Vulnerabilities

A new exploit kit called BlueMoon is letting espionage groups chain Chrome and Windows flaws to plant backdoors on government, defense, and commercial targets. Proofpoint counted four clusters using it since late August 2026, most suspected of a China nexus, though some use is unattributed and the kit may not be exclusive to Chinese actors.

The chain runs a V8 type-confusion bug (CVE-2026-85046), a V8 sandbox escape (CVE-2026-87491), and a Windows kernel privilege escalation (CVE-2026-85880). Both Chrome flaws were patch-gap zero-days, fixed in public Chromium source but missing from stable releases. That gap has since closed, with the V8 fix reaching stable Chromium on September 3.

Exposure is narrower than it sounds. The privilege escalation only fires on older Windows builds, which Proofpoint says substantially cuts the pool of viable targets, and successful exploitation ends in a plain curl command that leaves endpoint tools plenty to catch. Circumstantial signs point to AI-assisted development, including verbose debugging comments and a markdown handover file of the kind coding agents leave behind.

TA412, also known as APT31, posed as students seeking internships and conference organizers to reach US NGOs, mining firms, and commodity traders, then installed a surveillance extension disguised as Google Gemini across Chrome, Edge, Brave, and Vivaldi. How four groups obtained the same kit is unknown. Proofpoint expects the technique to reach financially motivated actors too.

Source: Cybersecurity News

A critical zero-day called StyleSmuggler is being actively exploited against Magento Open Source stores, giving unauthenticated attackers remote code execution. Dutch security firm Sansec, which disclosed the flaw on September 5, 2026, says every current version of Magento and Adobe Commerce is affected. It published early because stores were already being compromised.

Sansec reproduced the attack chain on clean 2.4.7, 2.4.8, and 2.4.9 installations, and the first identified victim ran 2.4.6-p15 with July and August 2026 patches applied. The exploit abuses Magento's own template and email systems, dropping a Rust implant disguised as a Linux kernel thread.

Adobe has issued no advisory, CVE, or fix. Its next scheduled security release is September 8, though Sansec says there is no confirmation it covers this bug. Until then, store owners are on stopgaps.

Disrex, ProxiBlue, and Graycore have each published unofficial patches guarding specific Magento classes. Disrex says its own patch is verified against 2.4.6 through 2.4.9. Sansec recommends temporarily disabling GraphQL, which classic and Hyvä themes generally don't need, unlike headless and progressive web app storefronts.

The layer that doesn't depend on knowing the exploit is server-level. Disable PHP's exec functions, proc_open included, since a list blocking five of the six stops nothing, and mount temporary directories with noexec. Check both var/report and var/log/system.log too, since Sansec's published check looks only at the first

Source: Cybersecurity News

SonicWall confirmed on Tuesday, September 1, that attackers are actively exploiting two zero-days in its SMA 1000 remote-access appliances. CVE-2026-83548 (SSRF, CVSS 10.0) hits the user-facing Workplace portal; CVE-2026-83549 (OS command injection, CVSS 7.8) sits behind the admin console. Chained, the first supplies the authentication the second needs — unauthenticated remote code execution.

Models 6210, 7210, and 8200v are affected on 12.4.3-03453 or 12.5.0-02835 and older. Upgrade to 12.4.3-03526 or 12.5.0-02952. Patching isn't the end of it: SonicWall says compromised appliances need re-imaging or redeployment, every user and admin password changed, and TOTP tokens reset.

There is little to check against, though: Rapid7 found no public proof-of-concept, no published indicators of compromise, and no attribution — so a verdict runs through SonicWall's support team rather than a threat feed.

This is the second such pair on the SMA 1000 in two months. July's CVE-2026-15409 was the same shape — pre-auth SSRF plus post-auth command injection — and CISA later flagged it as used in ransomware campaigns. NHS England rates further exploitation as almost certain.

Source: Dark Reading

CISA added two SonicWall SMA1000 vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2, 2026, giving federal agencies just three days to act. SonicWall disclosed both as zero-days after finding them under active exploitation.

CVE-2026-83548 (CVSS 10.0, Critical) is a pre-authentication SSRF flaw in the Appliance Work Place interface. CVE-2026-83549 (CVSS 7.8, High) is an OS command injection in the Appliance Management Console that normally requires admin authentication. Chained, the SSRF supplies that access — turning the pair into unauthenticated remote code execution.

SonicWall says it has seen exploitation of both, which points to chaining, and that no public proof-of-concept exists. Affected models are the 6210, 7210, and 8200v; the fix is hotfix 12.4.3-03526 or 12.5.0-02952 and higher.

SMA1000 appliances handle enterprise remote access, making them high-value targets. CISA has flagged both under Binding Operational Directive 26-04, requiring forensic triage — not just patching. Audit admin activity, check for new accounts, and review outbound connections. If you find signs of compromise, SonicWall says to re-image, rotate all passwords, and reset TOTP tokens.

Source: Cybersecurity News

CISA gave federal agencies until 24 August 2026 to patch CVE-2026-73570, a Zimbra flaw allowing unauthenticated remote code execution through crafted SMTP requests. That deadline has now expired. The CVE record scores it 8.9 (High); Zimbra and CERT Polska both describe it as critical.

The flaw only bites where three things line up: the optional zimbra-snmp package is installed, SNMP notifications are enabled via snmp_notify, and the swatchdog service is running. Only the last of those is on by default. Zimbra shipped the permanent fix in ZCS 10.1.20 on 20 July, and every earlier version is affected.

