Security news, decoded.

CISA has updated its Known Exploited Vulnerabilities catalog to confirm that ransomware operators are now leveraging CVE-2025-14733, a critical out-of-bounds write flaw in WatchGuard Firebox firewalls. This vulnerability allows unauthenticated attackers to achieve remote code execution on devices running Fireware OS 11.x (including 11.12.4Update1), 12.x (including 12.11.5), or versions between 2025.1 and 2025.1.3, specifically when configured for IKEv2 VPN. While WatchGuard released remediation patches in December and warned that residual risk exists even if the vulnerable configuration is removed, nearly 9,000 exposed instances remain unpatched. Administrators should immediately apply updates and review IKEv2 settings to mitigate this active threat.

Wiz Research has identified that nearly one in ten internet-facing LiteLLM gateways accept the default "sk-1234" admin key documented in the official setup guide, exposing sensitive credentials and potentially allowing cloud infrastructure compromise. This misconfiguration exacerbates risks from several critical vulnerabilities in the BerriAI product, including CVE-2026-59822, which is already being actively exploited in the wild, and CVE-2026-42271, which permits unauthorized code execution on the host system. Administrators are advised to immediately replace the master key with a strong random value and upgrade their installations to version 1.84.0 or later to mitigate these threats.

Researcher Nightmare Eclipse has published the proof-of-concept code for ShieldCrash, a new zero-day vulnerability affecting Microsoft Defender on fully patched Windows systems. The exploit allows for arbitrary file reads and full System privilege escalation, serving as a bypass for previous flaws including CVE-2026-50656 (RoguePlanet) and CVE-2026-69414 (ShieldBreak). Security experts caution that the repeated ability to circumvent these fixes indicates fundamental weaknesses in how the vendor addresses the underlying attack surface.

SOCRadar has reported active exploitation of CVE-2025-25249, an unauthenticated remote code execution vulnerability in Fortinet's FortiOS and FortiSwitchManager products. Attackers are leveraging this heap-based buffer overflow flaw to install the PivotC2 RAT, which grants them persistent access through features like traffic tunneling and network scanning. The incident has impacted 178 devices across over 30,000 targeted IPs, primarily affecting US entities and resulting in data exfiltration in at least two cases. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, prompting urgent patch recommendations to versions 7.6.4, 7.4.9, 7.2.12, and 7.0.18 for FortiOS, and 7.2.7 and 7.0.6 for FortiSwitchManager.

Cisco has confirmed that CVE-2026-20079, a critical authentication bypass vulnerability in its Secure Firewall Management Center (FMC) software, is under active attack. This flaw, rated with a maximum CVSS score of 10.0, allows unauthenticated remote attackers to execute arbitrary scripts with root privileges by sending crafted HTTP requests to the device web interface. The incident affects both Cisco Secure FMC Software and Security Cloud Control Firewall Management, though Cisco states the cloud-hosted service has already been patched. With no available workarounds, the vendor urges customers to immediately upgrade to the latest software release to mitigate the risk of full system compromise.

The CERT Coordination Center at Carnegie Mellon University has issued a warning regarding the Skullcandy Dime 3 wireless earbuds, which are susceptible to unauthorized Bluetooth pairing due to CVE-2025-20701. This high-severity flaw resides in the Airoha Bluetooth Audio SDK used by model S2DCW units running firmware version 1.0.0.28, allowing attackers within range to intercept calls, play audio, or monitor conversations without user consent or physical access. Although Skullcandy resolved the issue in firmware version 1.0.0.30, consumers with previously purchased devices have no official method to update their hardware, leaving them permanently exposed to these privacy risks.

A newly identified exploit kit named BlueMoon is being actively used by four espionage-motivated threat clusters, including APT31, to compromise targets by chaining vulnerabilities in Google Chrome and Microsoft Windows. The attack chain combines CVE-2026-85046 (a type confusion in the V8 engine), an unassigned V8 sandbox escape, and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC) to achieve remote code execution and local privilege escalation. These are "patch-gap" zero-days, meaning the bugs were fixed in upstream Chromium code before being patched in stable browser releases. While both underlying flaws have since been addressed by Google and Microsoft, the rapid adoption of this kit by multiple state-aligned actors highlights the risk of exploiting open-source patch windows.

