CVE-2025-10478, CVE-2026-11645, CVE-2026-12663, CVE-2026-19471, CVE-2026-19472, CVE-2026-19949, CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-62906, CVE-2026-69857, CVE-2026-70178, CVE-2026-75925, CVE-2026-77393, CVE-2026-77477, CVE-2026-77847, CVE-2026-82684, CVE-2026-82712, CVE-2026-83548, CVE-2026-83549, CVE-2026-84323, CVE-2026-84324, CVE-2026-84325, CVE-2026-84326, CVE-2026-84329, CVE-2026-84348, CVE-2026-84351, CVE-2026-84356, CVE-2026-84358, CVE-2026-85046
Domains:
infect[.]online, infect[.]online., 185[.]97, duckdns[.]org.
Get tomorrow's brief in your inbox
Today: Google patches a seventh Chrome zero-day exploited in the wild, SonicWall SMA 1000 customers face another actively exploited vulnerability pair added to CISA's KEV catalog with a September 5 remediation deadline, and a threat actor leaked over 153 million US and Canadian driver's license images on a dark web marketplace.
Google Chrome Zero-Day CVE-2026-85046
Google patched a V8 type confusion vulnerability (CVE-2026-85046, CVSS 8.8) actively exploited in the wild. The flaw allows remote code execution inside the sandbox via a crafted HTML page. This is the sixth Chrome zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645, all on CISA's KEV catalog. Researcher Salvatore Gulizia discovered the bug in the V8 compiler that allows an array with PACKED_ELEMENTS to receive the PACKED_SMI_ELEMENTS map, leading to arbitrary read/write on the JavaScript heap.
SonicWall SMA 1000 Zero-Days CVE-2026-83548 & CVE-2026-83549
SonicWall disclosed two actively exploited zero-days in SMA 1000 appliances, added to CISA's KEV catalog with a September 5 remediation deadline. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF vulnerability; CVE-2026-83549 (CVSS 8.8) is an OS command injection flaw. Rapid7 confirmed the vulnerabilities can be chained for unauthenticated remote code execution. SonicWall did not disclose when exploitation began, how many customers were impacted, or provide IOCs in the advisory. The company acknowledged investigating a case indicating active exploitation but also claimed internal discovery. SonicWall SMA 1000 has faced five KEV-listed vulnerabilities since mid-December 2025. Ransomware groups INC and Akira have previously targeted SonicWall products.
153 Million Driver's Licenses Leaked on Dark Web
A threat actor published over 153 million US and Canadian driver's license scans on a dark web identity theft service called Nexus. The actor claimed the data was exfiltrated from an active breach at an identity verification firm serving Fortune 500 companies. Investigative journalist Brian Krebs verified the presence of legitimate driver's licenses on Nexus and identified the likely source as IDScan.net, a Louisiana-based ID verification platform processing over 21 million verifications monthly at 20,000+ locations across 12 industries. The FBI launched an investigation after discovering some licenses belong to FBI agents. The Nexus platform was shut down shortly after public disclosure.
| Group | Victim | Sector | Country |
|---|---|---|---|
| Vexy | McDonald's Ecuador | Food Service | Ecuador |
| Vexy | Engefitas | Manufacturing | Brazil |
2 claims tracked across 1 group in the last 48 hours. These are unverified claims from ransomware leak sites, not confirmed breaches.
AI-Enabled Ransomware Attack Delivers 80-Page Security Audit
Palo Alto Networks Unit 42 documented a September 2 ransomware attack where the attacker used AI agents to execute every step of the intrusion, completing enterprise compromise in 10 hours. The attacker left an 80-page security audit as a postscript to the attack. The incident demonstrates AI capabilities reaching mid-level stages of the AI Malware Maturity Model (AIM3), where AI supports discrete functions like persistence, UI interaction, malware development, and delivery rather than fully autonomous operations.
