe released a hotfix, with multiple victim stores confirmed across different…
Also in Bleeping Computer
-
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences
Also in Fortinet PSIRT The Hacker News
-
Mathspace discloses data breach affecting over 1 million people
Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system.
Also in SecurityWeek
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-86296 | DIR-822AD-Link | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possibl… Attack
Exploitation
|
|||||||||
| CVE-2026-75650 | Adobe CommerceAdobe | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAdobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerabil… Attack
Exploitation
|
|||||||||
| CVE-2026-44756 | SAP Extended Passport (EPP) ProcessingSAP | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially r… Attack
Exploitation
|
|||||||||
| CVE-2026-86299 | RE7000Linksys | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/p… Attack
Exploitation
|
|||||||||
| CVE-2026-86510 | DIR-822AD-Link | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The explo… Attack
Exploitation
|
|||||||||
| CVE-2026-76578 | Red Hat Enterprise Linux 10Red Hat | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isA flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a rela… Attack
Exploitation
|
|||||||||
| CVE-2026-18922 | Red Hat Directory Server 11.7 E4S for RHEL 8Red Hat | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isA flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated succ… Attack
Exploitation
|
|||||||||
| CVE-2026-7861 | CSM (Customer Service Management)Next4Biz Information Technologies Inc. | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isDeserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM (Customer Service Management): through 07092026. NOTE: The vendor was… Attack
Exploitation
|
|||||||||
| CVE-2026-86478 | YouTrackJetBrains | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isIn JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address Attack
Exploitation
|
|||||||||
| CVE-2026-86480 | HubJetBrains | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isIn JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.