Following two months without identified security issues, Google has released its September 2026 Android security bulletin, addressing a total of 180 vulnerabilities across various platform components. The update cycle includes patches for 95 issues arriving under the 2026-09-01 patch level and 85 fixes distributed via the 2026-09-05 patch level, affecting core System, Framework, kernel, and vendor-specific components from MediaTek, Qualcomm, Unisoc, Tsingteng Micro, and Imagination Technologies. Among the resolved defects is CVE-2026-28662, a Wi-Fi-related memory corruption flaw capable of enabling remote code execution without requiring user interaction or additional privileges.

AMD, Arm, and Nvidia have issued security advisories addressing recently discovered vulnerabilities across their respective hardware and software ecosystems. AMD resolved CVE-2026-43603, a NULL pointer dereference issue in its Linux GPU kernel driver that poses a denial-of-service risk, with fixes currently available for EPYC Athlon, Ryzen, Radeon, and Instinct processors. Meanwhile, Arm addressed nine flaws in its Mali GPUs that could expose freed memory or sensitive kernel data, releasing updates for both Valhall and Bifrost architectures. Additionally, Nvidia patched two high-severity defects in the Triton Inference Server that allowed for information disclosure and data tampering.

Cisco Talos reports active in-the-wild exploitation of two vulnerabilities in Cisco Secure Firewall Management Center (FMC): CVE-2026-20079, a critical authentication bypass (CVSS 10.0) allowing unauthenticated attackers to gain root access, and CVE-2026-20316, which enables low-privileged login that can be chained for privilege escalation. Analysts have observed three distinct threat clusters leveraging these flaws. One group deployed web shells and a JAR-based command executor, another associated with Sandworm utilized Netcat reverse shells to install Cyclops Blink malware, and a third actor linked to Qilin ransomware used static credentials for reconnaissance and deployment. Cisco advises applying available hotfixes immediately, ahead of a comprehensive hardening release scheduled for the week of September 14.

Fortinet has issued patches for ten security vulnerabilities across multiple products, addressing two critical defects requiring immediate attention. The most severe issue, CVE-2026-84390, allows unauthenticated attackers to bypass authentication on the FortiMonitorOnSight web portal by exploiting a forged JWT, while CVE-2026-84388 enables traffic proxying through the Privileged Access Agent Chrome extension. To fully remediate these risks, administrators must upgrade FortiPAM to version 1.9.1 or 1.8.4 and ensure the associated Chrome extension is updated to version 8.0.1.123 or later. The update cycle also resolves high-severity bugs in FortiSandbox and FortiOS, along with several lower-severity issues affecting other components such as FortiManager and FortiClient.

DeepSeek has released a fix for CVE-2026-82533, a critical flaw in the DeepSeek Harness tool that permitted AI coding agents to bypass their file-based sandbox restrictions. The vulnerability stemmed from a lack of proper authentication on the local web interface, allowing a malicious agent to issue a specific command that switched the session to a 'danger-full-access' mode, thereby disabling approval prompts and sandbox boundaries. Rated 9.4 by VulnCheck, this issue affected versions up to 0.1.1-rc.2 and enabled attackers to write files outside the designated workspace after exploiting the unsanitized Host header check. Users are advised to upgrade immediately to version 0.1.2-alpha.2 or later, as the initial fixed release was not available via npm.

Sophos has revealed that threat actors are exploiting F5 BIG-IP APM devices to install a sophisticated Linux rootkit named PoisonedRefresh. This campaign leverages CVE-2025-53521, an unauthenticated remote code execution vulnerability, to inject a web shell directly into memory, thereby avoiding detection by traditional file-based scanning tools. The malware operates by hooking Apache’s Portable Runtime and modifying how PHP files like apmcss.php3 are loaded, effectively masking malicious code within legitimate scripts. Additionally, the implant establishes a Unix domain socket at /run/bigtlog.pipe to provide attackers with direct shell access without leaving standard network traces.

