Vulnerabilities
Tue 8 Sep
Ivanti's 8–9 September 2026 security update discloses flaws in Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM). SecurityWeek citing Ivanti: Neurons for ITSM has eight bugs including six critical — missing-authorization CVE-2026-12647/12645/12646 (CVSS 9.9) and deserialization CVE-2026-12650 (9.9), CVE-2026-12744/12745 (9.8); only CVE-2026-12744 and CVE-2026-12745 are unauthenticated per that coverage. Fixed in Neurons for ITSM 2025.2/2025.3/2025.4/2026.1 September builds (2026.2 due 21 Sep). Sentry R10.8.2 / R10.7.3 / R10.6.4 patch high auth bypass CVE-2026-83527 (unauth admin). EPMM 12.10.0.0 / 12.9.0.2 / 12.8.0.4 patch high auth bypass CVE-2026-18851 (authenticated). Ivanti blog: no evidence of exploitation in the wild; other Ivanti products not affected. Primary vendor posts: Ivanti September 2026 Security Update blog and Neurons for ITSM hub advisory.
Ivanti September 2026 Security Update blog (8 Sep 2026)
vulnerabilities identity cloud network
Vulnerabilities
Tue 8 Sep
Google's Stable Channel Update for Desktop (8 September 2026) promotes Chrome 153 to 153.0.8010.36 (Linux) and 153.0.8010.36/.37 (Windows/Mac). Google lists Medium CVE-2026-87491 as an out-of-bounds write in V8 (reported 6 August 2026 by Jihyeon Jeong, Compsec Lab, Seoul National University) and states an exploit exists in the wild — the seventh Chrome zero-day Google has fixed in 2026 per same-day wire coverage. BleepingComputer (9 September) describes remote code execution inside the sandbox via crafted HTML and heap corruption risk; Google has not published attack details while uptake is incomplete. Distinct from desk card cve-2026-85046 (4 Sep V8 type-confusion 0-day at 152.0.7977.82/.83) and chrome-firefox-20260902. Update Chrome promptly; other Chromium browsers should follow vendor builds. NEW 11 September 2026 (WA SOC advisory 20260911001, TLP:CLEAR): Chromium V8 Known Exploited Vulnerability covers the same CVE-2026-87491 for Google Chrome versions prior to 153.0.8010.36; WASOC table lists CVSS 8.8 High (out-of-bounds write enabling code execution inside the sandbox via crafted HTML). Notes Google is aware of in-the-wild exploit use and CISA KEV listing; WASOC had not received reports of exploitation on Western Australian Government networks at time of writing. Patch Chrome/Chromium browsers to 153.0.8010.36+ per vendor.
Chrome Stable Channel Update for Desktop (8 Sep 2026)
vulnerabilities cloud
Vulnerabilities
Tue 8 Sep
cPanel's 8 September 2026 advisory is titled SQL injection in EmailTrack. The body says an authenticated account with mail-related privileges can create arbitrary files through EmailTrack, and that success is code execution as root. All supported versions. Patched builds: 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and WP Squared 11.138.1.9. Credit to Ali Mustafa (rz1027) and abed1526. No CVSS and no exploitation claim on the vendor page. Separate from the August domain-parking flaw and from the April login bypass. THN (9 Sep) confirms no public exploit and absence from CISA KEV catalog version released 8 Sep; notes related July DB and August parking flaws have purported exploit repos online.
cPanel advisory (8 Sep 2026)
vulnerabilities cloud
CrowdStrike (covered by The Hacker News, 8 September 2026) tracks Slim Spider, a Brazil-based e-crime cluster active against Brazilian financial institutions since at least March 2026. In a late-March 2026 multi-stage intrusion at a Brazilian financial institution, the actor targeted crypto custody assets and Pix instant-payment infrastructure: custom Bash scripts queried cloud instance metadata for temporary credentials, enumerated secrets in the cloud credential manager, used Foundry cast to derive an Ethereum wallet address from a stolen private key, and implemented cloud-native signing via OpenSSL. The actor also pivoted to Azure DevOps to run malicious pipelines that deployed implants across a managed Kubernetes cluster, including backdoors mimicking legitimate infrastructure binaries (e.g. "spi" impersonating Sistema de Pagamentos Instantâneos). Primary: CrowdStrike adversary page; wire: The Hacker News.
CrowdStrike — Slim Spider adversary page
breaches cloud identity
Vulnerabilities
Tue 8 Sep
The Hacker News (8 September 2026) reports security firm Calif built a worm that takes over a WeChat account via an incoming call and demonstrated spread across three test phones. The callee does not need to answer or touch the phone, but the caller must already be a WeChat contact. Calif reported the flaw to Tencent in July and says the company has since shipped a fix (wire does not name a CVE in the RSS abstract). Treat as a messenger client/patch urgency item for WeChat on iPhone and Android; confirm your app store build is current. Wire-only until a Tencent/CVE primary is linked. Primary wire: The Hacker News.
