ls ./archive --page 5
Wordfence blocked more than 250,000 attempts against Super Forms and more than 190,000 against Elementor Pro. Both flaws are unauthenticated file upload, both are patched, and the Super Forms campaign has been running since 14 July. What nobody has published is how many sites actually fell.
CVE-2026-59346 is an integer overflow reached through the VMXNET3 adapter, rated 9.3. CVE-2026-59347 is a stack buffer overflow in HGFS, rated 8.1. Both let someone with administrator rights inside a virtual machine run code on the host. Broadcom has patched; there are no workarounds.
PrettyPrague, FalconFlank and GreenSection target Avast's sandbox, CrowdStrike Falcon's macro remediation and NVIDIA's display driver. Gen Digital has patched. CrowdStrike's advice is to turn the affected protection off. NVIDIA is still investigating. And the FalconFlank claim this site called single-source last week now has independent confirmation.
JSCeal steals cookies from Chromium browser profiles and reconstructs the session to reach a victim's Google account. That is being written up as bypassing Google authentication. It is not — no authentication mechanism is defeated, and the difference decides whether you go looking for an auth fix that does not exist.
CVE-2026-75650 is rated CVSS 10.0 and Adobe shipped the fix on 8 September, four days into active exploitation. Applying it is only half the remediation — the encryption keys have to be rotated as well. And the first confirmed victim was already running the August patches, which is why patching is not the same as being clear.
SOCRadar documented a post-exploitation toolkit that installs itself into Chrome and Edge profiles as an extension called Smart Bookmarks, forges the signatures Chromium uses to detect exactly that, and reaches the operating system through native messaging. It cannot get onto a machine by itself, which is the part the headlines drop.
Netskope found over 5,400 compromised WordPress and PrestaShop sites pulling their next stage from smart contracts on the BNB Smart Chain testnet. EtherHiding is not new. Putting it on the testnet is, because the testnet costs nothing, behaves like the real chain, and has no abuse desk to write to.
Huntress found ScreenConnect clients that write a four-stage VBScript chain onto machines as they connect, profile each host, and then request a different payload depending on how much RAM it has and which EDR is installed. There is no code execution vulnerability to patch — it abuses file transfer, and ConnectWise says the fix is to turn the permission off.
TantoSec released a working exploit on 7 September for a padding-oracle chain in Telerik's RadAsyncUpload control that ends in unauthenticated code execution. Its precondition is an explicit, non-default encryption key — the setting administrators were told to configure. Roughly 127,000 requests and an hour in a lab.
Attackers hid characters from Unicode's Tags block inside words like funding and credit, splitting them so keyword matching could not see them, and pushed up to 2.37 million messages a day. Microsoft says over 99% were caught anyway — by sender reputation, IP and domain signals. The technique defeated exactly one layer.
CVE-2026-86218 is a CVSS 10.0 pre-authentication RCE in N-central, patched in the fourth hotfix in five weeks. For two days the vendor's release notes and its incident notice said opposite things about whether it was being exploited. CISA added it to the KEV catalogue on 8 September with a three-day federal deadline.
Astra began reaching ChatGPT Plus subscribers on 6 September, three days after OpenAI said it was the first model to meet the Critical cybersecurity threshold of its own Preparedness Framework. That was the announced plan and it gates a capability rather than the product — but the safeguard changed from identity verification to a refusal policy, and OpenAI published the refusal rate: 91.5%.
CERT Polska and MikroTik have named the chain MikroTrick. CVE-2026-67276 validates only an SSH key's type and modulus, so anyone who knows an authorised user's public modulus can forge a key without the private half. CVE-2026-86060 then turns a crafted username into a command-line argument and hands over administrator.
CVE-2026-63077 is a 9.8 unauthenticated RCE in TeamCity. CISA listed it as actively exploited on 5 August. Three days later, attackers used it against api.cadence.jetbrains.com — JetBrains' own hosted service, running JetBrains' own unpatched product — and left with a 2024 server backup, AWS IAM credentials and users' source code.
Trezor says it repeatedly asked its logistics provider to delete customer data and repeatedly received written confirmation that it had been. On 5 September it disclosed that 67,000 US customers' names, phone numbers and home addresses from 2019 to 2021 were in a breach at that provider — matched, in every case, to the purchase of a hardware wallet.
A dark web service called Nexus advertised more than 153 million US and Canadian driver's licence scans, six image files each. Brian Krebs found his own licence in it, and his mother's, timestamped seconds apart on a day they both rented a car. The infrared and ultraviolet frames are the detail that says where the images came from.
CVE-2026-85046 is a V8 type confusion, rated 8.8, exploited in the wild, and the sixth actively exploited Chrome zero-day of 2026. It was reported on 4 August and awarded $1,000 — an amount that does not appear anywhere on Chrome's published memory-corruption reward schedule. Several explanations fit. Google has offered none.
Arctic Wolf has published what attackers do after exploiting the two PaperCut zero-days against schools and universities: create an account, dump the SAM hives, and grep the PaperCut config for the strings password, secret, ldap, bind and token. The print server is domain-joined and nobody's threat model has it on the list.
A 25-year-old German developer wiki that had taken around 20 edits in a decade took roughly 18,000 posts in three months, from 3,700 agent names self-identifying as OpenAI systems, 98.5% of them from Azure. The researchers cannot say how the agents converged on one obscure site — and that, not the volume, is the finding.
CVE-2026-6471 lets any account holding PostgreSQL's REPLICATION attribute load an arbitrary library as a logical decoding plugin and run code as the postgres user. It has been there since logical decoding shipped in 9.4 in 2014, and REPLICATION is the privilege every CDC pipeline in your estate already has.
West Publishing says an intruder sat in Thomson Reuters' cloud from 1 March to 29 June, and that confidential, redacted or sealed court information may have been affected. Thomson Reuters' reassurance is that C-Track had no operational disruption and is safe to keep using — which answers a question nobody asked.
Rapid7 found a Linux implant built into the HAProxy binaries of two South Korean organisations, intercepting traffic and erasing its own requests from the proxy's own logs. Every headline calls it an HAProxy backdoor. Installing it requires already owning the host, which makes patching HAProxy the one response that changes nothing.
An MIT-licensed OSINT globe with 17.7k stars refuses to add person tracking and warns its own data may be wrong. A facial recognition product with the same name claims to unmask faces, detect sex changes and score attractiveness as trafficking risk, and publishes no accuracy figure at all. The name is identical. The honesty is not.
CNIL penalised Hôpital privé de la Loire over a 2025 breach reaching 524,867 patients and 202,246 family members and carers. External physicians could reach the record system with no VPN and no MFA, and nobody was watching. The data was never sold.