Toy Ghouls Deploys Custom HiveMQ and Element Backdoors
Kaspersky identified two custom backdoor versions deployed by Toy Ghouls (Bearlyfy, Laboo.boo, Feral Wolf), a financially motivated group targeting Russian organizations since 2025. The group shifted from public GitHub tools and leaked Babuk/LockBit ransomware builders to custom GenieLocker ransomware and now custom backdoors. The mqtt-bird-agent 0.1.0 uses HiveMQ MQTT broker as C2; matrix-bird-agent 0.1.0 uses Element messenger. Both backdoors establish persistence as Windows services, use ChaCha20-Poly1305 encryption for configuration files bound to the machine's MachineGuid, and collect browser histories, digital certificates, and screen captures.
Shai-Hulud Infostealer Worm Expands to 469 Credential Locations
GitGuardian discovered a Shai-Hulud infostealer worm variant scanning 469 credential locations across developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm targets publishing credentials to turn credential theft into software distribution. The malware searches .env files, shell history, package-manager configuration, CLI caches, CI/CD configurations, and IDE settings.
BraZetsu Malware Framework Fuels Brazilian IAB Marketplace
Group-IB disclosed BraZetsu, a Python-based Windows malware framework turning compromised hosts into commercial assets for Initial Access Brokers (IABs). The framework uses AI to triage data and prioritize high-value targets, targeting Iberian and Latin American e-commerce, corporate, financial, industrial, and law enforcement sectors. BraZetsu scans for Brazilian CNAB financial files, extracts browser histories, and maintains WebSocket communication with the "Infected Marketplace" (infect[.]online), where criminals purchase remote access for $5.80. The threat actor Exilware was first discovered February 2, 2026, and the Python framework first appeared May 2026.
RMM Phishing Campaign Targets 46 Countries, US Top Target
ANY.RUN research identified an RMM phishing campaign spanning 46 countries, with 45% of activity targeting the United States across 601 cases. Attackers use fake documents (Canada Revenue Agency tax forms, shipping/UPS communications, Adobe PDFs, Social Security Administration themes, invoices) to trick victims into installing legitimate RMM software. The campaign rotates infrastructure daily, using 425 kit URLs across 240 hosts, with 94% observed for only a single day. Delivery infrastructure includes Vercel, GitHub Pages, Netlify, compromised websites, Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, Dropbox, and GoFile. Persistent fingerprints include font1.woff2 assets and the secure.html → project/*.zip delivery structure. Top targeted industries: education, technology, government, banking, finance, manufacturing.
AI Agents Used in Multi-Stage Latin American Campaigns
Unit 42 analyzed two campaigns targeting Latin American organizations using AI to enhance operations. CL-CRI-1131 targeted Mexican transportation, federal government ministries, and municipal water utilities in Mexico and Ecuador using living-off-the-land techniques, iterative batch scripts, and self-hosted NextChat instances. CL-CRI-1163 targeted Brazilian financial sector via vulnerable web servers in job-themed phishing, deploying custom RATs and Go-based SOCKS5 proxies with iterative filenames suggesting AI-enablement. Both clusters share overlapping SOCKS5 relay infrastructure and rely on commercial LLMs to orchestrate operations. Host-based operations reflected LLM trial-and-error patterns, including repeated attempts to dump SAM/NTDS.dit files and numbered batch scripts with successive fixes.
All-in-One WP Migration and Backup SQL Injection CVE-2026-19949
Defiant disclosed a second-order SQL injection vulnerability (CVE-2026-19949, CVSS 8.8) in the All-in-One WP Migration and Backup WordPress plugin affecting 3.2 million sites. The flaw exists in the archive restore functionality due to insufficiently escaped user input. An unauthenticated attacker can submit two trackbacks to a public post carrying trailing backslashes and URLs leading to payloads. During archive import, the input is promoted to executable SQL, writing the secret key to a public comment. The attacker retrieves the key via the comments REST API endpoint and imports a crafted .wpress archive containing a malicious must-use plugin for RCE. Version 7.110 (released August 20) patches the flaw. As of September 3, only 35% of installations updated, leaving 3.2 million sites vulnerable.
