MikroTik published an important RouterOS security update on 3–4 September 2026 (supportsec bulletin and forum notice) with details withheld, shipping builds 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21 (7.24.2 and 7.23.4 later proved to be an incomplete fix; see the correction below). On 5 September 2026 CERT Polska disclosed six coordinated CVEs and confirmed active exploitation. UPDATE 23 September 2026 (The Hacker News technical analysis of CERT.PL MikroTrick): the actively exploited chain is CVE-2026-67279 (SSH state-machine / key-renegotiation skips auth success) combined with CVE-2026-86060 (login argv injection via username -2 → full-admin). CERT.PL's 5 Sep advisory confirmed exploitation but did not name that pair; some earlier write-ups incorrectly folded separate RSA key-forge CVE-2026-67276 into the chain — 67276 remains a distinct SSH auth bypass (needs account name + public modulus; yields that account only). Highest-impact standalone pair still includes CVE-2026-67276 (CERT.PL CVSS 9.2) and CVE-2026-86060 (CVSS 9.2). CVE-2026-67277 (CVSS 8.8) is unauthenticated bandwidth-test memory disclosure/crash. CVE-2026-67281 (CVSS 4.0 8.7 per CVE record) is unauthenticated WebFig /jsproxy file read that can disclose root-owned config stores. CERT.PL also lists CVE-2026-67278 and CVE-2026-67279 on the CVE details page. CERT.PL says the MikroTrick combination of two SSH flaws is being used for full takeover of devices with SSH on public networks; successful attacks creating a privileged user named ops have been seen from 82.192.72.4 since at least 2 September 2026, with 103.102.31.18 used in exploit attempts. Log IoCs include login failure for user -2 via ssh and user <name> added by ssh:-2@<ip>. Fixed releases set a Flagged marker when known compromise traces are found (absence of Flagged is not clean). Latvia's national CERT also reported increased MikroTik targeting and urged the same patched builds. Until patched: restrict SSH, WWW/WWW-SSL and bandwidth-test to trusted management nets; do not initiate TLS or built-in SSH clients from an unpatched box toward untrusted hosts. If Flagged or otherwise suspect: isolate, preserve logs/config, factory-reset and rebuild from a verified config, rotate secrets. Primary: CERT Polska active-exploitation advisory. UPDATE 10 September 2026: CISA added CVE-2026-86060 and CVE-2026-67277 to KEV (dateAdded 2026-09-10). UPDATE 25 Sep 2026: CISA also added CVE-2026-67279 (SSH state-machine / behavioural-workflow bypass — the MikroTrick auth-skip half) to KEV (dateAdded 2026-09-25; federal due 28 Sep). Internet-exposed SSH / bandwidth-test paths remain the priority; patch and hunt Flagged / ops / ssh:-2 IoCs. CORRECTION (21 Oct 2026): this card earlier gave 7.24.2 and 7.23.4 as fixed builds and advised 7.23.5 on the long-term channel. CERT Polska's advisory and the CVE-2026-67278 record say 7.24.2 and 7.23.4 contained an incomplete fix for CVE-2026-67278; the fixed releases are 7.24.3 (stable) and 7.23.6 (long-term) or later, and devices on 7.24.2 or 7.23.4 must be updated again. No source we cite mentions 7.23.5.
CERT Polska — RouterOS actively exploited (5 Sep 2026)
Rapid7 Labs (4 September 2026) describes a Linux toolkit that compiles the Ted implant into victims' own HAProxy 2.8.x builds so it can intercept selected web traffic, hide C2 from HAProxy stats, rewrite responses, and run commands via a named pipe under /tmp. It is not an HAProxy CVE: operators need code execution on the host and the ability to replace binaries. Companion tooling includes a trojanized sshd password logger, a stager that overwrites crond (CentOS 7.7-7.9 / Ubuntu 22.04 paths cited), and curlRAT (distinct from SideCopy's CurlBack). Rapid7 attributes the activity with medium confidence to DPRK APTs (ThreatFox/maltrail links to APT37 C2 lists) against South Korean automotive and media victims; initial access is hypothesised via exposed Groupware/mail edges consistent with Kimsuky tradecraft, not proven. Hunt for unexpected HAProxy rebuilds, crond/sshd replacements, and the IoCs in Rapid7's post; do not expose Groupware portals without patching and MFA.
Google's Stable Channel Update for Desktop (4 September 2026) promotes Chrome to 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux with 12 security fixes. High-severity CVE-2026-85046 is a type confusion in V8 that Google says allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page; Google states an exploit exists in the wild. NVD Secondary CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Salvatore Gulizia (Serotav) reported it on 4 August 2026. CISA added CVE-2026-85046 to KEV (catalog entry dated 4 September 2026). WA SOC advisory 20260907001 (7 September 2026, TLP:CLEAR) covers the same Chromium V8 type confusion for Chrome, Edge, Brave and Vivaldi prior to those builds, notes CISA KEV, and says it has not received reports of exploitation on Western Australian Government networks at the time of writing. Distinct from desk card chrome-firefox-20260902 (2 Sep Critical UAF batch at 152.0.7977.75/.76) and cve-2026-79290 (25 Aug Aura/ANGLE). UPDATE 9 Sep: Proofpoint BlueMoon exploit kit (desk card bluemoon-exploit-kit-20260909) chains this CVE with an un-CVE'd V8 sandbox escape and Windows CVE-2026-85880; APT31 first seen 28 Aug, then other espionage clusters. Update Chrome promptly; Chromium browsers (Edge, Brave, Opera, Vivaldi) should follow vendor builds.
