CVE-2026-32475, CVE-2026-59309, CVE-2026-59310, CVE-2026-59346, CVE-2026-59347, CVE-2026-63077, CVE-2026-72898
Get tomorrow's brief in your inbox
Today: ShipMonk breach exposes 67,000 Trezor customers via zero-day SQL injection. JetBrains Cadence compromised through unpatched TeamCity, AWS credentials extracted. MikroTik routers hijacked via unauthenticated SSH exploit, patches available. Magento zero-day actively exploited to backdoor online stores, no patch yet.
Magento and Adobe Commerce Zero-Day Under Active Exploitation
Attackers are exploiting an unpatched vulnerability in Magento Open Source and Adobe Commerce that allows unauthenticated remote code execution. Dutch security firm Sansec reports attacks began September 4, 2026, with successful compromises on fully patched stores running versions 2.4.6-p15 through 2.4.9. The flaw, named StyleSmuggler, allows attackers to execute code on the store's server without authentication and install persistent backdoors. Sansec reproduced the full attack chain on clean installations of 2.4.7, 2.4.8, and 2.4.9. Adobe has not published an advisory, CVE identifier, patch, or workaround as of September 6, 2026.
/wp-content/uploads/elementor/forms/ for PHP files and logs for requests to /wp-admin/admin-ajax.php. Note that headless and progressive web app storefronts require GraphQL, while most classic and Hyvä storefronts do not. Treat this as an emergency mitigation.MikroTik Routers Hijacked via Unauthenticated SSH Access
Attackers are exploiting MikroTik routers with internet-exposed SSH services to gain full administrative control without authentication. CERT Polska reports successful attacks dating to at least September 2, 2026. MikroTik released patches across multiple RouterOS versions on September 3, 2026. Compromised devices show suspicious configuration including unexpected highly privileged accounts and account-creation logs containing ssh:-2@. MikroTik's flagging system detects suspicious configuration at startup and disables affected entries.
/system/device-mode/print to check for Flagged status and inspect logs for unauthorized users, scripts, and configuration changes. Until patched, disable SSH exposure or restrict access to trusted management networks. Do not initiate TLS connections or use RouterOS SSH clients from unpatched devices. If compromised, isolate the router, preserve logs and configuration, restore factory settings, rebuild from trusted config, and rotate all passwords and keys.FalconFlank Zero-Day Escalates Privileges on CrowdStrike Falcon
Security researcher Chaotic Eclipse released FalconFlank, a proof-of-concept zero-day that escalates privileges on fully patched Windows machines running CrowdStrike Falcon. The exploit code was published to GitHub on September 3, 2026, without advance notice to CrowdStrike. No CVE ID has been assigned.
JetBrains Cadence Breached via Unpatched TeamCity Zero-Day
JetBrains disclosed a security incident affecting Cadence users after threat actors exploited CVE-2026-63077 (CVSS 9.8), a critical deserialization flaw in TeamCity. The vulnerability allows unauthenticated attackers to bypass authentication and execute arbitrary OS commands. Exploitation occurred between August 8-24, 2026, despite the flaw being added to CISA's KEV catalog on August 5 with a due date of August 8. Attackers accessed a 2024 Cadence server backup, extracted multiple AWS IAM credentials, accessed S3 buckets, and potentially reached storage containing current user data including email addresses, project source code, and credentials. JetBrains acknowledged the affected server should have been patched as part of their vulnerability response efforts but did not explain why this failed.
api.cadence.jetbrains.com) offline.Trezor Exposes 67,000 Additional Customers in ShipMonk Breach
Hardware wallet manufacturer Trezor disclosed that 67,000 U.S. customers were impacted by a breach at shipping provider ShipMonk, in addition to 13,689 customers disclosed last month. Exposed data includes names, email addresses, phone numbers, shipping addresses, and order numbers from November 2019 to August 2021. ShipMonk reported the breach on August 10, 2026, following unauthorized access involving zero-day exploitation of CVE-2026-72898 (CVSS 10.0), a critical SQL injection flaw in Metabase. Trezor repeatedly requested and received written assurance from ShipMonk confirming data deletion per contract and data policy, but the data was not deleted. Enterprise blockchain security firm Holborn attributes the attack to ShinyHunters extortion gang. Hardware wallet security is not affected.
Elementor Pro WordPress Plugin Exploited Following Patch Release
Threat actors are exploiting CVE-2026-32475 (CVSS 9.8), a critical arbitrary file upload vulnerability in the Elementor Pro WordPress plugin. The flaw allows unauthenticated attackers to upload and execute PHP payloads on affected sites by submitting a form upload field as an array with an empty slot followed by malicious code. When validation encounters the empty slot, it triggers an error and returns, bypassing validation of remaining files. Defiant reports over 190,000 exploit attempts since the patch landed on August 19, 2026, in version 4.2.2. All versions up to 4.2.1 are vulnerable. Elementor Pro has over 6 million active installations, with WordPress data showing approximately two-thirds of Elementor's 10 million installations running vulnerable versions as of September 4.
/wp-content/uploads/elementor/forms/ for any PHP files, which indicate compromise. Review logs for requests to /wp-admin/admin-ajax.php. If evidence of compromise is found, check sites for backdoors.REVSTEALER Modules Disable Windows Update and Defender for Crypto Mining
Elastic Security Labs documented four previously unreported programs associated with REVSTEALER that remain after the infostealer deletes itself. LockAppHost abuses Windows CMSTP for privilege escalation, adds Microsoft Defender exclusions, disables 5 Windows Update services and 13 scheduled tasks, then hides a cryptocurrency miner within legitimate Windows processes. ProManager overlays fake windows on cryptocurrency wallet applications built with Electron and captures keystrokes. The modules share REVSTEALER's build tradecraft including the same packer, runtime function resolution, and Polygon smart contracts for backup configuration. REVSTEALER has been sold commercially since at least February 2026 and spreads primarily through game-cheat lures on YouTube and pirated software, including a fake "Claude Opus 5 Free Desktop" application.
[kworker/u:8:0] and binary at ~/.local/share/.gvfsd/gvfsd-user. Review Windows Update and Defender configurations for unexpected exclusions or disabled services. Block indicators documented by Elastic Security Labs.VMware Workstation and Fusion Critical VM Escape Vulnerabilities
Broadcom patched CVE-2026-59346 (CVSS 9.3), a critical integer-overflow vulnerability in VMXNET3 virtual network adapter that allows a local attacker with elevated VM privileges to execute code on the host. Also patched is CVE-2026-59347 (CVSS 8.1), a stack-based buffer-overflow in HGFS allowing code execution as the VMX process. Both flaws affect VMware Workstation and Fusion versions 25H2 and 26H1. Successful exploitation requires local administrative privileges on the VM, which can be obtained through separate compromise. No workarounds available.
Supply chain attacks continue to expose the gap between vendor assurances and actual security practices, with Trezor's ShipMonk breach showing data retention despite deletion confirmations. Zero-day exploitation windows are shrinking to hours rather than days, as seen with Elementor Pro's 190,000 exploit attempts since patch release and the Magento StyleSmuggler attacks beginning the day before public disclosure. The JetBrains Cadence breach underscores that internal patch compliance failures can be as damaging as external attacks, particularly when the vulnerable server escaped patching despite a CISA KEV deadline.