The Hacker News — WeChat Calif worm (8 Sep 2026)
vulnerabilities identity australia
Vulnerabilities
Tue 8 Sep
SAP’s September 2026 security patch day (covered 8 September 2026 by BleepingComputer and SecurityWeek) includes CVE-2026-44756, a maximum-severity memory-corruption bug in Extended Passport (EPP) processing in the SAP kernel, dubbed OVERPASS by Onapsis. Missing boundary checks on externally supplied length fields during EPP deserialization can let unauthenticated attackers run OS commands as the SAP installation owner, recover DB credentials/password hashes, read live user sessions, and modify data/binaries. Onapsis says EPP is hit as a session opens (before authz controls), via web/ICM, SAP GUI, and RFC; products relying on the vulnerable kernel include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO, Solution Manager and others. Onapsis estimates >10,000 internet-facing SAP web interfaces; no in-the-wild exploitation indicators reported for OVERPASS at publish. Same cycle: CVE-2026-58240 (S4GET) missing authentication on NetWeaver Message Server enabling unauth cluster RCE as <sid>adm; also critical CVE-2026-76969 (CAP credential disclosure) and CVE-2026-66768 (NetWeaver access control). Apply SAP Security Notes for September 2026 immediately; do not invent CVSS for sister CVEs beyond vendor/Onapsis statements. Primary research: Onapsis; wires: BleepingComputer / SecurityWeek.
BleepingComputer — SAP OVERPASS CVE-2026-44756 (8 Sep 2026)
vulnerabilities cloud identity ot ics
Vulnerabilities
Tue 8 Sep
Updated Tue 27 Oct
Microsoft’s 8 September 2026 Patch Tuesday is its largest security release on record. BleepingComputer counts 966 flaws shipped on Patch Tuesday itself (105 Critical, including 81 RCE), excluding 204 flaws fixed earlier in the month in cloud products; SecurityWeek and Krebs count about 974 CVEs across the broader September bundle. Two actively exploited elevation-of-privilege zero-days are fixed: CVE-2026-81963 (Windows Update Stack link-following to SYSTEM; credited to Romain Deperne and MSTIC) and CVE-2026-85880 (Windows ALPC heap buffer overflow to SYSTEM / AppContainer sandbox escape; Volexity and Proofpoint researchers). Coverage notes ~20 potentially wormable unauthenticated RCEs in the set and calls out Exchange (CVE-2026-55007), SharePoint (CVE-2026-69465), RDS (CVE-2026-69525), SQL (CVE-2026-65669), and Authenticator (CVE-2026-80097) among high-priority items. Microsoft attributes the volume increase partly to AI-assisted vulnerability discovery. NEW 8 Sep KEV: CISA added both exploited zero-days to the Known Exploited Vulnerabilities catalog on 2026-09-08 (catalog 2026.09.08) — CVE-2026-81963 and CVE-2026-85880 (FCEB dueDate 2026-09-22). WA SOC advisory 20260909001 (9 September 2026, TLP:CLEAR) summarises the September Monthly Updates as addressing 973 vulnerabilities, highlights critical CVE-2026-69730 and CVE-2026-69525 (CVSS 9.8) plus the two known-exploited EoPs (CVSS 7.8), notes Microsoft detected exploitation of one or more of the mentioned vulnerabilities, and says WASOC has not received WA Government exploitation reports at the time of writing. Prioritise the two exploited EoPs, internet-facing roles, and Extended Security Updates where applicable. UPDATE (23 Oct 2026; Enclave, Microsoft): Enclave researcher Ofek Levin published details on 23 October of 'AuthMask', a Microsoft Authenticator for Android flaw tracked as CVE-2026-80097, which Microsoft's advisory lists as released on 8 September. Enclave says Microsoft confirmed and fixed the issue after Enclave reported it. Enclave also says an Android app with zero permissions could pretend to be any installed Microsoft first-party app, such as Teams, and get Authenticator, acting as the sign-in broker, to hand it that app's tokens for a work account signed into Authenticator, because an exported activity trusted the caller's own description of itself; in Enclave's tests the tokens gave full delegated mailbox, files and calendar access and, by impersonating Authenticator's own client, the ability to create and delete passkeys, with no user interaction beyond having Authenticator signed in to a work account. Microsoft's advisory (released 8 September) rates it CVSS 3.1 8.6, Important, says an attacker would need to install a malicious app on the device and convince the user to complete an authentication flow in Authenticator, and lists it as not exploited and not publicly disclosed at the time of original publication; the CVE record lists Microsoft Authenticator for Android from 6.0.0 to before 6.2606.4246 as affected. Help Net Security reported the research on 27 October. (source: Enclave; Microsoft Security Update Guide CVE-2026-80097; Help Net Security)
BleepingComputer — September 2026 Patch Tuesday (8 Sep 2026)
vulnerabilities cloud identity australia
Vulnerabilities
Tue 8 Sep
The Hacker News (8 September 2026) summarises Red Hat guidance that a FreeIPA flaw lets a client that has never logged in create a Kerberos identity of its choosing in the directory and end up in the administrators group. FreeIPA stores identities in 389 Directory Server over LDAP; the attack also needs a second flaw in that database software. Wire abstract does not list CVE IDs or fixed package versions — operators should pull current RHEL/FreeIPA errata from Red Hat rather than inventing patch levels. Primary wire: The Hacker News pending RHSA deep-link. Watchlist relevance: Red Hat / identity plane.