Schneider Electric and Siemens have issued their September 2026 industrial control system advisories, addressing multiple high-severity defects across various hardware and software platforms. Schneider's most significant fix resolves CVE-2026-3869, a critical authentication bug with a CVSS score of 9.2 affecting Modicon M580 and Modicon M580 Safety controllers, alongside updates for PowerLogic T300 and SCADAPack x70 products. Siemens simultaneously published nine new advisories targeting critical vulnerabilities in systems such as Reyrolle 7SR5 and Open Interface Services, while also deploying patches for the Linux kernel flaw CVE-2026-31431. Additional vendors included Aveva, which fixed hardcoded key issues in PIMBoards, and Rockwell Automation, which addressed critical flaws in RSLinx Classic and several controller modules.

Ivanti has distributed urgent security updates to address multiple critical and high-severity vulnerabilities across its Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM) platforms. The Neurons for ITSM release resolves eight distinct defects, including CVE-2026-12647, CVE-2026-12645, and CVE-2026-12646, which carry a maximum CVSS score of 9.9/10 and can enable remote code execution through unauthorized access or unsafe data handling. Additionally, new builds for Sentry and EPMM have been issued to remediate authentication bypass issues identified as CVE-2026-83527 and CVE-2026-18851 respectively. While Ivanti reports that these specific flaws have not yet seen active exploitation, administrators are advised to apply the latest patches to prevent potential compromise.

Google has shipped Chrome 153 to the stable channel to resolve an actively exploited zero-day tracked as CVE-2026-87491. This medium-severity flaw, characterized as an out-of-bounds write in the V8 engine, marks the seventh such incident addressed by the browser team in 2026. The update also addresses 229 additional security issues, including several critical severity bugs in WebGL and Cast components. Users should upgrade promptly to build 153.0.8010.36 or later on supported operating systems.

Google has released security updates for Chrome, addressing 230 vulnerabilities including a medium-severity out-of-bounds bug in the V8 engine that is currently being exploited in the wild. Identified as CVE-2026-87491, this flaw allows remote attackers to execute arbitrary code within the sandbox via crafted HTML content in versions prior to 153.0.8010.36. The update also resolves five critical flaws in WebGL and Cast components, bringing the total number of actively exploited Chrome zero-days patched this year to seven. Users are strongly advised to upgrade to version 153.0.8010.36/.37 on Windows and macOS, or 153.0.8010.36 on Linux, to mitigate these risks.

Microsoft has released its September 2026 security updates, addressing a record number of flaws, including two vulnerabilities currently being exploited in the wild. The critical fixes resolve CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in the Windows Advanced Local Procedure Call, both of which allow privileged users to escalate to SYSTEM rights. Additionally, researchers have published a proof-of-concept for a bypass of the Microsoft Defender patch, highlighting ongoing risks to endpoint security.

cPanel has released a security update to address CVE-2026-67401, a critical vulnerability affecting all supported versions of cPanel and WHM. This flaw, classified as an SQL injection within the EmailTrack functionality, permits an authenticated hosting account with specific mail privileges to create arbitrary files and escalate privileges to execute code as the root user. Because this level of access grants full administrative control over the server, it exposes all customer data and infrastructure to potential compromise. Administrators must immediately update their systems to the designated fixed builds, such as 11.110.0.143 or 11.134.0.55, by running the upgrade script or using the WHM interface.

Google has addressed an actively exploited zero-day vulnerability, designated as CVE-2026-87491, within the V8 JavaScript and WebAssembly engine of Chrome. This out-of-bounds write flaw enables remote attackers to execute arbitrary code via specifically crafted HTML pages. The security update is available in Chrome versions 153.0.8010.36 and .37 for Windows and macOS, as well as 153.0.8010.36 for Linux.