IXON VPN Client CRLF Injection CVE-2026-75925
CISA published an advisory for CVE-2026-75925, a CRLF injection vulnerability in IXON VPN Client before 1.4.7. Configuration values accepted by the local service are written to a file consumed by a privileged subprocess without line-ending neutralization, allowing additional directives to be introduced. The configuration interface accepts changes without authentication or origin verification (CWE-306). The injected configuration persists across restarts, allowing remote code execution as root or SYSTEM. As of August 5, 2026, IXON cloud rejects connections from clients below v1.4.7, preventing unpatched installations from completing the exploit chain.
Rockwell Automation Industrial Control System Vulnerabilities
CISA published advisories for multiple Rockwell Automation products. ArmorStart LT firmware v2.001 contains stored XSS (CVE-2026-19471) and HTTP PUT request DoS (CVE-2026-19472); update to v2.002. ControlFLASH v15.07 grants Everyone group write permissions on installation directory (CVE-2026-12663), allowing arbitrary code execution; update to v15.08 or remove Everyone group from C:\Program Files (x86)\ControlFLASH\0001. 1756-ENBT module has a crafted CIP packet DoS vulnerability (CVE-2025-10478); Rockwell recommends upgrading to 1756-EN2T or 1756-EN4TR.
Tycon Systems TPDIN-Monitor-WEB3 Multiple Vulnerabilities
CISA disclosed three vulnerabilities in Tycon Systems TPDIN-Monitor-WEB3 v2.2.9 and earlier: hard-coded credentials (CVE-2026-77847) allowing MitM attacks and credential interception, CSRF (CVE-2026-82712) enabling state-changing operations, and missing authorization (CVE-2026-82684) allowing extraction of system credentials, configurations, or flash contents. Tycon released firmware v2.4.2. Units running v2.2.9 must install the legacy .hex build; the signed .tfw container cannot be read by v2.2.9 updaters.
Inductive Automation Ignition Project Creation Misconfiguration CVE-2026-77393
Ignition 8.1.53 and earlier shipped with a blank "Create Project Role(s)" setting, permitting any authenticated user to create projects if they can execute gateway scripts. Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected. Inductive Automation describes this as a default-value configuration issue, not an access control flaw. Users on earlier 8.1 versions can set "Create Project Role(s)" to match their Designer Role.
OPCFoundation UA LDS Privilege Escalation CVE-2026-77477
An attacker can intercept a high-privilege console window launched during OPC UA LocalDiscoveryServer (LDS) installation, requiring the ability to launch the installer with elevated privileges and keyboard/display access. OPCFoundation released UA-LDS-Installers 1.04.420 patching the flaw.
Microsoft Patch Tuesday September 2026
Microsoft released updates addressing CVE-2026-62906 (Discovery Studio information disclosure via SQL injection), CVE-2026-70178 (Fabric privilege escalation via missing authorization), CVE-2026-69857 (Cosmos DB spoofing via authorization bypass through user-controlled key), and multiple Chromium CVEs ingested by Edge (CVE-2026-84323, CVE-2026-84324, CVE-2026-84325, CVE-2026-84326, CVE-2026-84329, CVE-2026-84348, CVE-2026-84351, CVE-2026-84356, CVE-2026-84358).
Attackers increasingly leverage legitimate tools, trusted platforms, and AI to enhance operations while evading detection. The Chrome zero-day marks the sixth exploited in 2026, while SonicWall SMA 1000 faces the fifth KEV-listed vulnerability since December 2025. The massive driver's license leak underscores identity verification platform risk, and the 469-location Shai-Hulud expansion demonstrates evolving infostealer targeting of developer credential ecosystems. Recorded Future's H1 2026 report identified 215 actively exploited CVEs (up 34% from H1 2025), with 60 RCE vulnerabilities combining network access and no authentication requirement.