Chrome Stable Channel Update for Desktop (4 Sep 2026)
Wordfence (via The Hacker News, 4 September 2026) reports active exploitation of CVE-2026-14894 in the WordPress plugin Super Forms – Drag & Drop Form Builder. NVD/Wordfence describe missing file-type validation on the unauthenticated submit_form AJAX handler (session nonce obtainable via a separate nopriv endpoint), allowing unauthenticated arbitrary file upload and remote code execution. Wordfence CVSS 3.1 is 9.8 Critical. Affected: all versions through 6.3.313; fixed in 6.3.314. Wordfence says it blocked over 250,000 exploit attempts against this CVE (plus ~190,000 against Elementor Pro CVE-2026-32475 in the same reporting wave; Elementor stays on its own desk card). Observed Super Forms attacks POST to /wp-admin/admin-ajax.php with action=super_submit_form and a Base64 PHP web shell disguised as a data:image/gif payload (e.g. Mushr00w_upl.php); activity began 14 July 2026 and peaked above 40,000 requests on 18 August 2026. Upgrade Super Forms to 6.3.314+; hunt unexpected .php under uploads; keep WAF rules current. Distinct from cve-2026-32475 (Elementor Pro).
Arctic Wolf Pack Alert (3 September 2026) tracks PREY-0058: executives (directors/VPs) are cold-called by actors impersonating internal IT/help desk and steered to authentication-themed lure domains (assignpasskey.com, mfaregister.com, nowsso.com, oskeysetup.com, oursso.com, passkey-mfa.com, passkeydeploy.com, registermymfa.com, setpasskey.com and org-specific subdomains). An operator-gated AiTM Microsoft 365 login harvests credentials and MFA approvals; stolen sessions are replayed via residential proxies (notably NodeMaven, often same geo/ASN as the victim). Post-access discovery hits SharePoint/Entra (SearchQueryPerformed with contentclass:STS_Site/STS_Web and indexdocid pagination), then bulk exfil from SharePoint, OneDrive, Exchange, and Box — no endpoint malware or network lateral movement observed. Overlaps GTIG UNC6671 tradecraft; related extortion brands cited include BlackFile, Pink, Helix, Cinder, and Redact (affiliate/rebrands, not a single proven identity). Targets primarily US construction/engineering, healthcare/pharma, real estate, finance, professional services. Defences: phishing-resistant MFA (FIDO2/device-bound passkeys), Conditional Access (device compliance; block proxy/hosting ASN), Continuous Access Evaluation, tighten SharePoint scope, train staff that IT will not cold-call for passkey enrolment. Wire: The Hacker News (7 Sep 2026). Distinct from BigBear Evilginx2 PhaaS already on desk.
ConnectWise ScreenConnect™ 26.6.5 Security Patch bulletin (8 September 2026, Priority 1 High) assigns CVE-2026-84869 for a client-side condition that may allow files to be transferred and executed through an active remote Support/Access session without authorisation or Host confirmation. ScreenConnect servers are not impacted. CWE-862 Missing Authorization / CWE-269 Improper Privilege Management; CVSS 3.1 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected: ScreenConnect versions prior to 26.6.5. Remediation: upgrade to 26.6.5 or later, then reinstall Host clients and update Access agents (Cloud servers already remediated per vendor). Interim mitigation until clients are refreshed: remove TransferFiles (and TransferFilesInSession on legacy) from applicable roles/session groups — not a substitute for the patch. Earlier 3 September Guest File Transfer Advisory and Huntress late-August worm-like rogue ScreenConnect client chain (Quick Assist → wscript → VBScripts / User Run Key) remain relevant context; Shadowserver has tracked thousands of internet-exposed instances. CISA KEV listed CVE-2026-84869 on 11 September 2026 (dateAdded 2026-09-11; catalogVersion 2026.09.11); this card remains the single ScreenConnect file-transfer topic. Distinct from faronics-deploy-screenconnect-20260831. Primary: ConnectWise 2026-09-08 bulletin.