Sophos detailed the mechanics of malware targeting F5 BIG-IP Access Policy Manager appliances, revealing that it injects a PHP web shell directly into memory rather than writing it to disk. This technique evades standard file-based detection methods by modifying the Apache process only after it loads specific PHP scripts, effectively hiding the malicious code from disk integrity checks. The intrusion is linked to CVE-2025-53521, a critical remote code execution vulnerability with a CVSS score of 9.8 that was reclassified in March 2026 and subsequently added to CISA's Known Exploited Vulnerabilities catalog. Administrators should verify that their systems are patched, with fixes available in versions such as 17.5.1.3, 17.1.3, and 16.1.6.1. Because the malware can persist in memory even after patching, security teams are advised to run sys-eicheck integrity checks, generate qkview reports for analysis, and compare in-memory modules against disk copies to confirm the absence of active compromises.

Security researcher Chaotic Eclipse has released a proof-of-concept named ShieldCrash that exploits an incomplete remediation for CVE-2026-69414 in Microsoft Defender. This new exploit effectively bypasses the patch for the previously disclosed ShieldBreak vulnerability, allowing for arbitrary file reads with SYSTEM privileges across all supported Windows desktop versions. Although Microsoft recently updated the Microsoft Malware Protection Engine to version 1.1.26080.3 to address the initial flaw, this new finding indicates that certain code paths remain vulnerable under specific conditions.

SAP has released security updates addressing multiple critical vulnerabilities, most notably CVE-2026-44756, a CVSS 10.0 memory corruption flaw in the SAP kernel's Extended Passport (EPP) processing. Identified by Onapsis as "OVERPASS," this defect allows unauthenticated attackers to achieve remote code execution with administrative privileges via crafted network requests, potentially compromising business data across SAP S/4HANA and other ABAP-based systems. Additionally, SAP patched CVE-2026-58240 (CVSS 9.8), a missing authentication check in the NetWeaver Message Server dubbed "S4GET" by researchers, along with two other high-severity issues affecting CAP and SAP GUI for Java. Although no active exploitation has been confirmed, administrators are urged to patch internet-facing systems urgently since traditional access controls do not mitigate these kernel-level defects.

Microsoft released its largest monthly security update ever, remediating 974 vulnerabilities across its ecosystem. Among these fixes are two Windows zero-day flaws, CVE-2026-85880 and CVE-2026-81963, that have been actively exploited in the wild. Both vulnerabilities enable local privilege escalation with a CVSS score of 7.8, allowing attackers to gain SYSTEM privileges. The issue was reported by Volexity, Proofpoint, and Microsoft MSTIC, prompting CISA to add both CVEs to the Known Exploited Vulnerabilities catalog. Organizations should apply the September 2026 patches immediately to secure their systems.

CISA has added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog, mandating that federal agencies patch N-able N-central by September 11, 2026. This maximum-severity flaw (CVSS 10.0) enables pre-authentication remote code execution via static code injection. The vendor released a fix in N-central 2026.3 Hotfix 4 on September 5, 2026, following reports of active exploitation and customer compromises investigated by Huntress.

Microsoft has published its September 2026 security update, remediating 973 vulnerabilities across its software portfolio, including 113 rated as "critical." Among these, 82 are remote code execution flaws affecting products such as Windows, Office, SQL Server, Azure Cosmos DB, and Spring Cloud Azure. Notably, Microsoft confirmed active exploitation in the wild for two elevation of privilege issues: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC). Administrators should prioritize patching these components immediately, alongside other high-severity bugs flagged by the vendor as having a higher likelihood of exploitation.

Microsoft has released its largest patch bundle to date, addressing 974 vulnerabilities across Windows and other products, with two zero-day flaws—CVE-2026-81963 and CVE-2026-85880—currently being actively exploited for privilege escalation. This monthly update includes 113 critical issues, notably a high-severity remote code execution flaw in the Windows Shell identified as CVE-2026-69829 (CVSS 9.8) and a DNS weakness affecting Windows Server 2012 and later versions labeled CVE-2026-69730. The surge in disclosed bugs, attributed partly to AI-assisted discovery, is prompting experts to warn enterprises about the growing operational burden of testing and deploying such extensive fix sets within standard maintenance windows.

