CyberNews: 08/09/2026 Edition

Today’s roundup

Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

Trezor Supply Chain Breach Now Impacts 81,000 Customers

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

BigBear 2 PhaaS Campaign Steals 5000+ Microsoft Credentials

BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

THost9 Android RAT Pairs Packed Loader With ADB Worm

Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing

Summary

Adobe patched CVE-2026-75650 (CVSS 10.0), a maximum-severity flaw in Adobe Commerce and Magento Open Source dubbed StyleSmuggler by Sansec, which saw zero-day exploitation starting September 4, 2026. Attackers used it to deploy a Rust backdoor and a PHP web shell.

Researchers detailed a widespread data theft and extortion cluster targeting Microsoft 365 and other SaaS platforms through fake IT help desk calls, adversary-in-the-middle token theft and residential-proxy sign-ins. It mainly targets directors, vice presidents and other executives.

Red Hat disclosed a FreeIPA flaw chain that lets a client that has never logged in create a Kerberos identity of its choosing and end up in the administrators group, gaining reusable administrator credentials. The attack also requires a second flaw in the 389 Directory Server database software.

Security firm Calif built a worm that takes over WeChat accounts through an incoming call and showed it spreading among three test phones on iPhone and Android. The victim does not need to answer, but the caller must already be a WeChat contact; Calif reported the flaw to Tencent in July.

Crypto wallet maker Trezor said a data breach at its supplier ShipMonk is far worse than first thought and now impacts 81,000 customers.

Researchers detailed PEEP, a Chromium post-exploitation toolkit disguised as a bookmarks extension. Its installer, which requires prior administrative or code execution access, injects the extension into Chrome and Edge profiles by forging Chromium's Secure Preferences, bypassing Web Store checks and user prompts, and turns the browser into a backdoor for host command execution.

CloudSEK uncovered BigBear 2.0, a new phishing-as-a-service operation targeting Microsoft 365 that has stolen more than 5,000 Microsoft credentials.

The DFIR Report uncovered BengalSEO, a search engine poisoning campaign on Bing that delivers MayaBot malware and tech support scams. It has operated from the Indian state of Rajasthan since at least 2015, driven by two IT service providers.

THost9, a new Android remote access trojan, hides its payload behind a packed loader and uses ADB to spread across exposed Android devices and containers.

Grindr agreed to pay £26 million ($35.1 million) to settle a U.K. lawsuit filed in April 2024 alleging it shared users' personal data, including HIV status, with third parties for commercial purposes such as advertising.

Want to dig deeper?

Vulnerabilities

CVE-2026-75650

Critical