Microsoft Security Research (3 September 2026) documents a high-volume phishing campaign that inserts invisible Unicode Tags-block characters (U+E0000-U+E007F) inside finance lure words such as funding so human readers still see the word while keyword/regex filters miss the contiguous string. Telemetry tied to a Defender for Office 365 hunting signature rose from about 21,000 hits on 8 February 2026 to more than 1.3 million the next day, stayed elevated on weekdays for roughly three months, and dropped sharply after 15 May 2026 (weekday peaks cited up to about 2.37 million). Microsoft links the Unicode-obfuscated wave to a broader ActiveCampaign-relayed SBA/finance-themed phishing cluster previously described by Fortra, with disposable finance-themed domains and click-tracking via ActiveCampaign hosts. Defenders should strip or normalise Unicode tag characters before keyword detection, hunt U+E0000-U+E007F outside legitimate subdivision-flag emoji use, and treat marketing-platform abuse as a reputation-filter complication.
iTnews (3 September 2026) reports the Australian Communications and Media Authority fined Telstra $277,000 for not applying required identity-authentication processes to prevent SIM-swapping fraud. ACMA said the fraud caused at least $39,500 in losses to 15 customers between January and October 2025, with 13 further attempts where agents failed to add fraud protections or to act on risk signals; ACMA member Samantha Yorke said frontline staff did not follow Telstra's own processes. SIM swaps let attackers move a victim's number onto their own SIM and intercept MFA codes and other mobile traffic. ACMA accepted court-enforceable undertakings for stronger fraud prevention and staff training. Context in the same report: a larger $1.551 million Telstra penalty in July 2024 for related ID-authentication failures, and more than $5 million in ACMA telco fines to date on mobile-number fraud. Watchlist relevance: Telstra.
OpenAI (3 September 2026) announced Daybreak for Frontline Defenders, a global initiative committing US$1 billion in subsidised Daybreak access, training, technical support and partnerships so under-resourced defenders of essential services (water, electricity, local government, banking and similar) can use frontier AI cyber capabilities. The package includes Daybreak for America with a Multi-State ISAC pilot and a Daybreak Defense Network of more than 35 enterprise products and partner-operated services. Initial priority is US defenders, with international expansion stated. Distinct from the 1 September Astra Critical cybersecurity capability designation on this desk; this card is the subsidy and defender-access programme, not the model-capability rating.
OpenAI Daybreak for Frontline Defenders (3 Sep 2026)
Broadcom VMSA-2026-0007 (3 September 2026, Critical) patches two privately reported host-escape-class bugs in VMware Workstation and VMware Fusion 25H2 and 26H1. CVE-2026-59346 is a VMXNET3 integer overflow (CVSSv3 up to 9.3) where a malicious actor with local administrative privileges inside a guest that uses the VMXNET3 virtual NIC may execute code on the host. CVE-2026-59347 is an HGFS stack-based buffer overflow (CVSSv3 up to 8.1) that can let a guest admin run code as the VMX process on the host. Fixed in Workstation and Fusion 26H1u1. No workarounds. Update 8 October: researcher 0xCyberstan published proof-of-concept code for CVE-2026-59346 on GitHub. It runs as a Linux kernel module inside a guest with a VMXNET3 adapter and writes transmit descriptors directly, so a 32-bit multiplication in the host's TCP segmentation offload path wraps, the buffer is undersized and guest data is written past it. The published code crashes the vmware-vmx process and powers off the VM; it is not a working code-execution exploit, and it needs admin rights inside the guest. The researcher ties it to the same code path patched for CVE-2025-41236. Broadcom does not report in-the-wild exploitation. These are desktop hypervisor bugs, not ESXi/vSphere advisories.
Verve Portraits, a family photography business that Cyber Daily describes as Sydney-based with studios in NSW, Victoria and Queensland, told Cyber Daily (8 September 2026) that it is "currently responding to a cyber incident involving unauthorised access to some company data". The company said the incident was contained as soon as it was detected, that it engaged independent cyber security specialists, and that the limited sample data reviewed so far includes a combination of company records and customer content. It says it is still assessing the full scope and that individuals identified as impacted will be contacted as they are discovered. According to Cyber Daily, the Settra extortion group listed the company in a 3 September leak post. UPDATE 22 Oct 2026: re-sourced to the company's own statement; this card previously rested on a leak-site listing alone (source: Cyber Daily, 8 Sep 2026). Correction (23 Oct 2026): removed Settra's own claims about the volume and content of the data, which Verve Portraits has not confirmed. (source: https://www.cyberdaily.au/security/14158-exclusive-verve-portraits-data-allegedly-compromised-by-settra-ransomware-attack)
Cyber Daily — Verve Portraits data allegedly compromised by Settra ransomware attack (8 Sep 2026, updated with company statement)
The Hacker News (3 September 2026) summarises a Symantec Threat Hunter Team report: since February 2026, operators have abused the legitimate, signed node.exe runtime to execute malicious JavaScript rather than dropping unsigned binaries, with registry Run-key persistence, against government, technology and hotel targets. One Asian technology company intrusion (March–July 2026) installed official Node.js from nodejs.org after ClickFix access, then used EtherHiding-style retrieval after AdaptixC2/Cobalt Strike beacons were blocked. Related tooling includes ModeloRAT, Mistic/MLTBackdoor (KongTuke/Woodgnat), GateKeeper, NexShield Chrome extension, and C2Looper against a U.S. fintech. Prefer application-control policies that constrain node.exe outside developer workstations; hunt for unexpected node.exe + Run keys and EtherHiding beacons.