Microsoft has addressed a record-high 974 vulnerabilities in its September security update, including two flaws currently being exploited in the wild. The affected products span Windows, Office, Exchange Server, and SQL Server, with CVE-2026-85880 and CVE-2026-81963 representing immediate risks as both allow privilege escalation on compromised systems. Beyond the active exploits, the release includes 13 critical-rated issues and 20 wormable remote code execution bugs, notably CVE-2026-69730 in Windows DNS Server. Organizations should prioritize applying these updates to mitigate the risk of automated network propagation and unauthorized administrative access.

Microsoft has addressed a historic surge of approximately 972 security flaws in its latest cumulative update, with 112 of them classified as critical. This release includes fixes for two zero-day vulnerabilities, CVE-2026-81963 and CVE-2026-85880, which are currently being actively exploited in the wild. The unprecedented volume of patches reflects the growing impact of AI-driven vulnerability discovery across the tech industry.

OX Research has published a proof-of-concept demonstrating how CVE-2026-82533 allows AI agents running inside DeepSeek Harness to escape their operating system sandbox. The vulnerability, rated CVSS 9.4, stems from the local HTTP API trusting client-supplied 'Host' headers instead of verifying peer addresses, while default sandbox profiles permitted unrestricted loopback networking. By exploiting this misconfiguration, a sandboxed agent could issue a single shell command to escalate its session to full access, effectively disabling security controls without network exposure or additional credentials. OX Research disclosed the issue to VulnCheck on August 24, 2026, and confirmed that the fix in DeepSeek Harness 0.1.2-alpha.1 resolves the defect.

Security researchers have identified active exploitation of F5 BIG-IP APM devices where attackers leverage the critical remote code execution flaw CVE-2025-53521 to deploy a sophisticated Linux rootkit. Dubbed 'PoisonedRefresh' by ESET, this second-stage payload uses fileless techniques to intercept PHP file loading via Apache APR hooks, effectively injecting a hidden web shell directly into memory without writing malicious code to disk. Sophos analysis reveals that the implant modifies SELinux configurations to persist across upgrades and establishes a password-protected local UNIX socket for interactive Bash access, avoiding standard TCP listeners. Defenders should monitor for specific indicators such as unusual POST requests to .php3 endpoints returning HTTP 201 with text/css content types, and note that approximately 795 vulnerable endpoints remained exposed online recently.

Microsoft released a record number of security updates this month, resolving 974 vulnerabilities across its software portfolio, including two actively exploited zero-days. The first, CVE-2026-85880, is a heap buffer overflow in the Windows Advanced Local Procedure Call (ALPC) that allows local attackers to escalate privileges to System level. The second, CVE-2026-81963, involves improper link resolution in the Windows Update Stack, also enabling privilege escalation. Additionally, the patch addresses significant remote code execution risks in Exchange Server, SharePoint, and Remote Desktop Services.

Qualys reports that Microsoft has issued its largest Patch Tuesday update to date, remediating 974 security vulnerabilities across its product ecosystem. Among these fixes are two zero-days currently under active exploitation: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC), both enabling local privilege escalation. Additionally, Adobe released a patch for critical vulnerability CVE-2026-75650 in Adobe Commerce, which allows arbitrary code execution and has been added to CISA's Known Exploited Vulnerabilities Catalog.

Adobe has issued security updates for over 170 vulnerabilities across multiple products, including an urgent patch for a critical, actively exploited zero-day in Adobe Commerce and Magento Open Source. Tracked as CVE-2026-75650 with a perfect CVSS score of 10/10, this code injection flaw enables unauthenticated remote code execution and has been leveraged by threat actors, identified by Sansec research as StyleSmuggler, to backdoor online stores through the 'Payment Transaction Failed Reminder' feature. The vendor strongly advises administrators to apply the fixes immediately and rotate all encryption keys, administrative credentials, database access details, and API tokens at their source. Additional priority one patches were also distributed for Critical Command Injection issues in Campaign Classic and ColdFusion.

