Cyber Threat Intel Daily Briefing — 2026-09-06

CYBER THREAT INTEL

DAILY BRIEFING · 2026-09-06 14:27 UTC · REPORT BRIEF-20260906-142743

OPEN // LE

01

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4. "Sansec is

SRC: The Hacker News Sun, 06 Sep 2026 01:44:47 +0530 https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html

02

Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code. "A

SRC: The Hacker News Sat, 05 Sep 2026 21:35:08 +0530 https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html

03

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as well as

SRC: The Hacker News Sat, 05 Sep 2026 13:01:53 +0530 https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html

04

HPE Patches Critical RCE Vulnerabilities in AOS-CX

Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates. The post HPE Patches Critical RCE Vulnerabilities in AOS-CX appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 04 Sep 2026 16:11:06 +0000 https://www.securityweek.com/hpe-patches-critical-rce-vulnerabilities-in-aos-cx/

05

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions. The post Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites appeared first on SecurityWeek.

SRC: SecurityWeek Sat, 05 Sep 2026 13:00:28 +0000 https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/

06

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted

Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets

SRC: The Hacker News Sat, 05 Sep 2026 19:47:02 +0530 https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html

07

European parliament members call for slowdown of Serbia’s EU entry over spyware use

The letter follows revelations about Serbian student activists being infected with Pegasus and NoviSpy, and coincides with other pressures on Belgrade. The post European parliament members call for slowdown of Serbia’s EU entry over spyware use appeared first on CyberScoop.

SRC: CyberScoop Fri, 04 Sep 2026 21:02:39 +0000 https://cyberscoop.com/eu-parliament-serbia-accession-spyware-demands/

08

CISA KEV: CVE-2026-85046 – Google: Chromium V8

CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog. The vulnerability affects Google Chromium V8. Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, an

SRC: CISA KEV Catalog 2026-09-04 https://www.cisa.gov/known-exploited-vulnerabilities-catalog

09

CISA KEV: CVE-2026-48710 – Kludex: Starlette

CISA added CVE-2026-48710 to its Known Exploited Vulnerabilities catalog. The vulnerability affects Kludex Starlette. Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability coul

SRC: CISA KEV Catalog 2026-09-02 https://www.cisa.gov/known-exploited-vulnerabilities-catalog

10

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and

SRC: The Hacker News Fri, 04 Sep 2026 20:21:13 +0530 https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html

11

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or

SRC: The Hacker News Sun, 06 Sep 2026 15:02:38 +0530 https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html

12

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The company named the four programs ProManager, WinUpdate, SoftManager, and

SRC: The Hacker News Sun, 06 Sep 2026 14:04:20 +0530 https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html

13

OpenAI confirms ‘wiki incident,’ says it’s ‘working on a framework’ for more disclosure

OpenAI acknowledged its role in a recently reported incident where AI agents took over a German wiki forum.

SRC: TechCrunch Security Sat, 05 Sep 2026 18:05:27 +0000 https://techcrunch.com/2026/09/05/openai-confirms-wiki-incident-says-its-working-on-a-framework-for-more-disclosure/

14

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.

SRC: The Hacker News Sat, 05 Sep 2026 22:22:33 +0530 https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html

15

Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel

A group of AI safety researchers says a fleet of autonomous agents that identified themselves as OpenAI systems left about 18,000 posts on a dormant 25-year-old German wiki between May and July 2026, using the site as a shared board to pool answers to a timed web task and pass around a way out of their sandbox. The activity was concentrated on DSEwiki, a German software developer wiki that runs

SRC: The Hacker News Sat, 05 Sep 2026 13:25:10 +0530 https://thehackernews.com/2026/09/thousands-of-openai-agents-quietly.html

16

Companies Have 6 Months to Prepare for Automated Attacks

Frontier AI models have already demonstrated they can autonomously — and in some cases, inadvertently — conduct end-to-end compromises, but the situation will become more urgent very soon.

SRC: Dark Reading Fri, 04 Sep 2026 15:57:31 GMT https://www.darkreading.com/cybersecurity-operations/companies-six-months-prepare-automated-attacks

[ SOURCE ] Article: CISA KEV: CVE-2026-85046 – Google: Chrom… (1 indicator(s))

[ SOURCE ] Article: CISA KEV: CVE-2026-48710 – Kludex: Starl… (1 indicator(s))

[ SOURCE ] OpenPhish (18 indicator(s))