Exploitation was confirmed on 17 August, when Poland's CERT Polska flagged an ongoing campaign. CISA added the flaw to its KEV catalog on 21 August and gave three days, under the tiered model it adopted in June citing AI-accelerated exploit development. Shadowserver counted 155 compromised internet-facing instances on 20 August and 274 by the 22nd, plus roughly 8,200 unpatched.

Patching closes the entry point but does not remove persistence installed before it, Sectigo's Jason Soroko notes. CERT Polska says to check /var/log/zimbra.log for unexpected "Service status change" entries, and anything the zimbra user created in the last 30 days under the Jetty webapps directories or /tmp. Treat an exposed server as an incident, not a patch.

Source: Dark Reading

CISA added a Zimbra vulnerability, CVE-2026-73570 (CVSS 8.9, High), to its Known Exploited Vulnerabilities catalog on August 21, giving federal civilian agencies until August 24 to patch or stop using the software — a deadline that has now passed. The fix is Zimbra Collaboration Suite 10.1.20, released July 20.

The flaw lets unauthenticated attackers run arbitrary OS commands as the Zimbra user through crafted SMTP requests. Exposure is narrower than it sounds — only servers with the optional zimbra-snmp package installed and SNMP notifications enabled are affected. CERT Polska flagged an active campaign hunting them on August 16.

Merlin Group's Robert Costello notes that compromising a Zimbra server exposes messages, calendars, contacts and attachments, along with internal naming conventions and maintenance schedules — enough to fuel follow-on attacks. Patching won't evict an intruder already inside, so exposed servers need checking against CERT Polska's indicators, not just updating.

Black Hills Information Security's John Strand argues AI is compressing the gap between disclosure and working exploit, pushing urgent patching closer to incident response than routine maintenance.

Source: Dark Reading

A critical vulnerability in the Node.js sandboxing library isolated-vm can let untrusted JavaScript break out of its sandbox and hijack the host process. Tracked as GHSA-864f-rcv7-6rh4, the flaw affects versions before 7.0.1 and 6.2.0, with fixes released August 8, 2026.

Endor Labs researchers found the bug in native C++ binding code handling data transfers between V8 Isolates. An attacker can exploit a type-confusion and TOCTOU gap in ExternalCopy's transferList option using a JavaScript getter — swapping a valid ArrayBuffer for malicious data between validation and transfer.

At minimum, this crashes the host process. At worst, it enables arbitrary code execution outside the sandbox. Upgrade immediately.

Source: Cybersecurity News

A critical GitLab vulnerability (CVE-2026-19478) is being actively exploited, and administrators of self-managed instances need to patch immediately. Rated 9.4/10, the flaw lets unauthenticated attackers inject code through GitLab's GraphQL interface — no account or user interaction required.

Attackers can delete repositories, manipulate merge records, and ban legitimate maintainers from public projects. Security firm WatchTowr reproduced the exploit within minutes of disclosure and confirmed its honeypot network recorded live exploitation attempts.

The vulnerability spans GitLab CE/EE  versions 18.2 through 18.11.10, 19.0 through 19.0.7, 19.1 through 19.1.5, and 19.2 through 19.2.3. Patched builds (18.11.11, 19.0.8, 19.1.6, 19.2.4) are available now. GitLab.com and Dedicated users are already protected. If you can't upgrade immediately, restrict GraphQL endpoint access and treat exposed servers as potentially compromised.

Source: Cybersecurity News

A critical Microsoft SharePoint Server flaw (CVE-2026-55040, CVSS 9.1) is drawing exploitation attempts after Rapid7 published proof-of-concept code on August 11, 2026. Discovered by Rapid7 senior principal researcher Stephen Fewer, it lets unauthenticated attackers forge JWT tokens and assume the identity of any SharePoint site user or administrator — no credentials needed.

Microsoft rescored its advisory from medium to critical on the day it shipped the fix. An attacker needs to know the account they're impersonating, but Rapid7's script enumerates Active Directory SIDs to find the site administrator itself. SharePoint Online isn't affected.

Worse, the bypass is half of a chain Rapid7 built for full unauthenticated remote code execution. The other half, CVE-2026-63520 (CVSS 8.1, High), was patched only on August 11, and it also hits Project Server and Office Web Apps Server — Microsoft split the fix across two cycles, so July's update closes the bypass and nothing more.

Exploitation so far is telemetry, not confirmed victims: Defused saw Rapid7's PoC fired at its SharePoint honeypots within a day, and KEVIntel sensors have logged attempts since July 19. Microsoft hasn't confirmed in-the-wild exploitation, and it isn't in CISA's KEV catalog.

Patch both. July's fix is KB5002882 (Subscription Edition, build 16.0.19725.20434), KB5002883 (Server 2019, 16.0.10417.20175) and KB5002891 (Enterprise Server 2016, 16.0.5561.1001); August's updates take those to 16.0.19725.20522, 16.0.10417.20198 and 16.0.5565.1001. If you haven't applied either, time to do it now.

Sources: The Hacker News | Rapid7

Security researcher "Ynwarcs" has published proof-of-concept exploit code for CVE-2024-38063, a critical zero-click vulnerability affecting all Windows systems with IPv6 enabled. Originally discovered by XiaoWei of Kunlun Lab, this remote code execution flaw targets Windows 10, Windows 11, and Windows Server without requiring any user interaction.

The exploit code is now available on GitHub for researchers to study, but this also increases the risk of malicious actors exploiting the vulnerability. Microsoft is urging users to install the latest security updates immediately to protect against potential attacks. Organizations should prioritize patching and monitor for unusual IPv6 packet activity.

Source: Dark Reading