The Hacker News — FreeIPA admin credential chain (8 Sep 2026)
vulnerabilities identity cloud
BleepingComputer (8 September 2026) covers German firm Nebty’s report on DoppelCart, a fake e-shop cluster of more than 119,000 domains (mostly .SHOP; Nebty says ~2.72% of that TLD), with more than 105,000 still active in latest scans. About 96% of confirmed shops share identical build files and resolve to 27 commerce backends; they impersonate ~44,182 brands (median two clones each; some brands >30 clones) and advertise discounts up to ~65%. Checkout pages collect PAN, expiry, CVV, name, email, phone and address over WebSockets to C2 in real time, and can relay bank OTPs. Victims sometimes email the real brand’s support address shown on the fake shop. Nebty built a searchable brand-abuse database and said the main hosting provider did not respond. Distinct from BogusBazaar (~75k sites). Wire: BleepingComputer; research: Nebty.
BleepingComputer — DoppelCart (8 Sep 2026)
tech cloud identity
Check Point Research (published 8 September 2026; covered by The Hacker News the same day) found a covert two-way channel between code-execution containers of separate ChatGPT accounts via an internal JFrog Artifactory package service those containers could all reach. Containers could write/read shared item metadata, turning package-delivery properties into a clipboard between supposedly isolated sessions. A planted prompt, shared conversation link, or custom GPT instruction could make a victim session pull a hidden task, use the victim’s already-granted connected-app permissions (CPR demo: Gmail), and exfiltrate results to the attacker’s session while the visible reply looked normal; CPR noted a small “Talked to Gmail” label after the fact. OpenAI confirmed the specific internal Artifactory instance was decommissioned after disclosure. CPR also notes its PoC predated separate activity on that Artifactory instance linked to a Hugging Face compromise OpenAI has disclosed. Lesson: AI assistants with tool/connectors are coerced-insider risk. Primary: Check Point Research blog.
Check Point Research — ChatGPT hidden channel / Gmail (8 Sep 2026)
ai cloud identity network
Incidents
Tue 8 Sep
Updated Sun 25 Oct
BleepingComputer exclusive (8 September 2026): Kinryū Labs found an internet-reachable Elasticsearch cluster named "pax-info" (Viettel-assigned IP space, Hanoi) holding Advance Passenger Information System (APIS) data — 210,318,069 passenger and 10,465,631 crew records (220,783,700 entries, ~107 GB across 29 indices) spanning January 2017 to April 2026. Fields included names, dates of birth, sex, nationalities, passport/travel-document numbers and expiry, issuing countries, plus flight numbers/dates, airlines, origin/destination/transit airports, seats, baggage refs, and scheduled/estimated/actual times. Sample records reviewed included Korean, Chinese, Canadian, and New Zealand nationalities among others; many international carriers across Asia-Pacific, Europe, and the Middle East appear, so travellers who flew to/from/through Vietnam may be affected (counts are travel records, not unique people). Access path: open internet returned HTTP 401, but a cloud-based path reached the cluster which then accepted default credentials (FOFA saw the host/port from Oct 2022; exposure duration via the second path unknown). Kinryū reported to Vietnamese authorities, airlines, and national CERTs from 3 June 2026; access remediated 8 June 2026 after Singapore Airlines security helped coordinate containment. No ransom notes or sales listings found; without server logs, prior copying cannot be ruled out. Operator organisation not confirmed. Kinryū Labs published its own report on 9 September 2026. Primary wire: BleepingComputer; researcher: Kinryū Labs.
BleepingComputer — Vietnam-linked APIS leak (8 Sep 2026)
breaches australia cloud identity
SOCRadar (covered by The Hacker News, ~7 September 2026) documents PEEP, a Chromium-based post-exploitation toolkit that requires prior admin or code-execution access. An installer injects a malicious extension masquerading as "Smart Bookmarks" into Chrome/Edge profiles; the extension (based on the open-source RedExt framework) beacons for commands, harvests browser data, and uses a native messaging host (nm_host.exe) for host-level command execution and file management. Chinese-language artifacts in the source point to a Chinese-speaking actor; activity remains unattributed. Distinct from browser-infostealer cards: this is a post-compromise backdoor, not an initial-access drop. Primary wire: The Hacker News; research: SOCRadar.
The Hacker News — PEEP Chromium toolkit (~7 Sep 2026)
tech identity cloud