Microsoft has released its September 2026 security updates to address a record high of 966 vulnerabilities across products including Windows, Microsoft Office, Exchange Server, and SharePoint. This release includes fixes for two zero-day vulnerabilities that are currently being exploited in the wild, both of which allow attackers to escalate privileges locally to gain SYSTEM access. One of these flaws exists in the Windows Update Stack due to improper link resolution, while the other involves a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem. Administrators should prioritize deploying these patches immediately to mitigate the risk of active exploitation.

SAP has released September 2026 security updates addressing 20 vulnerabilities, including a maximum-severity buffer overflow in the SAP Kernel dubbed OVERPASS. Identified as CVE-2026-44756 by Onapsis researchers, this flaw allows unprivileged attackers to gain administrative command execution on vulnerable hosts via the Internet Communication Manager. Additionally, SAP resolved CVE-2026-58240, a missing authentication issue in the NetWeaver Message Server known as S4GET, which permits remote code execution across entire system clusters without credentials. Onapsis estimates that over 10,000 internet-facing SAP systems are potentially exposed to these attacks.

SAP has published emergency security updates addressing a critical memory corruption vulnerability, identified as CVE-2026-44756, within its Extended Passport (EPP) processing logic. Security researchers at Onapsis, who dubbed the defect "OVERPASS," warn that unauthenticated attackers can exploit this bug to execute arbitrary system commands, steal database credentials, and manipulate SAP binaries across various platforms including S/4HANA and ERP. The flaw exists because missing boundary validations during data deserialization occur before standard authorization controls are applied, effectively bypassing user locks and role-based restrictions. Although SAP has not reported active exploitation in the wild, the severity of the issue—rated CVSS 10/10—demands immediate attention from administrators running affected kernel versions. The company also resolved three other high-priority issues, including CVE-2026-58240, which allows unregistered component registration in S/4HANA 2025 and earlier, alongside vulnerabilities affecting NetWeaver and cloud-capable applications.

Adobe has issued an emergency update to address CVE-2026-75650, a critical zero-day flaw in Magento and Adobe Commerce that is currently being leveraged to deploy backdoors on compromised servers. E-commerce security firm Sansec identified active exploitation of this vulnerability, referred to as StyleSmuggler, starting in early September, where attackers used it to install persistent access mechanisms disguised as NTP servers. Affected products include Adobe Commerce versions 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. The vendor has released the VULN-39341 hotfix to resolve this arbitrary code execution issue. Administrators are urged to apply the patch immediately and subsequently rotate all administrative credentials, API keys, and secrets to mitigate potential compromise.

Red Hat has disclosed a critical vulnerability chain in FreeIPA, tracked as CVE-2026-76578, which allows unauthenticated clients to create arbitrary Kerberos identities with administrator privileges. This attack exploits a combination of the identity management flaw and a separate issue in 389 Directory Server (CVE-2026-76560), enabling attackers to bypass ownership checks and write privileged entries to the directory database. The FreeIPA project has addressed this through version 4.13.4, while Red Hat has released patches for various distributions including RHEL and Fedora. Additionally, a second unrelated flaw in FreeIPA, CVE-2026-79678, was identified that allows authenticated users to leak environment variables via an unsafe eval call in the idp-add command.

Adobe has issued emergency patches for a critical remote code execution vulnerability affecting Adobe Commerce and Magento Open Source, confirmed to be under active attack. Tracked as CVE-2026-75650 with a maximum CVSS score of 10.0, this flaw allows attackers to execute arbitrary code by abusing the platform's template processing mechanisms. Threat actors have already leveraged the zero-day to install persistent threats, including a custom Rust-based Linux backdoor and PHP web shells on compromised stores. To mitigate the risk, administrators must immediately apply the VULN-39341 hotfix and rotate all encryption keys across vulnerable versions of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.