Duna's Kiat
All editions
News

CyberNews: 09/09/2026 Edition

Today’s roundup

  • Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
  • Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
  • SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
  • F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
  • Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed
  • ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account
  • Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
  • Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
  • Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
  • New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

    • Summary

    Microsoft's September Patch Tuesday fixed a record 974 vulnerabilities, including two actively exploited Windows zero-days. The release covers 723 flaws in Windows, 111 in Office, 62 in SQL and 22 in developer tools, with more than 110 rated critical.

    Google patched 230 Chrome vulnerabilities, including CVE-2026-87491, an actively exploited out-of-bounds write in the V8 engine that enables code execution inside the sandbox.

    SAP fixed CVE-2026-44756 (CVSS 10.0), a memory corruption flaw in SAP Extended Passport (EPP) processing in the SAP kernel that allows unauthenticated remote code execution.

    Sophos reported that malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances injects a PHP web shell into memory whenever Apache loads one of three of the appliance's own PHP scripts, so checks of the files on disk come back clean.

    The researcher known as Chaotic Eclipse released a proof-of-concept for ShieldCrash, a new Microsoft Defender zero-day assessed as a bypass of the patch for ShieldBreak (CVE-2026-69414, CVSS 7.8), which the researcher reported last month.

    Check Point Research showed that a single instruction planted in a ChatGPT conversation could make ChatGPT secretly work for an attacker while answering the user normally. In its proof of concept, it read data from the victim's connected Gmail account and passed it to a second ChatGPT account through a hidden channel.

    Google Threat Intelligence Group observed a financially motivated group using an autonomous, multi-agent AI attack framework to run a large-scale credential harvesting campaign that compromised thousands of credentials in under six hours.

    CrowdStrike is tracking Slim Spider, a previously undocumented Brazil-based financially motivated actor targeting Brazilian financial institutions since at least March 2026 and stealing crypto custody secrets, showing deep knowledge of the country's financial infrastructure, including its instant payment system.

    The attackers who took nearly 4,000 bitcoin from the Liquid Network on September 6 by exploiting an Elements bug returned 3,400 of it the next day, but about 598.5 bitcoin is still missing. The Bitcoin sidechain remains paused, so L-BTC holders cannot redeem their tokens.

    cPanel patched a flaw affecting every supported version of cPanel and WHM that lets an authenticated hosting account with mail privileges create arbitrary files through EmailTrack and run code as root, taking over the entire server.

    Want to dig deeper?

    Vulnerabilities

    CVE-2026-87491 High
    CVE-2026-44756 Critical
    CVE-2026-69414 High